babfa803e1c837cdff83358608e96064a647e7b1de63892806c3195f5353e71b

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e37b974967afd5be35a4ca21c8bd7c5_JaffaCakes118.html
Size

54KB
MD5

7e37b974967afd5be35a4ca21c8bd7c5
SHA1

1c7ba58995f66feadc7082c0cf8713e97f568936
SHA256

babfa803e1c837cdff83358608e96064a647e7b1de63892806c3195f5353e71b
SHA512

f94d7d2bb27e1c52d7d0626888cbec749820d55511b79650a965667e439d78e916842a6e0d79e8b40f390c22d0e3fa0e41719c6c7f9e277b6794cd186c2cc735
SSDEEP

1536:upp+GMSmfk8FaEhm7jJK9qX7WaBOhI4kZ/ooAs:DSmfk8FaEhm7jzZBOhI4kRooAs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2F9DAD1-1D2C-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423088304"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e37b974967afd5be35a4ca21c8bd7c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
37aff351d243c9ba8979ecf3980a8f17

SHA1
1a8bb7898d22895c87669a30cd5bc53d27762b40

SHA256
363f7b4b7013b78bcb05f97e0795e0854c25a0a6dc41d19638db3f3408b7a929

SHA512
8da23046ac2cfd154aee16a8f85e258f8fbe49eed2a76b505c0691060d8fb5a394bac91f15081cb9b8ae600541a178f10a82a1432406085cc3748a8daf1b1fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc9c3afc3def65a2140c82c3590ab264

SHA1
1c18beb32a3fa49e67aa86e3b22e451cfda34566

SHA256
702abcfa23aac210643012dcb98b1cfeeea9433cdf39ddb2dd943ccd63938507

SHA512
e08d912afd4ab7bdd81d5478b557d09da42cd05dc540a2e569ebac4c64751728b5e1426f7c416b17e0c6fc16f82786018d4eb37c0a09c882028cb0de7d3abdb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be3788a92ec709a9aaea33a0014c5b2

SHA1
b484db4be81c0e485edbd5496e2b128ef11a9d62

SHA256
410ab171c2e3151c13698090aa9bf2ba68713402d198d3e62df3a781a8de30d0

SHA512
2a2abaa3a17ea5c4a368afe9af170bcc109aac3e65ddd9fcd8b401fd1c3409e0a34eaac3566ca96a8c4ec06faeaacd207af7bbbf8d07a02bc6fbd6271b5a34b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e4b023b6b1c588847395d07034c56f

SHA1
600aca3634ec6f2779950484013c45877fac7b0d

SHA256
05706ff42965434c7edd6d9839eeb5ab940d21eccc8a5d47895bef933d12584d

SHA512
fbf29c54b9962a1f51bdbc1504a0fbf27057ccd589f0e753264a652b4c7b1edbe657611ef6eaaa1399a7ffa4f582ad447fbc0a69a9832d22a4c77ab170ca0339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a3f88c959a8ff86244495394308460

SHA1
cb0f465684a8bec44c52fa1db3f741dd11d4c112

SHA256
11d9722d09b0e8f706e008038c1793530e579fe5ce465b7c93461000c6f481c9

SHA512
654ae6cf5a70cb8cc45b792ff1db1f05b66b190f414ed7de9182b0df4c4ae0b173869bacfae55d2566ae2fb87c087c82d16d451b4312f8cd64e3a21c83b1e99e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a52553d442e5393697d0f687b1bf86a

SHA1
e3fbb563743fc6c27e9bb5f41a07d30fa8abc45c

SHA256
68d487275d1486f00c00e6dbf81319672446e2c18df0262275a21c1f480a95cc

SHA512
0c346f707603ea513a4fa737880e44f70e8ec3f6863b816652f6b780dff294ecdebc863124d74097c3a7c8048905fe9541a27d65d8719c10bab3de3555a9e167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6ac59cf56da601db997f0e6fb20949

SHA1
3aea7fc3033a2a59f14a6b6998d83f8f6738e5e2

SHA256
841bded1ca9ccb67b382c45dd5bc925b1566a9efb2f54730ee32a5c2f665dc66

SHA512
e0a35ee817f8697f9d81feac74425ee630fe9e8990e0434101ece674e1261298184084970377548030a6c269dda65951348bc64a0e0a63357c5d09413cb49781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03a45cc3a63742747378347d8bfe86a

SHA1
02e6a359c4cc15726f86034578648171c11e8b8a

SHA256
310c5500d931c8d610656b19c58c5f8e71f9f1a28591ede3ac13d8a116461065

SHA512
e3c704e9fbb20835a9894570b4090aec01181659cdf8158a5153ba319d1f647163d0b64e6a449d554adec66359085afcefee2621287eb1898476d49cdd8e9cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff909545428c2e1f6611a66182dac04e

SHA1
70af7e9bdabd26d25926dfc2ec29ca4fd1d40ef8

SHA256
e1bd7a149c1a3cbb91700b0987794234d43af1997ea2df9a34f5ac5832b0a5e0

SHA512
3fb370667861d31a56543ef750cad57939726b9af47e25cef38ce24cc91961d4f4d2ef63e9fc606de4c9b9da0491c01257f3c816dfe84432613397258f8fdecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018ed2f18e21d7fbd9a1797da3da90c0

SHA1
a904ed8176baacd41e6aaadeef81e6802c8a7417

SHA256
996f45f00e4d032fbeb3a41d102cf44c07931c3b9f2a57532cf8f4dc65623111

SHA512
b6a8e5a6c754f7fbc1a1ecbbffc1f7237791a79d63f33d853e1d8c6bb962d422db63ed1cc4fbe5a942edb621c10e91fa4431d110b2c0e952b17c413be6f464a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
526d5aa60d52acfe997e1059460c3854

SHA1
7377e9b973dd56d1f7628946491b068e6cb6e23d

SHA256
89d4c339bbaf4b20d26bacd7a10c70e0e612e888207b507d989d50747dda9c3d

SHA512
9c19f6427404d5246ba0a6427705b2303cb47f094e9419de07d26af4a57991ca4488220dd7bc77701da433842f4bf2751858dc9453a0cefdcb8153dc4800331d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33ddc4bef5db3167115379a13e9fbc86

SHA1
7ffe6b83a93d6872296be2c6c609d9830d5f783c

SHA256
c7602a67dfaf4f9ab1a1e19921ebdc101b38824ecd9aa46d9bdfdfd5e68dc223

SHA512
32f4c24f4480fc890fc4a0fb104f29d8b972f5e1e1204eacf87195b76f9c69a3a3505fb88ffcb0c30e33b65c326de9d23ea69f7d3003e7ec5ddbf8b68aad3140

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E51.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit