5c09657aa3a45253152360d55610ea9619bf58e2d09ab5af413c83c911d2a4fa

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87375323942d670dd4eb2623bcb14a55_JaffaCakes118.html
Size

27KB
MD5

87375323942d670dd4eb2623bcb14a55
SHA1

e290cc6a6ca015ee74e08e0de5f8ff5aff9a722f
SHA256

5c09657aa3a45253152360d55610ea9619bf58e2d09ab5af413c83c911d2a4fa
SHA512

58977c0ca10d73037e330eead2675ac5d1419190b1ccb6aa2e7a107ae5f936f39ef9c4309d3fb3f5db5ae3d060bc8f4bf6bc425f3ef3ecf1ba152a98256088b5
SSDEEP

192:uwTUb5n2unQjxn5Q/pnQiecNnVpnQOkEntvLnQTbnRnQ9eSQm60NABqe7GQl7MB4:7Q/r1PIyABqe7RSWxD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90732591-1F54-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423325221"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2260	2860	iexplore.exe	28
PID 2860 wrote to memory of 2260	2860	iexplore.exe	28
PID 2860 wrote to memory of 2260	2860	iexplore.exe	28
PID 2860 wrote to memory of 2260	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87375323942d670dd4eb2623bcb14a55_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76eb268d63c0ffb1ea70b99ac4de6d83

SHA1
bbb75f744cc8a1f1f61c7ad7722a163acef9cb76

SHA256
49ddb0b5f372ab32fba0cd4230384850735250794f349718b9dc14f24013f92d

SHA512
b9b44e75ae5dec01a1a8bee52badbed0e9e4334791e20840837246269064dcf89f0e343750c68b1b88099029ae736df5e8d397c079e1b59c88e53e052fce623b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44915abc53a6c76ecf54bcbde6978470

SHA1
a43b64d91010c98961a5a977edec16f6364ca999

SHA256
9e64d8361f219384d7b2caec86b8cb37f1bcee5b8d92e7932d72dec3d58d0352

SHA512
18626fd3f2a46312f55ecd741f0350a0f9952fa272ceed16be9259a758ba5df9b179b60b545385a89d48e512ab57f4ca82a3c62c7a4af364a5c8f991a32c0594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5000756192ecd1b473b6ffd324ef0ba

SHA1
bf93e9b830f555651e1525df64fd1932f9b92a1e

SHA256
33f44d82c3efbe4fa58efd48b48adeea8e08f16e5cac52dbc64c7f942cc59052

SHA512
4d10a0ff1896e71e24bd6392ed117aad1e9e1788be2b158e3b2a46d4176267685f30020c2e4a48425a67cd3671c8599cd7cf55b9cc8e1687812041a889a9e905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ef3019e89bd888ca30884215955c9f0

SHA1
1b5aca54c556aac1544fd87d491f2943aeb0b83a

SHA256
a57417b34992ba482d35ecb2e48a9639ffe04c92f76bc736137e87ca902a3262

SHA512
5b84dd928043c080697a93dbd158fe2f59799dcded897423625d60368239ca7ef47a1b7474ee6c760a6b6476bdd47fd682b7b0720a2b656cac6c3a6e5090b448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3690ac2a81a8f014e9a28f74bd9107

SHA1
3ff3cf4acf34ee961af79a1e248a7852ffbe7f0b

SHA256
5f1a75c94af55baea1711ddaec7bc4a08b34694758c0748cb653ccc4a1852506

SHA512
72f37af9749525fe954fa31fe6cef831916042ed8e0d73b57877ed80cd637f9af0886c9d04545bd3a3acb0cbc13edd6b6586a3d97cd28be8ce29b378cc8b0098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8258470d70f5266d10d417d8fe29ed

SHA1
979e537c89a381d4a879a2ce9b5fe448b1e38c2c

SHA256
04b59964abd3c97680a87639bad914ea5b8c224da13cdc5551b6d0d956f8e387

SHA512
44de7a92d295345699ad3e47c070c0180e8c4729379e7ffa4d3d42ca90c7a60f21987a0974103e49ac773d5c6184d457270eb784c631a1315e83eec9dd3f7fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263688fdde3639c629d89206eb15e3f0

SHA1
15dd2f68163aa456a4e4237ea0abb0ced8414da6

SHA256
e939de312051c2f3718d136879aa34fc12026d6aa099ae0947db02478170558d

SHA512
3fd7b96da3935bb6fb702e3f0a779939fefddc1f293f4fbb4e0ef85eef422baf49a9602be983b7a4661c1b08c86fd31f939859cba9137143779290c717bc4878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccdeeee726fbcefeec070c34e744120

SHA1
ce61ae7f63fe593b657dfa23d5c459d65ea648ad

SHA256
da4a7703fc475397209efd191eef6189f24f7fa4368cb5f27823bc068452759c

SHA512
2c5c72293935354188be9fb35ce44ccbfab86a4ac8d9645703992c651b63757713b46cd26996a0ddf8aa3848deed315c6db4014ca23b1ee19946b1743c0852b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1375d7ba4a5637261acfc8fdf27e39f4

SHA1
12965fb8f6400078fd3086fc61cccf0f5e361ff1

SHA256
55b9aae15de10068a18a696a2655615a9570a3151f17aa45a6e810b0d46e4f26

SHA512
d2f69990edeaafdd2b459064cbc69e2349a4d4c100ec8e20dd2071a0298e43fa707f63148b3c63a6f8bfa72fa45e8859a8de2e19a69f8b12c1c2d51cd0a09cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DA7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit