0bb8400f4c5103555020ded5472f3d9958a805620fbc21c127abf3e45c0d8cff

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7074094e7ce7198389af0462d003231c_JaffaCakes118.html
Size

157KB
MD5

7074094e7ce7198389af0462d003231c
SHA1

a346c0bbeccf72e5761445562c4c6db699125be2
SHA256

0bb8400f4c5103555020ded5472f3d9958a805620fbc21c127abf3e45c0d8cff
SHA512

034f3073ec2a5cbf835daa7af8b8c35e38c7389227da8fddbc7236f2ff616f0befa113054f906b09dfa4d57c6d05b3c9caa64186b772ed3cec8923ff8b3cb558
SSDEEP

1536:DIi9cOr0f3u7xa5Ssfssv1aJ6dI+5izxBVdoBUMyRgBm2fdr1ziDSafvwLxm9/ZC:DI7Oyl3m9/ZYqS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23890341-1A37-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422762827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2740	1932	iexplore.exe	28
PID 1932 wrote to memory of 2740	1932	iexplore.exe	28
PID 1932 wrote to memory of 2740	1932	iexplore.exe	28
PID 1932 wrote to memory of 2740	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7074094e7ce7198389af0462d003231c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52891c9dfdcae71c92f7f232529ed60a

SHA1
b4cd7f197645fe7b1f96836ca41c591f057290d8

SHA256
555240876f1fb3288ab2ce820b0282eb5d5c36467bdca2990d0c4a3d603b7dc5

SHA512
9fdf55d8b50331b200a6c2aeea24745c5bb7f8347fb4dc30ed2d5f117a1a6aadde1d06929606f0c3490f9b015da8d649f8ceed9b5da2c8deddc9435e639d322c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90bb78da601610512a0b32b9bb7a19d

SHA1
36e5b50e0953bce31c5968ba6b0dab011ab141aa

SHA256
a2de4fd198d973a45eeb0b87b4f303b7132d9885799ea6a7a9558c12020ee3f4

SHA512
de9ad176f649a7838a40237ffce3872e24af637d9d1ea4372adaff5514fa6f9c3a5f3b64bc3818baf56fc6bbc4351372b1def2e44d260a2bb0cab7a733cdf9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad6b4a7fcbed8d3bc5915b3c9f0eeb8

SHA1
2eab0bebced4fcbe2703f6b8f3797ce191ddae9e

SHA256
9851690d554df40273a262bed30633a78969d89b014dfdcc67ebf5012661428b

SHA512
b81eee74942c7efa3c0d5d7c1f4379a1197c07930c6a79421d1d352473087042a6fee6b24fa2f269f716ebeb4415bc0f03a6aee4904f63080c9256c9a81ebe53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe5dbfaf7c2327da0829e44dc7e4dcb

SHA1
90022df23906e23a6a361c4b79833ab09e58daaf

SHA256
58c6f195d5890af5cde4dcb8512ea1b37f60dd7add507b3ea2d0e1023a819430

SHA512
82683a0d45cc8e1faed32377480b8bbcf2dfc1a8ba68a216607bdc54328182481970254b6292d11fae379036f0645413d3b0f8ce502828f6906d821d7b422341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a4594d6dc4338f479979a40c5aaa42

SHA1
8a17c2c452471319763f458decf97b68bc323ff8

SHA256
b2977f162b186b3d7a62ca9b1c341dc3fe2eb5c51e729f26a7f93f581f854228

SHA512
691a89d388c451cecf8dd82dc0c03ca69267098cd1a3a347895808910fd62d28bf1b312268fb2cc5102cba72eb9aa8afa7e89cd49b44c14c8d46ea022238b6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ced80b23211ebc935e0576b67ba239e

SHA1
ddc7d0063c44b5f3a0841ee7bd5e63fb68e62371

SHA256
2999247481d050c6fe7139efacfc3696e75bf4e004d774daded6b6a41f17efcf

SHA512
cf17bd1469b4d30fe03b918966f608f2ab2d513df52934c3a3c14e112aa296257eb093e3a8b3d7bc6c21e8547e54196cf6762b7d047fa05bdfbe8af067c991dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bddee2a9761c5af4dedc6ad957b8aad6

SHA1
9f2e841e22f6c8ca07b9832ff5905aafd0beef6d

SHA256
121178db62d5f25cc1fa2c49e33d26ad4f0ecff7297b3dc20017152f2c4444bf

SHA512
0490b1cbf1fdb101eac2faabd04896d1dccea277eeffd1720156e092ff36d5608efbb2a13ea2e5d2f0df44a4b90cc440201a9b67199317733f2a680c46439718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aec048192d7b48f227cd4c03f989ec0

SHA1
ddcd439ef5f05fc898369fc2297ebfd856cb891b

SHA256
ee5c46cb3a586598c9cd25717bfc2efebd8f341c7b93de3c15943088bbd16d2c

SHA512
5e69efeaa9331bc170cab75641e671454028d5ed9cd73df549668cc4c97c85040799c6b9d8186977946a1d18b15881a90a2b416b459e1428bcebb337a35d7010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844578ecc523739eb35c94a05f486821

SHA1
162b6540a8b3879f71cd658544296858e5137efc

SHA256
100a9c1896d57dfbfe2b5cc45b420c4d9fb05e5a78ba6ff6af5c6bfc48bcbd6c

SHA512
93fce7907d3a915c2ecf73f00c59a83e54d24ae91a43ce6c05e36d91f14cd6c1da016dbddba7b6d331f3422cfcec44f590e7a8e6e826045c723590ab01e4ffaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
255fe93ce43611714d5f1fecf2f43db7

SHA1
05c9b96e9f67125dec1b7ef4265bf36b33d057de

SHA256
c058319c2e7dbcdeb2b74a74e990423d47814d18c2f5e9e508965533016bace9

SHA512
67026660b73832ca5b09b4c59d6cdab768891a4d9e13919f4450724305b19c7babf6dab336953e282b4c03d4fae907891241e0163925c4bf29f32773dab1c1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DEC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DFF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit