60efb70ce4d9ff1c504b6254d055ea426728e49cbfa3f33f7e7fde4a0c0d6d31

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e95cd08c06e496b41cdde9bbe0f0f5d_JaffaCakes118.html
Size

18KB
MD5

7e95cd08c06e496b41cdde9bbe0f0f5d
SHA1

7777d37577c52bec578913ec4035daed8a13ce12
SHA256

60efb70ce4d9ff1c504b6254d055ea426728e49cbfa3f33f7e7fde4a0c0d6d31
SHA512

5baed7d4557ce38001893b22c3b2450b8d4aa167a84452090b362526dfdcab787c409043143584adb5deff64aa18920590eeac8a2e3b6eb5883fde4a74d43b98
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv49zUnjBhPh82qDB8:SIMd0I5nvHVsvPqxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423096346"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC5A1281-1D3F-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2488	2460	iexplore.exe	28
PID 2460 wrote to memory of 2488	2460	iexplore.exe	28
PID 2460 wrote to memory of 2488	2460	iexplore.exe	28
PID 2460 wrote to memory of 2488	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e95cd08c06e496b41cdde9bbe0f0f5d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4883b4a8f42c3645e73d3d7ce3953901

SHA1
4b649023f3a536170e9018a829bdaca0593e8646

SHA256
7f22fe5777dd31dafdece24621a79c2ede84c745278ecb977e00768fa1b4e024

SHA512
a9c23b517947acb430cd466bfc56fe67666082a53ebe24bf1341bc379edb0f56f40ee05b18ea1b80f30af50b28b5c09314c84ec6c13f03d9a2885b1f27c07fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a625fc271f5b699aa3f77b8aa57b713

SHA1
6f8a624d22fb65a861476c672bf77da1f0679fcd

SHA256
621f1a3c2f4349cb161dbbb17c626142f1b60c166d53e1a39cc1814a853ba8f5

SHA512
cfed17bb44fff8d939112dfec1b673c6db57b9f731a7daf8e87782d4c2cfe58c4725a207600a2587a034cbfe84cc6d5295cb904d04581c1610c3745a758873ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b2450e191a04b29ab4397452fef474

SHA1
8072b80b429a5969aacb1b53174132f3393fc1a8

SHA256
6dcb8f0aa7d2e2fea1aff2fc7c62608d5c0b16e0e7b8850e76d7aa7858132c0c

SHA512
7fd237547d221985f4d056a6d9194ae5251634dc9974f36f39926d2b6cc4ffba5f6cbf8b96324230e0e340ae7940d1b4b876e89f62c8e04c596c5c8f4f04ecbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf2975419d971880b3b6cc5c81ae774

SHA1
04e3841c343f6a9413b2fc4999a84c83c6460aed

SHA256
baed42e9c44f03b828bf075478125e4d070bd55a5b134d3edf44dd159ab242af

SHA512
fcfce3c022668f842d701d61025109b780f1cc1f6d9a35960b5aa47ce00d3f43681a6ef85ee6009b7e07e58a474561d36ccabc3d37131ba18bcd744a015d8ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f12cb9addbc055f4c9e190deae305a

SHA1
8367d515f63232c22286071b2c652f43762c539b

SHA256
050028056ce33eaa10dd3f4da09287e0a8736a81a88cebc1c9523f956c6a65a4

SHA512
cda1fe18aa7f14bbab31fe0bcc37f0f652164c6555c0e1bfe01bccbaeddcea026fc97c10f84cc6668f54bd4cf3e67d074ee8c3f8f980bf0a32b163ea79405725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8a85a862cf634ba26ac0b0d3b052d1c

SHA1
60712878ba4179db8a4a7340b620fb4a6a7a89c8

SHA256
ae44b1cdedccc8b4a3143831b64ce157b4a962d7a453a4f5fd01aa0217fc994e

SHA512
39ccb3297143d254efc2cd56a3ea47057ccf5f7b3e90ab8c63a6f1d6d47ba4134b395b73888c4eea54f01408c95c091cebe6b0812467ba5d58ee29a3cd03ecda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ff6303f0521b9badf7edde13e1726a

SHA1
92615e0a121e83833d09de45502b1e644404d4ea

SHA256
a3dcb32bce7f314b11162688ebe73faf8164b4c3cff50dcaa02f66a2b7d5ab03

SHA512
e114e59b9154618cbb1796b9682b30a9297830e7269f83586fecde4a331fc236a4c9b31d273a9c3b092a82f57eab3d0c8788a5f4c474e48c2cf168a67f9482bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46e3c9396a47c56a9cb854bdb08b9dcc

SHA1
853e29c5e426a4c87608969121eb322adbd0a14e

SHA256
8ef0d82c50884d0bcae857e675dead1e42ed0d525853ee366fff4848fffa716e

SHA512
10bed1da4bafa6b6b861c14efb79076167f685eb0d36e3e9f6b08f6b75c4d6f61c91dc0c90b77f040ec96a09fba8e25fcb7124223c27f0ac05a3b60938a2e0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09df33a513097b0f32b4026a7f9b9988

SHA1
7a2c4bc0bdfb45927bfc039886abdf5b1b46a894

SHA256
0d85cf6448653c58ca9ab104042ac2e035e4d92a08c75f0d008879afdebbfab9

SHA512
a5fcd3b2b64568b542399658991ffa7d32e0acf80f7433306b86327e6804b5da179f3f7da74916ab6846cdbbc9e273288e83fad8eefcf89bc1e2dce76fffdec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB9F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit