32e3e346d5a0c61f861d559a26539db17ad4a2898e0d554ab7b52f032f9a3687

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d7545fdd1538df6edabceb1c56681e0_JaffaCakes118.html
Size

142KB
MD5

5d7545fdd1538df6edabceb1c56681e0
SHA1

100b219aab14a7a1a97d0d408e5c294f1e4cacd3
SHA256

32e3e346d5a0c61f861d559a26539db17ad4a2898e0d554ab7b52f032f9a3687
SHA512

5c0bf8764f47fa2e5081de045e233ef06c3c55f10ee0867600e88e4ea01a0b2283e770d3f21b340e2d9ab6f95e39c69199d46df31785d1b23a970f73bb3544c8
SSDEEP

3072:S7yCvcfx7dyfkMY+BES09JXAnyrZalI+YQ:S7yCvcfx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8933101-166B-11EF-BA8B-4EB079F7C2BA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422345632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1788	1800	iexplore.exe	28
PID 1800 wrote to memory of 1788	1800	iexplore.exe	28
PID 1800 wrote to memory of 1788	1800	iexplore.exe	28
PID 1800 wrote to memory of 1788	1800	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d7545fdd1538df6edabceb1c56681e0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca754a19928244fc3e57df1ee891fad5

SHA1
ff54b808975fd49ecb174cbb74dd0624d81b179f

SHA256
6b1d88c47ab25435647a811e03fd0c6cecf83a297c87cb3f5d35fa6b1cdbdf5d

SHA512
d66bf1828568075f8bf5723270781cf0fbc18a9bf7d32de18232ec369ff6388cf9f68f74a9747671bb9f5a48046936402b14651e535f94c2d0bcc0857d039257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d81f65414baf4b9f70307591d2dbfc

SHA1
76c28ca08adaff43803fe88827d670dcdddf54bb

SHA256
5a0af3fdc3edb83d82b28ac7749f267cb248a4b893b050afc5fc8c8befc4d677

SHA512
465475a840201c03d8ce3c08ce8cd1255d6d1d1a9f8956d5897c2ea3d89216000d0b39524c6458a39eafd17af0838b0e496545ec8a2a6fd7279127699546a6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ba20e67d9f6d68d70daff0ea7f9af4

SHA1
f0a63eadf16215738a7198817a5234dc3627f5a9

SHA256
6b7367f65b4f2cb795375a5e8af970202263caf3f3b77d0ff1e0b1f053667e12

SHA512
b2f1a817c0f51721c33e970378f853e66ed7c04f9e42b5d23e16272101f368b5754dba2475e68a8b812cf1d6ea20268f6d448b48a271f4af3b30c6a6dad2c9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6f7129c7567f88eaeed380356a343a

SHA1
55acb373c836a3294ea540e3a2f4b97af1b45cd3

SHA256
043c714bdf680a44ffbea5b4bdfa077f048ae3ad4fa0d6933d90cdc26f82434d

SHA512
aeb16750a6a927c14f5ae4beab240a07a8a41815961779e627393a6892f4e6d378410fab278cd84cedba21aeb43a0cb0020a33699f2d1409ad4b81faaa339f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3195288c99d560265f3af9761dfc684

SHA1
1c1cb8eeb25486cd02f7603871048cb59b886af1

SHA256
69f3c2fcdff87b0ae50f3ef87d4175fa5a9f11aa3e90fcf23dadd5e18b5527a9

SHA512
4bf0d1bc95822b392cb5c6b20adf038ec21c536183c9ecb0c4fdfc15c0fc2a88926939fa88f34816e2d8f3b81a2eb15ef145373dacaf3a9b506db58a514824af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9ebffef62e217e88ca01ffffcffb31

SHA1
ef856539192e4e6515883cc411e461655881c960

SHA256
145040016808da4c674d33f2de395ea81ee0f458c7d8c839488ee65040ed5754

SHA512
c21ce5032dc9ce71cc8357b25852f28ca833626670b187994bca97bab4a739da1760d4f412034fd99245f2948506d7c0393af616f5af2e67d472eff33bcd8550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c51b9b8fcd000250434102d6ca3dbf64

SHA1
06be8d7183e6af5a0e7684897f7f1cf1ad0c52e8

SHA256
5003a25c6ddd9a084b0ce25abd8f01adbd02f2a72b96059cc9ff832552774c27

SHA512
17d6349e41f7e8ecf93ef776b8a7fc42c592aab2619d57cf66d78fb7476b809fa9b1f4dda77be76463b25186c6ae3efb2e01e5a7f921fc5ac9bd2fef7fca2f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
288a4eab0101e5d08d3771d1cafe1195

SHA1
954384446cb7101c931508b8ebda0d7704b740c1

SHA256
93a7eb11c5c0970ed0b85d6438341ea448a203913c9e063b843d886485e022f3

SHA512
4fe352d8a5addcd5b5e5b0c1517ee71e6a13b699e6d492a7251a72f9e1ce899181100e52f21d6915c457a70fa3780788b1d057529cd1fbc9c91d9fffe0b15d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0570a6f0a22ddac961a09fa70fe62488

SHA1
74434dc5316ad3fffc43f590f6c6bc84b20e1113

SHA256
874da478c784e8bb8dd5d12de51bc08bc3bc25c14986727c21d67727b9ee2701

SHA512
1f5f75acdb9c509cb81a4c00303afff8970685e248d5d8caa639dd5e43f7857a67ac5e1c2e0fdece48fe613e9e2c7b514c2dabe1f47c8c916d7fa48302c0be80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2712.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2773.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit