d802e28502443994c38f8a6a77c52e71f4c06a3a88f57354b8876c8b61bb0372

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f9b001795a48e75ec129fdb2b03baec_JaffaCakes118.html
Size

282KB
MD5

5f9b001795a48e75ec129fdb2b03baec
SHA1

3e988814a24c0aa3529f04e1593cd8546cc8f3e4
SHA256

d802e28502443994c38f8a6a77c52e71f4c06a3a88f57354b8876c8b61bb0372
SHA512

61e3ffc845f5d57a9d5f4601078d7584572cb3c1fb737ea1f8c7cb2a95f33dd82b8d1ddba107a3c148c5921919e27d3b50fde25a714d49af4f8a5b1fa13fae12
SSDEEP

1536:FL5mnwlmpgb/7SkF9aQsTm+mHl0u1AmqmomBm50cEfO:bmnwlmpvXm+meummqmomBm5BL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{600A2FD1-16B6-11EF-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422377670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28
PID 2416 wrote to memory of 2372	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f9b001795a48e75ec129fdb2b03baec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7fde0f571d98908ad6fa425abb7d67

SHA1
ddb6d8658024ebb5b71685787422adac354a2ded

SHA256
3b3c77675eb0c5c61c15097660be33734339739e29497579cf48bd971d2e31d8

SHA512
ea268ab0f4ccab6233f061f66a9c92f1c6244dbb4e099d929920b9cc34229be4f1bf1230660f1ff6fcdc0e0c09d9845802d726383b830e31ce16e7c9dd3ca56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6153fd7eb081bb3c6745aa074cd2a54

SHA1
01501850a64835ed16fc298b8aacbc02e3d8863f

SHA256
2015927c203f3ef6d78e69f8481c662247c585b202acb902fb115e714ef870f7

SHA512
c3f5ab979c6ee6aa00c66457c17e031db7c26ebafc85264046fbbf1fd753b5041602c1d9b712b3398310ba8a4749be73a9c2c2a5f0ba41726b56fb21b0d6bae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b65ba8927477b7709c537a1100c3f2a

SHA1
74beab825548334164a203f559075655ed4f889e

SHA256
54af0690225aa1c686541249b6a067750b25b7a7bf652d2307d4ecf3ede52b6e

SHA512
94b5f06a4dfe60cba5c3c0de1e7966c078326a5378644a75d6d9cad79093037f1426ef4fbe29835d455b0f560083d6abab5ba9f09445e644fad82677469f84a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4559160541124e4e7ce28a48b4373813

SHA1
a4d437635dda310b4aec70380dca74a89ec77e40

SHA256
371946c93b83885fee553fe59939abfca947b02f5b46061a0f268a2477359c3c

SHA512
7561ac03d968d29c31fd4ba0247b5a2914186b31182823c248fcf9bb13cc6d33c98245c2427f450caa21b4ea181756ac70724077a6bc5ba3692758eedec3cf5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb43b708f22cb7ab0f30353c1493b80

SHA1
be8e377d789f633b5e94303026eb6ae9fdf4e940

SHA256
784859c752a146c4cc03dbff56f2a343a7b963158e2408a621331a8cfeba9532

SHA512
191a9e32bb867df19b07773df0f8ce58bac52a65a23d3ff543300851a88a635fa9e93ca71eaf3e0a535b137abb1ab8bb832d7dae8f64f569eff240d00ba13586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63104b886f99e00cb7b442904295b2eb

SHA1
2721e2fc937ff451b0f347141af236aff7bdf631

SHA256
b5f2cee49869e4610c0b680b983c666d2b4ae89d8a1441d4a2f27710763d9111

SHA512
c4f1d25a1e980dc2873b583852db38b810b0493054b1870791e3c8ebf87e978d77b8772308cfe99b173c631b5a3e39ca22444d0f12acc51eeef971d56a293d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b97719d1bb0be49524021c966c461b7

SHA1
148890bfaf22fb5e15f8d440f3e2aecf2fe9dcfe

SHA256
ff23a5b2fc13e4b92dbaa9bf1b55107ecce3be4161079b471f67d213d6c60dbd

SHA512
f4e62bb40716ccf32a47cbc5557f685aa4d39ae24f8e4c33aad15a4cc76321e6b4a9ebea80729465f18d0783d9298e559e7fcc7bbf61ed416d4efa2c20117d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd3e74393dd101f4b8c1fb03f030009

SHA1
63bf0ecec9a17bece71996bdf9da4235301e0c54

SHA256
9384737ded5f566933c232c2a5b74254155364df4e8915a7b58b2904c1aab90b

SHA512
ee8c182dd33df381833915c6620f12d328961fa51463b774767a3184f33348471ea464430e0780ce7851c7bd771dfbe8e3c77125fb260ec74b0597c782c2b572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ce87f294ee4fca53c8a5da85dd8afe

SHA1
9f4e03c034559dc9dee93556fee9de095c7107bb

SHA256
a6788d86e48225bce804e1f7003429a1e301ddd7f2d48fba8a7bb1322397e2cb

SHA512
e2b78b53fa8edadbe075cd1d8218a5d4aabb3247742febe63b7a416413e281d128bdb99215c9e5d6ef3a6987c7bbc57c8740c6ac8bfcb41f9abdf8e0f5d0845e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9627ea7db1be7c0f5c34764fe653d759

SHA1
b37981636e2ecb20b28dfc3b113a5deb11db66c4

SHA256
90bdc2da1e143fe795deeb5da76ffc031332abbdd0c0b8e571c2f101b319db36

SHA512
645fa44c24048a29855033f83e2e4b0b48caabcc9137ca5825a9fcc0acb81bb50db77cbc4fe8388b72854327931becc0db6ee2739c750a6d7118941db09518cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd803560f9d85c744d7fff92634b2e8

SHA1
d3121c2a7dad4908ff90999cb816654c707a2b70

SHA256
a974b553a52d4806580a68c907207fdbeab078acc5472079719c1c9afb1fa5d7

SHA512
025a3aa1a5d790e7677ea6244655f0e5d27b6e678d03483a7c667b30c604069e6769b7971757b83a0bbab695cccee286e5591e9a1dd8bfe091f6c64f38e55e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14AB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1578.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar158D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit