bb0e3c124c49a897a991d02f3a792bcf72a06321e3d9656d22a342e9a16e8873

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69f4425a0b62ad8ad03d0a06fee671aa_JaffaCakes118.html
Size

52KB
MD5

69f4425a0b62ad8ad03d0a06fee671aa
SHA1

eadb498cb635230e8278228f8cc3ccb2a834e12a
SHA256

bb0e3c124c49a897a991d02f3a792bcf72a06321e3d9656d22a342e9a16e8873
SHA512

15ae9029072bac38ddc63214f33c1a33a583e35d4ebddc38d3ebb8a19d0734d1cfd01c3304a5e3b1fa20a58d3b6e92c64f04d9b634cf6b9f9e561e23c3989cfd
SSDEEP

1536:SdmaYT//ysnzNm9F18H4tsnzNm9F18HVAv0U90JPBoy8v78uERkc9rZNasNZhPeU:SdmaYT//ysn4Ptsn4YCZpEl7NhfavFBA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422605554"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F626CAF1-18C8-11EF-B02E-F637117826CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2808	3052	iexplore.exe	28
PID 3052 wrote to memory of 2808	3052	iexplore.exe	28
PID 3052 wrote to memory of 2808	3052	iexplore.exe	28
PID 3052 wrote to memory of 2808	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69f4425a0b62ad8ad03d0a06fee671aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52d18f4338229dfc4b50102f61fa56b6

SHA1
dfe83d8f77002776a4256871e7e6d51f6a24450c

SHA256
e92e4127c4f593dd090e3c6eba3ff0267656b372541b4e2b4adee56319377bd3

SHA512
59c0e715c79b2008c0683598714eb25e4b13a8fd64915cc565962c9167cefc60efb4a8c17335190bee2c6a16ad7fb30de399122406a41befdf1e49dd57caed94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8341a5c9d5779568cdacc568ef2b1f73

SHA1
0d09b2e4646f307902f887f289f229250ca1d39d

SHA256
32c99937661754fac5bf208f60f59124e0a9c19c2b4c314ec0ed903c2df2d134

SHA512
932b7cbe1718003d6f47cfbf35bac471236c567556102ada61a0c736100dfdb40a19621e96a3b351de2944a26a19f6f3b1d5e47977359ffe43285d8e2b8eda30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bfdafbd207f541b1a3064cbb8ae9ef4

SHA1
f5ab2397bfbfe8c83786d7ffd7f22d542b62a94c

SHA256
05508a6c62f650e8216d541504cae79985d32ddd5ba0c46bf9a5586026091623

SHA512
243521f4b9d30893cba8d74ff5616b623557dbcc7bbcf31b60ff457d3d0668af58563269a726c0ad6f6ba146e4959c4a8dfe3d17bc99051e8cfef67e260702c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f879697dfe186851ea0a88b794621099

SHA1
879628301db1e501668ac8657f5b3efb8e81aafd

SHA256
741ba0b86399fb8c295fe6a01b4864f3445401cebc42f6df9bfe1d7d0e5aa9f3

SHA512
61b10b6a40ac1b9668338732b9d6c0809df8437896d94e1e06c7b6289eedc401352546adbcfba77c594ce5d988f829e9a335511cc599fe60424e96c679979897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da80d87af548e8d79289d0944b7cf64

SHA1
e1210a564c1054d7a8b063ae1790c151d64769d7

SHA256
57f314181b9b6e909b5d3bfe8e36f242788b406dc7625f689448cebcb2002442

SHA512
851ececb20d676a2da98a01138f8eeb8d95328fa011a51da1be8a387ba25dc8d2461a1dcfdc52dee74202cb346ef2eb0506b9752a73d5a2403d50624d08ca27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
982008b45b28953e1b90b7baa7b117bb

SHA1
2e3063bd5531a006c0b3b61510bf18b511bdaeef

SHA256
6dbe821ed46c97d54034821db3ee1fe9cf39894bdf27f893af12c801f93522e5

SHA512
2118114d49824c2deae926f50d4047e054b322a7dfc82c4b0aac4bf45af6335e37011233bc4f6a5e630feaf47ee5b2827edac655ad6e9b8f37b2cf157c6f7837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bfe939cae3bb33dba2d3e787deac231

SHA1
0d2ae1d84700e8dd8321e7d6d0a909926c62b08e

SHA256
638c9d84234e252daa7341ec446c1d8eff0e1f6820a0d115a625e2ddaa53e638

SHA512
8edc923ae463f0f85efbad539b3b9934d3150c1c55751508a2ae5648c8c8d8f90fa0fc1f753f9dcd9497493e2077f6d1cf4446249c5a21c8dbd9d3f5ea1e586f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08b72a28fd56dc36c6396f213ae362f

SHA1
7e665013913a4c88062d318f3fd0aa9a57447e43

SHA256
c6ad43b64d14264bd5d05ca7473412dba0ea287c67a6a90c7f2e20086d0dfd52

SHA512
aff3d94d9648650ffc1726c8e1f98c879d759b1d2ce329971694086efa498ba5277a4b245ec64d8dc9e80528f00a70cd486144c1fffd82c65c53c593c88b0ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f6da9dfdf79b0c364805cac9497b94

SHA1
ba418c17369f90341c9c1468d585c2bde1008899

SHA256
4bec8024cb7ede2a742568118e84be3b92af0a957130c790c8868b4916db90ed

SHA512
c45c222ef611ff140cb524a24a9c165f998e482d3263f7fefe85c1a0c9a034f11fea86da4ce532bee931d7d7be66f8269b82dcc12917d61cd68486f50be0baf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83f74c75b0ff6f8c66e71837a1b4bd4c

SHA1
76e71ae8ce5c2f748f181e1e9c3c4179a2626202

SHA256
6c7ae347049a2ddf2b32fd5e7f4afbd7a6693d6bee12c599e4b8fb991e9d8102

SHA512
bc4f56edfe05e0d33af6d6b011b9cb0f7cc40eb1945419b1c076db854fc7512b8fe1b4add3dafc81ff3a366736e88e016f3f022bae1f9d6bcf2c641a580541d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\WeiboShow[3].htm

Filesize
241B

MD5
f5ba896d004fc2ad25e2efb56b129b57

SHA1
f4f586a75c24d595aebac0d105fbf989b7f723fe

SHA256
5551cf9ff3d42d87dcd453c15951f650effe152236573faf7e3fa6813343bb7e

SHA512
7431e23775359b0a0d7cad2990b3890d14ff203a8113e404b0439ca9f5019021ed395b5f2c9e4b5ba59a398659578205bcb5c92ebd3f8629b70ab8d97f5713fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IW68H88T\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\WeiboShow[3].htm

Filesize
20B

MD5
7029066c27ac6f5ef18d660d5741979a

SHA1
46c6643f07aa7f6bfe7118de926b86defc5087c4

SHA256
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

SHA512
7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1075.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1087.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit