193970137bc7768d68a16c54b20fb7689c943d228697d33719cec87420762086

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

813800957c5195b619e8fb06ab2afdb1_JaffaCakes118.html
Size

35KB
MD5

813800957c5195b619e8fb06ab2afdb1
SHA1

456d7082d3cca8fc7e586e89a05e55de357237e8
SHA256

193970137bc7768d68a16c54b20fb7689c943d228697d33719cec87420762086
SHA512

26e06d841c09a4a50d6280d6a18095283cad63149416825fe79aa93ad59b4534fbf2f7b47e164696ece28d299a9d76e1f27ab70344fd072560afbb4cc452b304
SSDEEP

192:RoTolDxEb5nPnQjLntQ/AnQieunVnQOkrntu5nQTbnInQUhsXwVVwV2wVQbQowVw:iTo3jQ/SlHbQG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423158947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CD31D41-1DD1-11EF-8DE0-D691EE3F3902} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1756	1848	iexplore.exe	28
PID 1848 wrote to memory of 1756	1848	iexplore.exe	28
PID 1848 wrote to memory of 1756	1848	iexplore.exe	28
PID 1848 wrote to memory of 1756	1848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\813800957c5195b619e8fb06ab2afdb1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
176bc2d7a762b808127c615e4cf7a60b

SHA1
853891fc384fea023832bb9b5115c2749d3cdac5

SHA256
d345d0857bec1ea5661cb07b218a9b6044d3371c19edbbc1f465d86eab14c2cf

SHA512
55ca8cd642feb223d6a2deac656e01ed9a603e370e51e62d672f46967add79cd4edd6ebb6473d5d45904a91e9e7f6f409eeeb627d89ea6cf2028d2775aaf708c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
674bb0d1eb858e70d04574cbb1f49f41

SHA1
50f39e5762d8d0e972b9ff381e294031df07d6a8

SHA256
abc1c13d6be0fb66547a2d03bc78492c4ecfa8d62e28995f0685ce5f802c8021

SHA512
560c242e8ed18c9b20b5ba4612ed2561be69024f346d4e7515f2f6058776a62fb1706272a411ad587eddac5e1435d68578125b45fe11260ca749e88e29f57219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ab4b9386508f309adbd569deb8faa4

SHA1
26b9ade7e4ab4c42cb1a176113212a8f59ede029

SHA256
c7bc08a44db6cba652799101275809fffd7f990cad3ca4ed36d77a63626b4624

SHA512
5224151c8aba3337584c898732352cc3bb13042b894d1886cf0bbc3943452e95c5d0d8cf607ea210717df6a21a411cca4a76d128a39bf3f0b22eece69a9e6d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fbf4f33952c0d3f9157014c57042d3

SHA1
ca234040ded8d1c35c58d2f4e9fa674a65856c36

SHA256
5911e9b86839c07b553f0a400c8c665a037a72c6568c79c5e815341d40798f14

SHA512
49d4b9c2d1897ebf640b1c8494164e208da7d513e91ecf39dd0bd886df4ec7cfcd2103d4a696a5d2a47ad44f41e366cdb2bf66703d18621a27014f1fb121a91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
817e85c1762ab5025165951d71f8fbb0

SHA1
2c0be8490b9563d49a7979741ca6c170c57a19aa

SHA256
83752bd9d5293a10bdeeca9e2b0eb45823be6470a310353b0b06519061bd50cf

SHA512
82816981a7e266fc448b5efec559ee430252636a11eba5b7e672794b10e94895eee129fe7416e975ac6e487cdb7bae2e58d84ec95702af8db18f8ba3ba23321e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
785695094cdbab5bc0e80dd99ae5b0cb

SHA1
59cc4702bdfb2fbcc938926b9239776d72fdf2fd

SHA256
6a6e55c66c4319257c57a7653a4b30a21716faac4ef06419ccc9533743a65a15

SHA512
bc7663906f500f12c1c4a787a93beee9d77899a079a5b4028fea8a8cb766ffba4a4f22e45776581190151821ec316b4782cd7e243d7aa0d770b8696b7e4c619b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78bd0765a666299ac520fa04c16c5b2f

SHA1
4c9d9359a88df240edd1d94aba9801d282bbf3ae

SHA256
798d81703684573d92e83886029e81d77499557da883e8bef0e11c2b43f45969

SHA512
51dc108c99bba32bd8e5561fed2a5a39a5347c050686dbf64bcdc3669e3567f7dc4541997a56e4975a33cfb370aee46bc2d7196fc26cede1d05813e35f8a5a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8feea8b1188757e2253e311938ed0c0f

SHA1
d8eb1a2fdb17bbd009ca0346b649d9024b0cf4ff

SHA256
1ef53112c36022fb1947fb78b332e7dddec91ba3834e15d06d198405f74859fb

SHA512
234cb2dcf9717c610efe04a62fa7b4b352484a6cf0ee5c07e3b01bd0d639aef4952eb8f646f0905cfa605ba4b92ef4194e0718cb098a336fe29a4952370ae596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8302c4c0f1b8348f0ff8a8ef54105428

SHA1
e8a6c776b9729c612c85a1038eef3d2b898cd5c4

SHA256
1f899142e36d18dffc4408301f76f73efcaab881b4708007523eaf6d48582da3

SHA512
d91b96da20d66c88b9f6d259bd83ac12045b635f5a225d4ca4e5ec4a7ac43915ef67984111790736bee569b78ea1197cdfa402044fdc96549e74b13cb46edc60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caafc44fd220f608ebc7abf70a9f19d4

SHA1
5871930ce41faf0a9161ebe4cc9e06634d081a7b

SHA256
1766ec599e1eccd6f7ea4f33cb729dbb1ae9021f327de2f22511f338d70a0a37

SHA512
99fee31793ba7177f3b9e5737a6d44639c8188e12bfd29bd7f7126d3f985aa9467c2e057da008a2a90d4d316e37ec4a716ce43f1a0f23aa1ceda63142437e93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
00153058f54f15cbecbd286029286204

SHA1
e88fde6117c2dd2fe3126b8736c6c6559415a0eb

SHA256
30ea67889247df75eaaefa0fcebdf31ebd0c7836193e860ed33f725402bfc79a

SHA512
c0d6eb7320756a9a33a8e0491ee28db4d282e6ab4ba24cda276614184593b16023ecb524430e897cda15e7e52f635077579c19f77adcb263bcbcd27296b0d3ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit