5b2ef4342424f613b360b8bb8db487187eaa416cec888ada7a0d170c5d278374

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

832fc33e3518230607844450debd3ed0_JaffaCakes118.html
Size

120KB
MD5

832fc33e3518230607844450debd3ed0
SHA1

ba5cd2717f4a5ded31d09e254ca9847da57ee4c5
SHA256

5b2ef4342424f613b360b8bb8db487187eaa416cec888ada7a0d170c5d278374
SHA512

183ce69b658e5033f1bd89d88f8e33aca3c80d10ffbb13a970ad4047c6b537f020d112fb2a36a7b343b20017a800372814581704fc04470dbbd2f2c1dc396aa4
SSDEEP

1536:SOvLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCY:SoLyfkMY+BES09JXAnyrZalI+Yu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{055F3E71-1E47-11EF-8E9F-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423209453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2916	2972	iexplore.exe	28
PID 2972 wrote to memory of 2916	2972	iexplore.exe	28
PID 2972 wrote to memory of 2916	2972	iexplore.exe	28
PID 2972 wrote to memory of 2916	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\832fc33e3518230607844450debd3ed0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85e585a3c4e95fe403f6eede1eefaa09

SHA1
3cbd5f645524f72cb70d9913169abb73b2def2fc

SHA256
cfed96e33933cf105a072d5c2c6e73012aec92a544216f92d4a10e3711e5acdc

SHA512
c01bf855d4688b34be83764ca9a63160465eb50cb7f5e66df9ebc0912719c9d19c9708c90fec8f328a852e7dce217f5334b44157b9af6909c51a7b8a85949689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cce2240e119c03eddc82d0625e061079

SHA1
980546e5253308d1a7f6d2d2756ee7028ea39b1d

SHA256
38cca5bba8016f60e560f12211103277838c8e375918370224f5b7af8bc8892e

SHA512
35702fea11f5fdf089c60839e168e27f7aea28ee92541330da41ace1b93d46152041ddf469f1b432f57a19ea4059cee7cb5fb37394e3af11509d480d49ec2042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
672998780a1e6eacc8de586e340db143

SHA1
e2478eb1b084911a6e678a5c4119b91efc2f5f8a

SHA256
30640047422dc6a1fbfbd4ddf364191a469a6d21c4382571b2391e4a3c311e53

SHA512
e4f24bc69951b4cdce6e146198072592abfa7a7c53a85d294aa1edc2ea16098c0a4c87fc47dd13057deee1c366344afc793d40bc0d673df7f1342418016d1272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb520dca258d5e7dee4f259a4649f8ea

SHA1
7b54ef57410f4dbfbdd1d7fa34ed18c57daaa73f

SHA256
1919149ebd38b9d6258c42e07229717402591e596057446475aa23e0ebf422b7

SHA512
7406d2f04e0c0dae9fa00ea7590a8a239e470059dfc37144080b2c9e36fe3c32eeb82d68fb2d29f4f1f91398b17d59275d0476dbaa9fa8583948c6f512790de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1924bd23b3f1c6eeea278f0d087dfa5

SHA1
f6b821b14e1e4564a13f8c9f5cff70d54d3225e8

SHA256
1ee8c356d48d3e2b67f4cb4eb64582d65ab9d2e2725466cfdd883d409c81613a

SHA512
a9e6656d3023b4e742759437a4b3166b433bb11f8f67e1fb69446ba8ef2299069624bd957670ad9cf16012b70718350f7a80a2123ae4de6cfbebf5218a8f66af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb98759e1a4e6d77caaf4e78c8001189

SHA1
0f3b3cf92b652b437c09c550cb5319a7b397c3fb

SHA256
5d9c54086c55c7ec47e74e136fa8d5a91c08f3b54c40080d146b1cd1f812d115

SHA512
3b23e31272f283d31a1da3c2f9dac4da400726fb8d119dbd02e1e4058c7923bb7bc1a54c085fd5057569e55c93b4f8e02968b4d383f6196452419fdf7759831c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58de1d01cd898d5d83babfd4626a0e7

SHA1
d92a83a12949099031815fdac88b18bfd3a35107

SHA256
a66c7794a3f34b82ceb96b488e9ab698032f02291141b382a18467c7293af6cd

SHA512
4a4f70dbe92d5286b8cdcc77ce3cc56b2fba29aceab6d08d6163cc8f385ecee0c9dbbad14d5ea36b22f809052174c7bc39d879fc2e2848cf16bf2c6182675746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4142073c8181ad6f2a3c5e943ab10cf

SHA1
de59f5b2eb10e4dd6ed420e8cd7fad2bb43a83c0

SHA256
7252c2610c071bce219b1f9b51ffdb3e8f6c57d20116e2f94657f181094c9b0d

SHA512
29acdf463257e00f0160f116d635e5b487bad358bcb6b9c4fd03fe4dd9794973c7a84a828774416015d0ba23421d7134e7760dbd117810d5b37398f3d3a462aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aa46a15bd2e96b2b8cc33b5e0f265d0

SHA1
b9d45f8ef0e2adf51dbf9f56375a6fcdb855ec6b

SHA256
9895e95a54f2558cf7eb7d295148d77ca75449b137b6300fb496b545ff038ccc

SHA512
79d781732f075f7a482ef2ef4cf0000fa858324be68ca5414f47b6afa4fd2e8d41035ae03907da62eca0a8df8d5aeabe6d10279068b42c36ca28381d7ba93e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab126A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1327.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar134B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit