f13c9bc01fa200e88e893d269f66aaad1f989da97abc4eb53e25e8155ac51efd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

857897c0056605ef811c54b69774ac0d_JaffaCakes118.html
Size

95KB
MD5

857897c0056605ef811c54b69774ac0d
SHA1

dfb147b1fc7bb5a21aa8441ba62e57d5681d2964
SHA256

f13c9bc01fa200e88e893d269f66aaad1f989da97abc4eb53e25e8155ac51efd
SHA512

926db7594ee5f39327ac516e2d17e25f8cbac618e733988c16cd3e7dc0cf352b0b306ddd026730d3e9eeb4c569e5481d973d7beedfe136afa7b0633152f4eb6a
SSDEEP

1536:W3jBxRYL6GyZeGxGsNYKGsKYYBGsMmLGsY/W7GswCqVGs4JhGs3zXwGs3Yk/bCPN:6B7OaHo+WUHir8K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{862696D1-1EE6-11EF-BD9C-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423277958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2096	2900	iexplore.exe	29
PID 2900 wrote to memory of 2096	2900	iexplore.exe	29
PID 2900 wrote to memory of 2096	2900	iexplore.exe	29
PID 2900 wrote to memory of 2096	2900	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\857897c0056605ef811c54b69774ac0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f5b3275662968f85f48c2f4950c33e1

SHA1
a00d8a0dda110eaa41b06c54adebb78f1f6469e3

SHA256
6abe6d377733792b754b1f51544fafb16f17fa4f8a5f812cbc11215b8ed6b135

SHA512
b0273d64c804e08a9b7de252d00269158ebaced199ba5e978035350cd1b4ead58f95824ec6dfb807dab7004fa6cfe52f70847af5cc6dc35320a08db3c0d7046e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f48437f8921e50ebd38403cf1c125894

SHA1
e6e01523455e28e8b8654a8462dd9bd52a1648bd

SHA256
eb709cb94c5971b2534791909477daec264859c933143a94894be982b26950fc

SHA512
ea340e3040272e69780d4e99a25cd22b7b756f948e501609799b1a0c8f028f59946f6496a4c43b0ba384ed39e4bc10555021180c02ae42c07eb8b88d82092bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08c7ef89e5132558d1790dff058c8d25

SHA1
70742e14d06eb8d5e65745245f2a659733e97e14

SHA256
7091f217d1614094005113e93efa8ba6ca3d7ba2d4469f3cc93aef9cc73d6925

SHA512
0ccba1be5642b9c8af9ea8d8982f5d402631ca347eabab2268092325889124cd1ff82694b8bda71680027e7f1b6da7352316697c2aa18497308d19e3fff895d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6d07e1e89ac51c10b4b18f5ae5177d

SHA1
0feb10059fa3428d5c891c8c1a48261fdc448cb0

SHA256
83b8f772578a61ac458160f0b27bd374a8865270b17520fffce17ce19b3a19c0

SHA512
b7a7bce5705da64e385df7d4a6df11371c538078718083a0636ceecf6411e9d930740cfdf27572858aaea0b974af97ea27e894e539d93f9c1c3dbde550d01592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5f4a5821c04f2a82aa7f659019e00c9

SHA1
3a8bbff1a5feeabd72766c1eaa334e27f8a58e84

SHA256
93cc93e1b33766f7428116ec29bb460f390f980ab6b4c6627ffce7b6f64a124a

SHA512
ba09efc5af503d59d5bff6129e45147493340f22062b518860c6998adc767168242b53a2eab03bb033a01d6cc51034c60029e20e91dfaeca6a8db1013530972c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12f36bf8bb004d0234066818bf490f09

SHA1
82d47ce8de573b001e993cf0acf6d1c042ab281b

SHA256
579c6b766359735473484b7d6de9c57ebfb87da5edc7cfdc0d886e07d8a57033

SHA512
8c9828b35e47ade5ce2eabaecb44c2a09465c97912d2d138d1d6be1c121736d3250d8d39d9f8e40dc8ba8b91b1f989408bbe906681cd05eb2cf6775cee2f1009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8024729e4885f9537ff54086b7d7af0c

SHA1
9aa4c3e4b4b7192cb9dbc4c1c528d4fce15a66ab

SHA256
4c50e3f51235ac6bd35a94bfc0e12e44524d978dcefc70d6782c379d68845d63

SHA512
d3a515241b62116ed4327828aaa1a8345fec2c7b3a5e42dd736723a785e23d848b8734c6f4e627295800f737acdb497bd5097b44e1920f30aa1b88d0eefd6381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b249b413feb08ef5e7df288ce88b01b

SHA1
c84c0c65b600fb2e2c5f5dd874fe35e0ba9d2e2e

SHA256
6bd3dc9f6070a9db9db2ef901cb5f541f2d6d341de005eba4baad0f443f36010

SHA512
fbd5fc2ba4186632a73804c3f4e0cb6513cb08b88dc20f4b809f5035aef93b1b51b3970ae8dd5d4a155f5d234519cee3e5c171580205afd7dd3e3d4f3da75556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c67c0778c88f2462a1fc3d368f9f151

SHA1
b58cf46a81ef4b6e2dd0d07c383f63691b24b3e3

SHA256
5d27c9020fa4a9c6d4ccf6642d1b6a098a2615f805484b88c26bb5ed950fe4bf

SHA512
49857a6b785f2f37495d5f3086e784b051b6b244a5e8bbc91606a5d557563c515be4183e5eb0799fa79942dc603d0d948ecfcb0cda5010e0e739c05aa736e02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
777b9695a1e88d228e62d4c4848b5cdf

SHA1
3b66c7b3ff9fd471ddb7a292693609692a24450f

SHA256
d31d64467fc8ae9893b6025d2bd1217a0cebcaa253431fbbbc1c5c897cbf2f8f

SHA512
614efe617eca5a205dfdb8bcf26ebcd8618f661c25928c8151a8e0f4efa4d199a27e22bfeb6f2e0e95720659306c537d108e9db9cbbb4120ea4dde308d9b7259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit