0c5364fd403846f0d24b34f5ab25633f6790440e85957e2dd037e4af1ba60a4f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75053212145bd8d45113f91322f0a0ff_JaffaCakes118.html
Size

25KB
MD5

75053212145bd8d45113f91322f0a0ff
SHA1

e2b53f627fb74c907d3058e915d6f6a83cbb4df3
SHA256

0c5364fd403846f0d24b34f5ab25633f6790440e85957e2dd037e4af1ba60a4f
SHA512

6daab2e994e5e6d27816a47b5ddbd081c1cdcf8b95b9c132756deb11e28ec00cead6ebd62d51ceb174f4c8295e6d684b488818e7f40e58035cc0865c5b3eb3ce
SSDEEP

768:SMlRvYp+VWjXedWg69N81vhMSxA/keqsgzwgRpjVBmA:SMlRvxA/keqsmwgRpxBv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422877379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9E192F1-1B41-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2304	2916	iexplore.exe	28
PID 2916 wrote to memory of 2304	2916	iexplore.exe	28
PID 2916 wrote to memory of 2304	2916	iexplore.exe	28
PID 2916 wrote to memory of 2304	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75053212145bd8d45113f91322f0a0ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
208e6bb75d80dd52360b122a24cc0d6a

SHA1
e6402cb04bca2cc2253de12d0518c61fd379e25f

SHA256
4ef7c8484b6e81483c8dab8990d7cff11b2800722f180213b300edee4efbb738

SHA512
d038551e7ec3d3a87c1d8367b6c879b9a63b05edb586fa928d3bb7ddb1351704699af24a6c6c76b27c97ae7bd5cd09322e967a950835d5d71f03a4c71e09d698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38c45d5ff27cfede30ed8d6315305c56

SHA1
762ab4597f02351b3084345748aac0b07dcdf45d

SHA256
b3bd60cfefbe908269d1b4be58223828667d8a0ffb875d95195c01881c358915

SHA512
f0755aabc920fac41b02c5654c5a9cea78a54108f454e526967df0629db31f01054c9b8b2ed03d2557f3a7449a3b2ec69c9f1bd869bab5db28b150d371bcb320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72fc41e05fb820a35aee9b11788eb891

SHA1
e2edfaa4cf94207828c8243d1ab8add94586dc51

SHA256
1e957097e177e7b8f34d4117f714c32a86039d5fe314f15d059b0b550eb3a91e

SHA512
3e2a4e113b7fddb7b7d3ecfe3b82d6dc6fc1842bfc9a5ee74f011d4fda52708ee5420a4c2a19af9fc19210efba70152c37c24e680f74f78577fd8112635f0735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a944cb981459590506a3d88740dc7371

SHA1
cf89ee088b54e699a6bf9e8554d4dfda919f9fdf

SHA256
ca31a754ff4de68d395b748f98a577af44087879caeeb34b7f7be8de4c60acb8

SHA512
fbf205921020f70ed651a2361b74ea5fec06e0429f304fe81d18c56782ceb03be05f2dd6b2bc2708f952fd3b03707d6287c5b0966f0fd5d5072d1cb65c9c4246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b406318322271ce5232260e3039bcd3

SHA1
0c04475e5571ca6096c6798bbd2c62ca9d5c89a1

SHA256
5fe26a0957ecb53be1de6e44e31d64d659a9422c3e53e97d9402bd3cb2bf8399

SHA512
59150afb9e25283f3eb8a92ca0defe50fb0beddb6d71de43cd7d4ec664f3ffd09928a3d7017690748ac6b2bc74adf977270b375822a7e86ed209b4b520eeaf48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267406d325eb5e40886bc8db7fe1c9c5

SHA1
a45179a2a5719704110fad44755e0cac59166529

SHA256
db4e99f41f82c7e2381b39224bb72f7c5e4f25328b75fd9fcedef017b870ab50

SHA512
62e23e6e25b3a28c1423bd3d419eaa9e7f5c0e32c62315a18bfe845c753fda48a07b4faf53fe3fa40a85b3bc91c946221d176ad20d42749768cfce852a7caee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846cf6156741e59a72c5b568b2c7941b

SHA1
78bb0f334b0e9dafe2720d5ee3b0e037106228af

SHA256
38d4993390d2aed1813e65b6eee97a0dde769ebf28638c8b829f92296dfd2ae7

SHA512
8a6d63a1f860c8cf8d108f8c2451c4ab1b1d62f3136674816b34dce167587da4c9824b244a48cd4e2fbd5a1a22bcd40a2fc89d992bfbe034c26155ef0437ce5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909778589a5d3e01be2e06451fb3cb68

SHA1
20b88f60410e21dabe5255ad740742b0e495ad76

SHA256
2efcbdf88c6eb84661423cbffa555476d4daff68bdea1006b5ce25d3a739fb09

SHA512
7c4499326529912d7858b314fcc062036abababa6b95a125affa3a17691a0268743d5d4cc5351c01354d21c3a145a8ee0c9e2fce6aac2b4661adce41d696ec5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a37fc3d44608af8c6bdc955eb9d03230

SHA1
25bffe0f74da419040bcf10b2ddbc1249daf2532

SHA256
342234489681ba3be5fb1b7219be007642313e627497a6c75c065c85d5917865

SHA512
43dfa4af24c828551680883c4aa399b0bc846c4ff86f2aac5d15b96cca9659aa233dd64ccadde175183a57d521fe03c77fd326f04faebef71736fa1f77ea0781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d997d984665351ad385a56e5e8f7e12

SHA1
bac530793d4f5bb6b39552647247b29071ea3f87

SHA256
3b84cf09677ee15b009152d2eb0a1c502e1920e1a42d3a643792b594756f7bc3

SHA512
029740f190623b215335a672b1135edeaccadb20f75af844f187cfd55b50190a0338c1c6a569144c3d6bfa1da0d95a359e78c130ba4543e71b5ba033535b3bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D19.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D7B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit