0ebf7053dc2d3499838d3d4a7b5775974551e3165daf8794f00fd8b22d45033a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86366f7ee7b0533d3d51a5ca9319f3a8_JaffaCakes118.html
Size

18KB
MD5

86366f7ee7b0533d3d51a5ca9319f3a8
SHA1

21929eeb319291f7ab680e7c74fa29c3026f1c8d
SHA256

0ebf7053dc2d3499838d3d4a7b5775974551e3165daf8794f00fd8b22d45033a
SHA512

09eb94e51c98bd695b36b45a5856a4f9a6cef4da56181a33db22c9aed23db864ccfff4e6fc3588dce6d89ea82ad024c8c442bdf7df82feecbc156d28a33dd51a
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIy4ozUnjBhku82qDB8:SIMd0I5nvHnsvkdxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{036479C1-1F17-11EF-B459-56A82BE80DF6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423298785"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28
PID 2320 wrote to memory of 2184	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86366f7ee7b0533d3d51a5ca9319f3a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
06d052b31716e214be671efa70696149

SHA1
9bd47181a9c806fba874d53cf4771cc1cd68f35c

SHA256
614c96bdcf2aa2659a36612c10f0c4c066da0560d9827bfd6e4b9d25e7cf8d82

SHA512
4d49dc51654777352b296d264b96435017329bb043b5fa746b604abed7795098a29d143bc53bbfc6831a7d19ddfa460f78559a1178393861a2ed853f96e8c875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6c71e708856c7021b95ff176ba69bf0

SHA1
2440052ef7e9d94d29c12f123e46bbb56748c8cb

SHA256
b6dd7ed003cad357e5874c3e3164b8bab5301d2bf0fab7baa611809447177f92

SHA512
cca3724f673a5a97db5c6aa37e41bbdd1bf28b82c44aa89c13157d7c7964be760936ccd9021b5a27e3592d7a68b4c66a2434570631f4ff540c54fb26ec353d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d247cbd8887076d4c7c0ba5a73cbc9c0

SHA1
c4b75dfdeef5569983984899d092a518d407a5dd

SHA256
67accc3c478c9662e21b25e6fe8d06ae4500434a11decfbd3bff51e4d349a94a

SHA512
a5fde8485206387c9b627b91abec42f4ada897d540b791f0258a5551f7a2921aa99dec1edd555c654ef5abdeba7f4a9fdedd3da45c65b1da703151fc0696db76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbd29f2b2df5773cc6621b8d6f3b54a1

SHA1
15e8d86c975ec63ad68b2b5e3207c31425cdc1f5

SHA256
aa6a7fd3b88b8b8a17e0d060afcaa2cec07c8f126bdd028bc6404dc9295c23d8

SHA512
6085685ba12cd25629f31792a23335b455bbada35dbaf326177d9ef136ee683d5bf8fdc3a9cc78a9336ac143141ee6d426e990fd5f98f12f964d97ce73d6ad35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdad7590b6b8c7b2222f755aac95c168

SHA1
eeb33066dd5d78210c320af1997c702154a07ae5

SHA256
6455ac94fa4642abf62017e324ea8aaf27bef8ac8ddbc07f59962c9084be1d17

SHA512
8f0a07bd744de8bf663261ef3e1eac6a92cdb2ab4e42583e7276addd2d5ceae005b67c1031ac3bd9a86725df976b0932d0307f3c0a872cc5fb1171989f09aa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a7337b6b4fd17fca72189f052977635

SHA1
7e4c11bda9184cbd4fde85092fe40a5acf6aa317

SHA256
4897a57eb78ed03c2247a0ac42d8bce7959513148279515a798fb2232f2fb635

SHA512
a2e6c28b48baaa1a4a680020b03c4bde9d09c1ccaa62c276f777ba4c2ed974bf936a0addab09f829bba5c0e3e40754e32646a3642795795ccef422d9696c1091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
647a0186a36bcdc77633fd045b0d5405

SHA1
74029b626bb75f3988a2fb7f1069decffc6dcab8

SHA256
1d9b54cf0490edb5082552706721ddf0814bb323c4643a8a326217ec0148b456

SHA512
46df6afeaf6d911e297802f7c91daed51632e5e0e63c98317db33fda0ca41f7f2931bb5368917a2f407eeacbac6282a5b267d447c139d696fbcef12e591076f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd797930acc7c67c8ce93a75b138dcf5

SHA1
a2d00faa4b93247a12bc1413c16f2ab85c5a1c2c

SHA256
25eb371aa8c8c1866f80288aef68c3f4e1a2384c20a70f17c7a5f4b6f8ae1bbf

SHA512
27086b2f7f49aeefc74265d9f28ca799c21b2f8a0dfaa7c1979055df2e013e17acdab29ff629ccf61f575635852124b7a9a089831c62ea65db463d6b7bed1abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b231d5c08587bbdfe26932dc3fbb53cf

SHA1
ec4e9734ad4a02ffb09a50cb4d5baf76d5b7c1f1

SHA256
36e9b480286daab471192aeae58948fc1cc1bfeb5e419fd2b27f2f68a43a86c6

SHA512
9daf3a652f5d1ca5384831445eaa44603fa00f8b2d040747277f766ba3fade68e04c7e4dca5fde9b916803c9b6116f168c5229c94c4d8e48354953208719f470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
294e75d39a2f0410053589a5ba2c57c7

SHA1
8f80c1c225bc5c13e35aa8e813055aaf30723e7a

SHA256
d278e9175a39fbd70eb83fea4918c1a878f5e0b3f5991813b6538a8012730f8a

SHA512
23e4a2a094db702cbfcb0965fc8d5aa4df2dadd4ef0457f350f8c30cc25db4ae10675ef51c1b649c1e32ae71da09da2ebdf34a93702068093d5569b85382a031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503ff7152769f2c6b6e029011c887a08

SHA1
8028cd83c6e3f1d81692f53e075115489f514844

SHA256
46b173ce77be00afa5204cb68439d5deabb1ae77dffeaee7eba79ca28b626a12

SHA512
dbcf388ffeee13010b365c23b3fdf0a2db0467973d548e1dbfbe1f34e9cd8e7fd0a6b56e1b71f646bd02e0193c42ca67ab63b988a4f2cfdabd4d5c2086d4d40c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c9a848815736cdb15faf1dc41bf6e0d5

SHA1
aa93e9b05dff869dc3aaec3f5be49d63e30ad7ec

SHA256
14a2679b1b1359bd843e04155225b731bd93342e5368a41a59a47d547c1b241c

SHA512
bed9c7bca1c9f74d215cbda4d53bf0e269a633563cc856b67ba41edb277cf29b98ae9eeb9f2e85b461cc03679a0afe3272fadbfe2a30ecb0173312cd4657dcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1634.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit