428df80e9eeb261679714606248ba74400964bf5a31140a776a0bfff47aa0a24

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e1dbb610682be9b7cf893b4efd81ee8_JaffaCakes118.html
Size

41KB
MD5

5e1dbb610682be9b7cf893b4efd81ee8
SHA1

b6407a66aecb98d3417a05cd408c2a6872003c91
SHA256

428df80e9eeb261679714606248ba74400964bf5a31140a776a0bfff47aa0a24
SHA512

6f20e97703bfec3086d8a210636beb81018cb51a29087c25cfb060e66b585f77f09692866b914b5fd17bde45e5bed10f72e9f5e179f4a12f9493404c69ae661a
SSDEEP

768:ZS/Z6jIwaHzjoFZFBCnF5EddRFYQAp6Qh+DiJrEx:g/Z6jI1zMZFBCnF54RFYQiB+DiJrEx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C1E8E81-1683-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422355759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2944	1636	iexplore.exe	28
PID 1636 wrote to memory of 2944	1636	iexplore.exe	28
PID 1636 wrote to memory of 2944	1636	iexplore.exe	28
PID 1636 wrote to memory of 2944	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e1dbb610682be9b7cf893b4efd81ee8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c479ada3480db7cb1cf482438e880d99

SHA1
389799d81f7fca87f789f713cae0ee3f7676bfd8

SHA256
9f093959b1c2c30e8f8e31f182e2dd9e6b42b3525d0521077e33a3190daaa0a9

SHA512
50a6974c7dc1e11dc5429ec50fac747643385087f3c59417504a99856cf994b45e19dcbf47c59e43517626fc83a61b4ae356530159f81534bafcd31d157843f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1d807c3a672918f9a39de5f4b13a7c

SHA1
874d0f4cfd47070f7c0de72da3c7e4612c8ab0df

SHA256
ade9f655e314f912a85149a63615da14930c37686638fe64f2af99f87e78264e

SHA512
8aa05cee47461c9be71b4ebc7a5ededc4d37c966c3b0452ebfa8ee97421e7aff20f9b860562bc60cab282e5219bdd763442ede0e3fda8babcae9ebaf05cd1dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef92127fa0ba5219c1a8306024d18517

SHA1
f8b5d3e9d6f1c3e969491f6921efbd860bccaee5

SHA256
ab550988a06ed7acaf74091377af207b73bc97f1cca2c3a10db7b730ce2a787f

SHA512
98688aaaf31c7b4e002a85a99053a627297dd022198e2d6199790c5212f476de842447265cc1fac828c01718d6cf8b4f64d3eef17501aa983acd2b3acf386206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8b9e52a914e7c1644ccb28cea0d294

SHA1
b6fb6a35edc34d8f67ad2c4125b08a729db9d262

SHA256
638498ae5aa21b937727bfa6a01bc89bd065dc8475b043caf6c252852e5b57c5

SHA512
b1dca98766d53ce3080f962fbb957c9b6175e85da51193bddbb4788430771648bf74c950eb128670f35e0aca2d1edc1ecf2e504c25b0df9f1c66bbd2a733cc99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627faf473441204c3f61019ed4848824

SHA1
154541326e6b734fc6343aca1ae2cc1c1d592b62

SHA256
dd6991a6990d02a535324dab6895e3c963480d0a4805910e2d6d85bca4ec03f5

SHA512
69a27711223b47d9273977ac257adf8412b2312d59822a7dbd749c87e0e9cf7c430564b884dafa8abd1d225ae77d3dc848de3eeed1fa248e9ac045ae3105bfc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b26272ab432d7af949286f45dd27de

SHA1
150c2a1f0881cff89e27b01bab4f4691f1ff6c32

SHA256
469bb07d94ce4a21c36e6db94bef716978f603df5e16344a175b6ad10ac27dd3

SHA512
7e546e6eb726e014557905f4780e380530722cae130a5be54ed4388ef96dcfc36158baa707e460a4403d02215b8f1ca4a648a9708d5a39847b1e295fc2edb497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3200c23ff2d9de2c520dc1f3bb3e2b10

SHA1
8ec6317a38147792368791fb3c44629abe2776a2

SHA256
f737482766c67bf924e314590bbdcc640ab1ac891a28aa745e9525365cc69fad

SHA512
363236cbcdf3df5c712f36d149ad7bd9c1a4b4598112c46c1430de6a29f53783ffaf290157fc3a45f688646ed76be20aa52a4dd688cbee3f7489961416d45195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ddbeebfa9d177059b1137bfbbffd14

SHA1
5ef2b2f382455a379c4f27cd6e16e5d849f5059e

SHA256
3e7d3675226efd5ae35ebc52781477bacefcab76041de30654f667f2a7b06f48

SHA512
99398f2af9f414fc49659bdff3d58a83ce86e3dd4c320bfa70c9f406751e30ff04bf4013a74695118733a9a37d3c8392cb10277df3d960301871ea1053bcd50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
694292c86f8c891deed653abf9ce8738

SHA1
7b083597244c4734186de086b8b0efe6b93f423f

SHA256
df34604150a9b5907e0723dd31772d2d1f0f8c2379edf70a17bb868ab502ca8f

SHA512
d92b04f017f3ea3ed3c7a933722178fa96d2560d6ad33ce438583fea09f8c6fd5ae9aa7d0341842c637740bec1093d68a1d307718f701eaa782e47bacf856d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8afb5d617644400f4f6b481fff5f3095

SHA1
0cf09e6b49ad47867b42fa3e901758b59db85a2a

SHA256
8a5e18132501943bed76606776510e97f4f71e6130e384ee06209770ca509eb2

SHA512
9ad0a4c0da11f015cfd5e196eb0c1c33efb5a0b4d9a7de86288be02889be967586407855c0d8c109c0e5556dedabdefde8ccadccfd60abbb4fb7425463fdee71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7310520bd7306a28344ce7790c3d4f9a

SHA1
75270fb087965e10a783ab9cc62493f3efe24ab0

SHA256
20a21ef082cbc9683256e84ce9d2108d4cb1880efdf46b59082f489970513f6a

SHA512
99bb935aac2b04ffab3e2609ec73ece72c00fdfd5bf40bfb5683032cf6ca959624d5993e492e91667f5323734c7059da5b9a0c073e9164b28da1c0a372bea50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d041f13bf8c8948a5878705547cef2e7

SHA1
783f15fd0f7fe60748e939dc1d417dc84fe341b4

SHA256
618d13b6020519b9630cec6def678e5cc09ab3fedf3ac26d5d22f97ec8850677

SHA512
c4cf46826523c8baed85b7acfb2aa2cb4b2b353370ec880e5fe94590650ccf997c9cf4a8ef1b856d1589345c7562c35247e598a9f583fd6ddc1d7f5496227c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\jquery.min[1].js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23C6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23C9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit