b0c87f8b2c30d333f30d79fac429e32bb4420542adfb834456a7403e7283352b

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e492f9e0f83b4f05c64d7f719a6fe41_JaffaCakes118.html
Size

57KB
MD5

5e492f9e0f83b4f05c64d7f719a6fe41
SHA1

af7b2b40cd2cbbf832d48fe29fddaa80fef49027
SHA256

b0c87f8b2c30d333f30d79fac429e32bb4420542adfb834456a7403e7283352b
SHA512

843971a59ada5f8c79581a037f17212ec1ce794d4e4a80d6c8d4385573e59a0168919d3e15a501b0eeac05a973d854e050315aa824ddb0d1ba82d711663e61f9
SSDEEP

1536:HWheHuL8G/mHKnY/2c1Hzxs5adaVY86/sglFFyKT3sRkgfB:HWheHuL8G/mHKnY/2c1Hzxs5adpxgJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a88fc53a3af858313c193a3a17d84b6b140bc2c662a0e49bde95c8f8a27bb59f000000000e80000000020000200000004ad95a81b969ef771d41767178c256678cd594f7d5c205df730e5c3c630b543090000000f50087fac8e2e2fe9f1dcf105da45d4bb4cc06d6f21f3607b736581f78194723e5283f8a8d1aeaf56bf5aa906653aa84af3524c0e3c232fdb405df19b616fbb1b5f12ae64e6d5a5acb68a534749664816b632993fdd7ecc53ca90239fd6acc9dc19f5d1fc52f209884b4121e8cebec29b2654794dfa91ce5e23fce343ed38dbaa13cc3afa2c767e3167219e8c0a69e7240000000b6b4efd338fff70464b3725731cc6a74cf67b529eef8a8213c18cff3179c8a4eff0fdfca3986a8ce743cff9d487fd9a4efda4b49b60aab5fb58b17f14af9e4b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{152E6F31-1689-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ab090077717549d4209fafcd0d8575bfcfe754be53765be135ba06e856f85d10000000000e80000000020000200000000a321bd96fc98e0ad0acdb0f35902ea52ad44a121ccc0cf8a90a12bb233c71b42000000072991e7779c87d2146eac8e7376176f874faa0b07061a7bb87b2b7d8ce44a0eb4000000046fc5408dec82d292383b5a7f1e779026dcd0cc14f8e4dea1e4376a66e52e7ccca76ca047ff7af2e8fe6ba2889911dbc9449aeeb9d9cbae6c17de57604bfa1fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422358217"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07b0aec95aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e492f9e0f83b4f05c64d7f719a6fe41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843827da651eb758e5ae93f603c75db7

SHA1
b3ebe5d27f1fab616d10c984869bf0898c5c225a

SHA256
85272a16a88c19626c7c6570dfc7e77deb72ce2522cd4d4ab1b1feabe5b25432

SHA512
10a886d56da384ecf0b341e1be96356a0cf82b0c6ab231c1952b33e57fc0b6c6990087dcd55f9a052a53346ab2171aa1b469dcce00213c855691c73cece05d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b52cce47f0199eec14841e05c21983b

SHA1
92d5a5b406eef2e68a1ced2ebe052ee22d71d53a

SHA256
25918835b7dd6cd2ec95bdd3f7eb358daf1b92cd3f09e3277c2c7d2473f52e5a

SHA512
a18b686e16aac84f822420014fe0704ddc8791d839e9b704afbea84973a8c6332cc2d16228be6c04de5c8e3755bb3802be903fce0e437a3ed69798c825680895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ab6c4ba7e30a08aeb7d51f9f3a512d

SHA1
c98700eb99ffdd81cb5d6d353c7f76bf04c6f728

SHA256
c4452c69833e66bedbfa283678cb4996be6e88b134165af3ccec3d5505380ef6

SHA512
012b1105a04ebac71e7cada5a1c5cfde8aa794558d13ab42530c2d7afe1093c69e7cb79e61dc2457142ff4b23b905f62794097a72328ea784f76a375d02da0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dadf9eaf4cba59e764e105fcbae58e0d

SHA1
7ac03ba4ea13ce809194018cba03839aba129aa8

SHA256
c0a77768c89b153e7d98f59accb72bb0bf0aa7c84ce8bc1c2f97da8d171067c3

SHA512
33d38db2b987c9792a4947379d688d859278f0186bca191366e04bcaca6aea4dfb6619dbd828c2ee0dbda863613eafb057db135cb05f083c8adb40f14d78b3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ac04648a991ec19f66ecf14f6ec12a

SHA1
7816048fc562680430a169450f0f675b94d94929

SHA256
e3986807c8feeea05a8ba2ada609187f99f661e8e967acdd5df5b565d4138aa6

SHA512
f0ff23853c084ca6a374cb2d9e2d67cf03b7715145ce54293b8f530e849f46c32f273bb81b5849d8b836835f8ff8d5e3f223185c2597a28a3c7f2912683c4e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1b3362cb9fed562f4d0ca7a1739678

SHA1
a3b0801e4b41c1cf72effbb8b4f6695616f50433

SHA256
08bcce1d6587e5bb9768259759a04b39281b1483af916b3aedbbef6fa6766f6a

SHA512
ebe3ba4185f064c064b8880f56471c4469a16ac0419b01990ab0e628083526e80f694fbc1b17d8717477e7f4c0859a6852f0355f4e49a227ed59096d72547f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd7b89b88e15ce040938ffca9f2195a

SHA1
5d07208bd5646a63b7e39872c101b55fbdb9fbb8

SHA256
f003613e62b345c9cc3962b81e70b7333cfc3753e532d4078941ef7732ebe1df

SHA512
ceb21176980e1f48c0aa4c850f350bd30aee708771dd51f7e42348639a322eeb67beb4217a044aa9ffdbfc96ad094cb9fab6593befa3413bed9eba9015d64f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b60fc86799a05f0669d4d778443261

SHA1
ce710e6965060697c1db4598df439d212ecc42cf

SHA256
ffb463907033505e9532f55e799bb91f52515f8f5edbc436bc077a5aecf15b7e

SHA512
72609417781f7a1d3913f6eb25f53bace258671dca157a5789caac3391389d14bc01d588edb01fbd7535d9e7133c1e4ba4cb3e203e48e2ddbb7834da807d929c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98af9815702665a15c9130545f17e619

SHA1
e0983d54f441bd9354ea5b2ca90056c4ee1ab15a

SHA256
bad4a5a46643b800c362652048dde9a3dc6b5525edb3456673f7938f4802cef6

SHA512
badfe52d210f4a7e35d9b232f40b914d95e58b05f3281683e160e61f41e0feb5231160afa795d3404aa2b408706e5a44b91cafa354bf711ad06f948eb97bc3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
239e8a0b4bb33143bedee864b05ca9f8

SHA1
dba5886e9cd5c0681626b773d98bb2eb1fd795d1

SHA256
db584a705db6e42cf85867b331f0b39cab6e219a8937fef25593bbfb9b441778

SHA512
f947cc5d70cb8bedbfdf88e068dbd86ea016529124ebd8042449913983ef52bdb633a060f54399f6171b63c03c070f5c64b563c04175417097cb9daeb1495031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc98a53ec3472b009687971f7d732ea1

SHA1
ba260a2db8497493e2472fa97465259fa28de7de

SHA256
15673d813adb6b16780d0f99bca424bd2980206f10733008bdc5fa70488cc756

SHA512
8761d1a65f0b84186368ad9f96ffeead3259a58a0d147b83f8f5680c05c77a8e9a4bcd14112c7ba47e3f60344992b6b1f40eafdaa2595f66b559aa6e9f5acde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
240a51b2e36f65556b181bdea35a30cb

SHA1
0ad5f77a51d537f3f2ad8af935481c42355ce95f

SHA256
6ba6f3c4eb8a222b83a96b3c615a57278c9fa4aea43c4f08c7e645a012acfe67

SHA512
3f8b25c34625fdafd37e53cd0880f0d0cfefb5e7b78763e3dc1622dc95b417eb5f3b21e173b2df02d6bbf5cd62f701c34157653ed94c0929095fb0d8ee1553ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f83281cacbebe4b2fc49f794967dbd33

SHA1
ee11a30f3a77fb1d1d8049a6e54d0d240f4e2527

SHA256
b27c14408fcabd2b9c22bbc0fe6daf3cefc7e1afc4e0bc5404024f809d6fe9f4

SHA512
7e63f0b9576381e472dc069d085903ebeb4fbc8f97df39589b33e4d1730dc80b120f0fa0c53de0363648cda72e1fdb9521532c8e45139889f13996d6143a083d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49AF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A11.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit