b253ec7e66364965cdca3fd0dc0c7eed38a40ff0e691ee98cbaf0784ae2c678b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88736705092432364d9c0d2fc08debfb_JaffaCakes118.html
Size

138KB
MD5

88736705092432364d9c0d2fc08debfb
SHA1

6db9dd3d9ef729120607d6943d44d5da65883263
SHA256

b253ec7e66364965cdca3fd0dc0c7eed38a40ff0e691ee98cbaf0784ae2c678b
SHA512

519ce6ceff089d97dbd2fa49c2b54261041bd13a2f935e71fd2f20e775db4ce2e0b2c89328f107a52942592fa10103f1b8ea4df5e38ee5cb018fcfcf94fb6f8c
SSDEEP

1536:SIjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsS:SIjyfkMY+BES09JXAnyrZalI+YJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7EC39D1-1F96-11EF-A18A-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423353634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2928	2116	iexplore.exe	28
PID 2116 wrote to memory of 2928	2116	iexplore.exe	28
PID 2116 wrote to memory of 2928	2116	iexplore.exe	28
PID 2116 wrote to memory of 2928	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88736705092432364d9c0d2fc08debfb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff7a1e32c2afe42e3ead4fdbd68720be

SHA1
4cc5a74a642c59bb4506de97f97968b62077f37b

SHA256
2cb246d0f9b756cb5132b74785406cbb06cdcbe2c96c82ca3befc2eb82f2b316

SHA512
df5809d73cc9d1e9a5c8a9415b8ea053ee56df526bf60be1b5abc2d504a499ee20b54245c6ac3c86ea9943115c6c95e34f9cfd7f36c581ffe9b55e1e1d4e3bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca5b3fad4a3137a46286e8d1d6ed030c

SHA1
03cdc7977b5e578e5fdf309a066f749e08d729ea

SHA256
c035bd60b0badd5eb6b92ce886a807b414bf485f8995295cd1cb8409bfb44ba3

SHA512
b82e13a6d2e4e7c8008856f0fc18d31f8d6ec94b30e046a81a61bdfec8fcfc461e0fea6f4c8d66c01d6fec3447244fb74ae78e09d474b8de3a3937d41435646f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d43ded34cbb06b7c4e1b90cdde076cb

SHA1
8f5ce005892abcc89af34bf7778915257c13eb3a

SHA256
8b4764a4cac7e5aeb560b6639a58256295f679448b7b85c2b9c384f7c17300d6

SHA512
77dcfe7e65d94edef61507a6048c7ff4ef36108b54a72f67721197d41f94ddb213296cde161738f73595a85c1b055d4940507fb9f26542b7e6686fcad215b801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aa08f7ad1a3e6f252f1abe478107038

SHA1
f65a4be61de3984476f040d92b1f840f291c9394

SHA256
0031e19d11384278d69c54882ef1e65f23861d84f0e8bcad4779b0cfaba8c9d5

SHA512
bb746c507a027351107e6803089fb23ecfc2055f389eea6c77d5d76173127e48bfa27932cfc35efbc4fa7f391a068f66dff63dab1bde84cba9422ea61ecebec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280c7a807d8c3984ffd5d787692fd809

SHA1
5433b63aedf2046f24f4344b35bfff138b09c387

SHA256
cc1e72ba4499fec246a98b06e704674433b1c71d96e2577659d367b43ba445b3

SHA512
3ed671a1fd2527da714ff121e401de0229abbb1ab1ac2dd1f3f3f2899613b666c66decf85e0bffcd11ea37659e91e54656f5397173dd18c762d6a15881d66699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95e88499988aadac8d456fd6336ba56b

SHA1
ed5cc58cf14f364cd89955b9c1e25c7c7a3ee49e

SHA256
ba29586231b2b0f67297e604071de76dae2fa3b1911999ebaf0902894707aa7a

SHA512
a1465b1040560233cf6587c10e5c0ac5eca395592bb3415cd026f30d1de3e413d12704493e2b11dec21821bb5a302d31961afd29b3e5549b5d801018e0a24a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0f33a3b0220326d585f2e1f6f09c070

SHA1
38b55ec5ce090b0dc068dd4fbd50f37aa80782bf

SHA256
1055783ebf3b814486f2549ec59da51324796265bf700ee2080662e5a6a0ae6b

SHA512
681ad94896e0a7431c3164fd0e1a8f935f49daddd2866208bb31997c6c8969269761d2c94514858a11af4274348918271aeb13873ad13cffe5b2b09091baeea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbc13278b22587a774735d83167dadc

SHA1
1ba884be55d898124a64b189cbf99e21cb1c9e29

SHA256
26354a2a8c926aab84a6f789f90bfa91c8ca9f0c21b11d1c00d8c376e28f29d8

SHA512
369e93bf1246b820acd7ed96d00a438e25cd8c93de9c3d577be92bf15bb4deaad7ba4d181f34ac5fe1f2e27c9aa9904f24abdbe56fd294b9d221402fe96cb7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7365af27eebdee9bfb786938066020f7

SHA1
5cf66a4dc5ed7e254614b4c1425c42ee851909e3

SHA256
200808c48a8f151ed977c11aa2ab2957c32b66945e25e0a2e52f2c18016a5a1f

SHA512
faddd558935492b402ec89ca006dbddb52ecde05464ba9a1a599921e8666bdae631a96fd8aeb0841c8e82511b45d2a72fdcb10d32b3d10576c4521e10d1ba61c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25F8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar269D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit