542bb15426a96780270979e15800f9e1c4bceb8040decc6d6fb032e7780cee1e

Analysis

max time kernel
148s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dca8f4b6933cdc80629e8b109e41269_JaffaCakes118.html
Size

118KB
MD5

5dca8f4b6933cdc80629e8b109e41269
SHA1

a506fc8b28723902f30b238bdbf3476139e2491a
SHA256

542bb15426a96780270979e15800f9e1c4bceb8040decc6d6fb032e7780cee1e
SHA512

2d91cb086b5c708f6e5fdeca4beda48eba283cf6ffecefa2bf5761bd06067d38146c4583ad650b868a6c8cccc29423ea62abe9d3c99902b9a1997716f643876e
SSDEEP

1536:SSEg5nyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:S45nyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6EAF381-1677-11EF-92F7-4AE872E97954} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422350811"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2372	2908	iexplore.exe	28
PID 2908 wrote to memory of 2372	2908	iexplore.exe	28
PID 2908 wrote to memory of 2372	2908	iexplore.exe	28
PID 2908 wrote to memory of 2372	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5dca8f4b6933cdc80629e8b109e41269_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
686103f115f33723e27e91e43e6ffb19

SHA1
ee3ef4d1abb2b4b42ac2dcdb284943fe0a1a3186

SHA256
59f35fbee2f9752c38ce05cfd3165cb6e51e3fc76fc9746d0788092cc5c026a5

SHA512
de9a519fc855408a5b38adec1920b01434e525bc00d2b663443fd532249ce1de0a85458005873067d4182c79f7d5c6b0811a75afd460e39265da893cba09e24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b16e62398f7851f550e3d016ca8b397

SHA1
e22f9364033edec114d5d4319c814717d3f73aeb

SHA256
9068b0ce794198833a8ab28893b590f96eca2ff80d5139a1d8b888ecd70e78e7

SHA512
790e6be63d862a46ee9b9b0ef66edb252d33551c0a2347e36087212438f05f25e043e425729d895c3b979a0b32f87b2d05ba848a410e2bb8a1ede057a51d379c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c054e99a70d81dc52af9fa1762a4926

SHA1
5c312a931b241623ac214cf253d82771aefc05fc

SHA256
a8698930f91a2b8d5846162ef3d1daa686e38a626881cca9df7ce360cd90e280

SHA512
0812d3836142da44495213884fa09c6f56bbd887cf3c44ce3a6f92e74f8227454e888240a0bf861ca06dbf1f2a351c85c850eaf476ecc22a559343d708fc3e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a308587da6fed119df3c7f9c09106dc5

SHA1
f8e61915d05c35c62a31a0e490a9a551084e1ed8

SHA256
10f4d2ebf6a344e5cd940abda3fe88422cb024c5530c3fc70940c89e74969491

SHA512
6f9bcc5c67147acd1636e495363049913aca11cd3a8374410402dc3a47d88305526412daf87b67c0d1866fe507eff3813bee2631321d980d8fa3cef6cb255041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f69b9eda8f3042b29df53e8a87e897

SHA1
44e16b6be5f51066350a241faa97caa7f73894f4

SHA256
a7e48357876c2bdcec7558d97aeb5e42317f498cb7ec68b81e0bc1345818ff93

SHA512
c0f12469641f30431197d5d3bee4a2c423d4ce70a6ef04093ebc9df788f4fdcd2ce58b2ab10c787af7089496c93a4b4e431af0e058b2cd3751238c414a6914b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c63a191e57d265cd60cc6f54787c32e8

SHA1
ef3b4f4505800b4517eef5c109bdcf889d5cc347

SHA256
d677f463c76d57672cb93ea233f6704154cd9399aee78d15e1edb7cb5de47ae1

SHA512
1df7013da9e6bdac3c9b72a6c7eeef5f9c8db01166ccfbc5d7e1c9557ecf3dd9d7653bbaab40b326ed5803146c74d36ac8f38d0017e3bdd408d4f6a7847d8187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d22fccdd99d1355ddbca672fab7616

SHA1
51ecc907e8c72fdc018af488bf08d19419d73f90

SHA256
511e18e36d2ba7b2e9e31232252279313f0ea0a3d1c0b2d336c17a4a414c0de0

SHA512
7dad8263c892b0b3915dcf494c08179db7ecdb660187e41840eda447559059ae4e19e93439b4cfadc894ed1562bc9f4451bf5d6d6e7dc26b09f102eb8dafce8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f2bc74bf452af6f1608cff6be2c1c2

SHA1
4cc604009a17793f8edfaabc2d40f4360b9e7e21

SHA256
f8ef9574f4f60a1dad13bf1dd5e8c3a29d4f5d64344a56692edfd52e46bf48fb

SHA512
67fb86fadcd202b8b9d05a4829411931fa0c47f32ccb4d0a2d50b28be79ad1577b362d692e2bed5a31ee1233fa075120dc86efbcf7e49604b59d08186eefed63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c8648d62dc872b9811f35fca27847f0

SHA1
39b59c733a060481936abc5ad589606266e5a661

SHA256
79e5f042f844c21ceaacb6175cf5555df4b1b532c864026507a5d222fb83c29e

SHA512
9cf7c57bb49fb9bf65a0c51cfc4061ed7968f110aebf39772e07117ae9008d03113cf254618c87d7191e4de926af856b000a5d1f3af1e12b062d5d90e2002639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab977.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar98B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit