bc5d63ee4461a94cabbdb93dbe2df09e411a558e433a3e9f4ea492152e26b5ce

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html
Size

35KB
MD5

712d3fa62a18c3633bbc15d885f2ee2c
SHA1

5fe6ea849a65c9a5cc1daf188e9f2239bf58e08f
SHA256

bc5d63ee4461a94cabbdb93dbe2df09e411a558e433a3e9f4ea492152e26b5ce
SHA512

6f8b7e8b8d8cd68ad2c9b8afe69315c74627f38850cf008336d095339f2db3be704cd63b5ecd61686bb473705340f4faa1068760450d8f25fcd832cd8c1bea95
SSDEEP

384:+YdrTOSDW7rfmFMMYf+XxFaFzFGyr8cu5av0/eEfsMU0obQOcMXYbClbMUmMCi30:BcfmFMMDXk4SpB02vb9uUPa0C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55AA5F01-1A63-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2748	1868	iexplore.exe	28
PID 1868 wrote to memory of 2748	1868	iexplore.exe	28
PID 1868 wrote to memory of 2748	1868	iexplore.exe	28
PID 1868 wrote to memory of 2748	1868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\712d3fa62a18c3633bbc15d885f2ee2c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e63b386edd4e05f4f6fec2529b3b8f6

SHA1
f3ca7cf29e4bb1fd5e506347e6ba1d548c8ae708

SHA256
351b5fdb29076f24a98f84ab001458167449bafda7c9fe2f725ec4adefd2bb06

SHA512
983650fcdd4c4d9e8f532d8f891795b8a443b06a837cb54b575a169248709f1b3014f704244d92e677818c48894afcf6ad1dcd4bc5f20a8f3f9048695f238250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dec263407f4c4c48897a221cfb48867

SHA1
bc37d4f2f65983b6fe1df1b0228f36e25dcaa94f

SHA256
dc5bc1b74c866f77dd3209c99bd8ec355e5ee8b45def4ecf03fe9f246f13528b

SHA512
4a073329a74e6fe509c6381d5d624cde94ac1449ca9f070931c69c25b682902855ea35fef8bfca73f6f5df626f5665feb4d638c6c50563f595bd698e36bd6007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730b1e6934b5f343f82869a7f14e99c3

SHA1
9e19d77328aeb0a72f1fcd74e5a51e4ba8f62cf9

SHA256
2bd8c15e9c215359cc32b19912d25aad2ea4e0968bbd1c82b441e93f1945d714

SHA512
0d9a269425b3e47c568b5b4cdea1d5c7ecb910a48570b7262c992ffd9bfb33f7c4e0dd3e371f6b92ff2328b5f0e21a401cb8fffd4cc1f63215f63c9a52e079bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3d099b9525e9c2f4bbda199b3e11292

SHA1
6e2d9af91fc182bb4b3d01f39023cf171eb0a829

SHA256
fe951894939b9b95cfa9eebd4448cf84d37b822701222b6da2252cd76df12855

SHA512
9153f52c0674e286d8ee237da4b5cbf08235cf3800a2c184da1ab8003ecb3edcc50ed10dd212ba309e895bb488e8a86580507deb8fe386e20bd44d9a730b9b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb462924a699af15c8ca07f1945e7c6e

SHA1
337c856e027cff10add0816bad7f56339818f409

SHA256
b506873831be01960be21aa426c9843b56dd7e22264a40039fd9b0a4c2f92650

SHA512
ab9b522ef0807baebfd6e278aa45f99f179ab7e0a01015afeb3a02ffa45ca1914a1ad006e62c4a8584924e832b4f312f2621954d6d15a4282a0a0fcf904e19b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7996dd38a71f21a8377e03f441eda2a

SHA1
5eda7324848b986069010fa84d6129584cb1d054

SHA256
f20c9ac59577434fdfb7e8df80d2a36e9fc6b3ab121076520fdaf05332ad7297

SHA512
c9e20f0c329421f8f4573d54169ba3177d30d04c27abc2d963ebaf202c08b29cccd16e04f87db6c9b84169c7942946ba0bf03b4218e195f2817cb01e7da5542f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b4b7091d2b7dd413235746291522e9

SHA1
8835d4bfe85679f3d8be92f82d871541563c3063

SHA256
0703e1eeeb1405c5288af1b15b71dbed74b177129b6bafbc548829974da830de

SHA512
d66dd329ec73e0e4ae03882e3893476999f7e8d0180f82edb0973f1ccda09ed2658f129709cda054f16551bac8131d7f06049bcbadedd4a424104ecf9108d09e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8cae616772c3b18a6cecd38451d8f6f

SHA1
9806e8a62fc968c6607f93121a1d23ec855aac30

SHA256
a5cd852ae3bf3428c3e1b1ddbe416555c3d71b39d19f39b43c651b6bc00e4718

SHA512
d4fb6a52e82a94d3bab256f813b0832ac9bd45aac8d60348106d8e1814b5e8cba6de838c56a63ae39ec23eac1d5984f21d762b8d1618258a262d1f65e62c2337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f285b9a0ede31c893569ef222c00837

SHA1
c4141caf5ecde8957adce22a41c107a681fa612f

SHA256
11feaa0e5c8a422d22cb3a8fc420711923d47a639d513ae3afd83ca63186430f

SHA512
7862616db832c17a8a6bca6230ae30d36955466de65785db754d9afe218f5f65df634b7e8a9e2e7f96fb8fc033d42b808d6468ec50f49b9c7eddedadec415118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7849a25b0676775d93ef4c5f8c6138

SHA1
5b002ca1e6d6134cdbb614a4db7cdae049780a61

SHA256
ab9a31d9a91b974c49043b3f722828dddc0eab2bd9a1ab3b274ba7fb9812f5a5

SHA512
7736284f08fd1b69ad7ed7a7961043a8d26d303f3c3354b48cdabe18cf9348e05d7385670a867e7c19da4a6aacc316425d29047fd570b8d1c5fc246c4e2858fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar173D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit