17347ffd90ce5419e03c3938b7cde924ef82e363de5ee403c75cdaddbe980cc7

Analysis

max time kernel
134s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html
Size

27KB
MD5

8137c050fd61b2eaf82628af50456dab
SHA1

9330434dbed68c06e4f2fd37f4247eb12df43f36
SHA256

17347ffd90ce5419e03c3938b7cde924ef82e363de5ee403c75cdaddbe980cc7
SHA512

bae8770df0829616204aaa8bb1e941873ee1f47d455b962e221fb3d2f85f6f8e72b1070c61ced0c26c3fe269eef759ee6eacb6d79b69ebf95627229b7f81774d
SSDEEP

192:NmOoKqvb5nlnQjLntQ/vnQievnZnQOkrntd+nQTbn6nQ4MCHAfpdE7wuMOAQWMlI:8OoxUQ//05Y4g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423158921"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CB28B31-1DD1-11EF-9511-66DD11CD6629} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8137c050fd61b2eaf82628af50456dab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c5bc7b080d55604414728bb05fde87

SHA1
091ea599d991d9389d1defd3da47debbadbd803b

SHA256
c09dd91d03508aaa82fb941f5ecf5021d6ace2021223792e036257eee116c4f7

SHA512
43f2460c8a8e0e280627bc225e58d387f36bde2fd82a0bd78cde0cfa6bc082f3b32e4f4d4d19a89f53971abaa033c6e231544913d2547b265628d0b440b16d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8ea5eb5f1b5a7cb1a1132a40e56c548

SHA1
90ff180a182cb3f83e332f53e06835a12dda3e97

SHA256
3407a593f8c9501eaab5e7cda516b54f796fd0988b3b5e7e895c083976943a06

SHA512
250443adadaf2cd277dddeb2fdfa862a4ab3c895f741da1622473c4320fcf2ec43e6ad4ba03c202ee4e9ab943fd6181180ce022ab00a2333ee1bc4352abe3e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29fb9b10dc86462fd123fc2c7f64e684

SHA1
b4a18524acb95dfd3d2af3c53c6532a24cb8ee0d

SHA256
6304a9c2bb315d1ce9df6469b97b700896643ef8db53f8f981470479fedc58e9

SHA512
0f96e5073caa12c911ee7b7256c5b04063916690801f7621df4b31ce805ba06dc3685d570de1e79b8a299790d888546d59d836ba8d612796ea8b633f3a953482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7bed8de291331f11b80d1dc5e3b0fa5

SHA1
450993dda6d6b8c73e6b54f55ba888a1ea772295

SHA256
72b4eaa17fe6f40e16ebfa9dc0272bf7c622957bba1bec7f954536c77465e782

SHA512
13237b2d3035414b521965e83cd9733e0712f5b2e61dfcd0570ab0ea0b21818e992e3295a719bae47a728a7a3ec888ff4ce534d8f3cab71a6263bc47c978dee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
273e107ca484d05c29e1c7658f764be1

SHA1
9ec8a2076cfb1882c522c2fe11c14a3e28908749

SHA256
d38876b035bf264cdd72a087618205a54b1662250f3f0fe525db86ba0935fcf4

SHA512
245ff0046657cc30fcbbdf82af00162203e69185ce4b7ee2afdb27901515405a832392001fdefae5b4ed47469d3d82106dbbe37c37b0bacf0ed58c84990ae02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a51062b17b05715377358e1ed4f732

SHA1
181dda84b048720f2a0e62ea76777f373b36c1ea

SHA256
e7c706124ef5afdc73854c4cb7e88e3acfab8cfe5476fe92887c2ba065fcb779

SHA512
321109546ca86c2888ad24607c694bd42041069765e640c77e100aa954c21e814e132a9adf00faa2cc944b8b875e7109e2acd9de4d00b928d7e95781a1744a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfd8a889ab1be88de303de9e428d1979

SHA1
67c652ffe641f6d06bdbc6c311216c6b82538eba

SHA256
e805a88a6b09df00bcf62785abd8cddb81e04a1e580bb6d14f208dca4ef88488

SHA512
5ad4481f3cb855cf0d034c1b0cdcdb262c969c9a919ca3dd35813ae8e3431da4ded6d0b06f9ac187d47cb96fb696d0f0b7aad4819dbaeb40a92e294b2679c488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
225d0fb4cbf1a75729dfee772ff65b9e

SHA1
03329c022833d7674d522fee925163a4e03401b3

SHA256
15b6f90c32b981b1e622970688f21d27439e5759deb7e1b025ea2c50668612d7

SHA512
98c57ef48be4a7ffd1f10a85018f4b681dac7f3c453f7e6594529cb8bf8b2c81fd69b18dd590c0b5666498b24a8a4ddfc16e5592c881507def291b4630ab43d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ec68985c0a34ed6d48c3bf33bf853a1

SHA1
c970f8ea6c718d5c03bcfabcf5fa75074bed1468

SHA256
1f13bc30909af1b8cf1dc27575c2511393cf38d5928b560af66e500135b06c2f

SHA512
dce78ae11c4538a42ef6d898ed1a8a60611fb3190e47d96f5f06f6ac3418a426ff1bc8fea0a4660d94f50e178477b6c3b1858c88e86a259a91b76eea9b99b011

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA91.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB9F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit