cc16bb73d637799df4e93032b2a595687eacc2dddd48ffd9f1f22aee4dea11c4

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84a0b038acefcc08b1bf348afc8c798c_JaffaCakes118.html
Size

19KB
MD5

84a0b038acefcc08b1bf348afc8c798c
SHA1

7204db0c7f3e0f941cf7e5bfd7774ecbacb995b6
SHA256

cc16bb73d637799df4e93032b2a595687eacc2dddd48ffd9f1f22aee4dea11c4
SHA512

49bfc00f69815bad5a10bc8ecf7d35483bbf09e9aa8a2dae0deedac3f2e924a6aa7f606199844da843a0e3c1dece34eca0b489df08e04b0937d97c169423a0b1
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIc4YzUnjBhk+82qDB8:SIMd0I5nO9HtsvktxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423244396"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{619E47C1-1E98-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2896	1640	iexplore.exe	28
PID 1640 wrote to memory of 2896	1640	iexplore.exe	28
PID 1640 wrote to memory of 2896	1640	iexplore.exe	28
PID 1640 wrote to memory of 2896	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84a0b038acefcc08b1bf348afc8c798c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca6648819bc9379caee457095675524

SHA1
8582fcb530c83ae0d13d23e835fb2e9cedac46ce

SHA256
7c0f125dae6009710f26fad58a1b6c424057ce17b3a6102dcc64d6826487b9b6

SHA512
f96f031844714ba00ebec7fe9409aeb099c71d1c246b891d10efb95781fc1c35e7da2f0d835334d1e6e14b1385c9e87ee4d968ee903d35dee9aab466cefed5b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7446683e45a699d1d035e5877975d96

SHA1
22a7cc4ec6ffc0247c40ba270edfafa4cdfc4128

SHA256
91bfe371fa5f1c15e8aaa10d43cb9283a853b138e2542e83f21827c3b2ffe311

SHA512
b8f6267e020ffa3d136b872e4da994e3a45189d8cff7ae08601b0e44a8a364fd86a38b360784f7e9e9c4d1fc77919e7a53acdb740f6a79d404583c3e1f7dc591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3eb34440fc568a8dee61f2fc9be9c4

SHA1
c8357a5e06200be2664551a0964e220aef143ba4

SHA256
abbdc7a5d5de80d9995b2388986509973bd101284c6a37159c850df46f80abda

SHA512
05050ed53c08feccebec6dd9408b2a7e29cdefe44a7ba8d6999f927091052ffede6112ab63b2c7ec1fe30a4485b7bbfac457329e886b04bab3f7acf45e926a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cc8ef90b0b03a4ea4323d37d6da6dbf

SHA1
ac1b0a12420647ecb8093a979d5cde4b5490b9f5

SHA256
4135e211f6d8f783a65074447db562cb51f44aa8e9280d3c78076122cc1a0c26

SHA512
17be76a87f068e3eef9c023d230923df22d88b572a07b7664dd98d0ae9506b44b71c3debb55e12ce099a1e09e12c4e7eabf44a1598bcd1a4188d4c2740476127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
536b001c7d5bed899ab1b2d9d215aec4

SHA1
93abfcb9b57a68eb3959829f42192e106f00a52b

SHA256
1830f0a030e474a869ddd1342322a697b3c309625fc79d41e32b755c426f0948

SHA512
eb666faa551ed629c76ed37edb8fd79cfc1efccb32bba886b59847796ae8aaf9d1545ba057193392e49bb0252fcb14d30df50addd0562dca941cd78b601e82c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da819968311f7cd39f2944ff33a83f01

SHA1
86cff1bbba9962e9c5f20448b9258a5c1a7a6d22

SHA256
d9ba7ebde2c4e0bfafc9cd260dedc571d7d78af7afb47d53b9956afe0efda4f4

SHA512
25c5dcd68d3863c2806ce1f2e65256f1a3e34afc317c9f5c45c6f9c0563530487e6b99fb76674d62b791c6f8c52955f44bc85d2a20ee7063f35838ec3c1995fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f39df6eaf6ae9d7e08a302f393d77fe

SHA1
d20d2ad458b3c3aac1d1591983408cc3e69a0063

SHA256
b22205b9e1bf671ac0b9a035c52bdfb04bac3d7c5664152d0a2bac0f49277d1a

SHA512
37fbc8aa06414026429033e290b40fca1d30e2846d5637c8c8abebc543b4ce3945d14a785aec6c57f0c26fd2e6e4eb3e2b280ad08d85252005f5a7065f430ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c85abce3a05ff14837755799b88a9165

SHA1
d1b94551b01d240950a85b9043a104de8e5dbfd6

SHA256
41e2e3a8401fe358175685a4aac81eb54b58914086eebc3cec9de2add9acc598

SHA512
8781af4603878657cdccce1acf8b20c2f7c76d5fce738f6e603bd42da9424dcb49f29e30fd55d41b22c034da9298486a1a310401d98d6e0f2825e9d3701fd3b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b36fca840446f60e2784a96c423acd0

SHA1
cd8f6a07060612869230a37416ff1ff5d3d011da

SHA256
53aef0f31e1a88803177d88f5aacc671f872d620809f7bab823ba7d892932e87

SHA512
47534fc8a3a90e562a2bbef7fb8fd2727fe4c01bb422ed12b98cd1979bad05ca226393a04fc0c3f85a4f4fd16704c378e97c7d0ea83fcd45fba07f3e301afdf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19BA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A6D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit