b27ccb833ac8225cc030f542c58716236a3ce219087f35a028d93fcb989337c9

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2e9df7694e2fd824376741a8cd9a58a_JaffaCakes118.html
Size

25KB
MD5

a2e9df7694e2fd824376741a8cd9a58a
SHA1

cbcba260f9b8f69b0a80ce4d6013f9f43e7a0822
SHA256

b27ccb833ac8225cc030f542c58716236a3ce219087f35a028d93fcb989337c9
SHA512

932cd1acf5fbfd1f2f3235405ccf7a7dc6f18ef01c6cd554d616ed064eb6910354bf7b7ed94042925e4f5f9cfeafa80cb9837020dfc085f01b22a8dc1df08952
SSDEEP

192:NkwqtjoGssab5n1FAh/E8NA1Yx0U3nQjLntQ/VonQie87n15nQOkrntbgn7nQTbP:OpoUvGQ/SleF9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC19F2B1-2912-11EF-8857-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424396459"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3008	2888	iexplore.exe	28
PID 2888 wrote to memory of 3008	2888	iexplore.exe	28
PID 2888 wrote to memory of 3008	2888	iexplore.exe	28
PID 2888 wrote to memory of 3008	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2e9df7694e2fd824376741a8cd9a58a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
39db21f0390a3054dadb34cc95f9be8d

SHA1
f03aae79de62f8efecceef3320221e8f24404969

SHA256
48a0a8c07ad2c980f09680eb741cfe6896daadb3bfb7d3e00bc8397887149b16

SHA512
120d056a285295f583cff0f7413dd8dde2f04d2c161646bf227ce81629fed2ef38bd58e546284bbb78f0c3ae94ab48ca001db73288ec606f825422d3a0274f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41ffd3672f0c660b20559299eaf24dd5

SHA1
7d2731cb674c59ecad5d7f848f56be4ceab057d3

SHA256
1e75263db45d3ab30c34fdbeff40b1a145dc64dd8db8d7653d56128566eb9e03

SHA512
a2d6dd671a617f79954d497fb2190672775f966bb5ecb0710b20de9539692781cd79a94a99951120cb8cabc933f9ef72cdbadee351180a0fa9a86704d626e97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7498215161d7db271aa8afe83f222c27

SHA1
11be8a30e5d3fe9655f0b5739c76c7d14abc8de7

SHA256
8b5eb4ca505e877d5aab4a97766534797a9c0ad669e8a5a44fffbc388aed6d3c

SHA512
4aac4bcf8cfcf8e6a4f6cb0b3d818eb55e3f44d80d688a80f99eb4b05c07e30682f451c91e9a2b94b244c7673b1ceb92c819582443009320847ff34d790fd2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6920a93dde442a0d1b63218d9ee9f9b6

SHA1
5bb3960c404b1c563ad1c3f8e85e7e587221ae0e

SHA256
dbdb10561c22224a8f06e1585f71e6df5963c670683861991367c5b098db9a7c

SHA512
3ddb95666b3669347a21eef7df5e6650f8561b80762d6bf380b81db58c7a02b4954e822b0c45554279d48e5c8e5ca5fc80e3cf4af21b257ba50a42355d4d9bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
903c255b9a5d2b742f0bf3bb19fe81f2

SHA1
9357c901e7e52192852225b77224dbbc842aef28

SHA256
93a8aae45ab6c0edcc2f16c0cf7e66560d956376ad5dc6f5d887cbd45c72469a

SHA512
820ee83c6c23541d5cd30eb64ed9bd023c38de8d0b911a068f231d7f880cdbe35de7e4d5b3d40231921a8c475fb3d5b8fc6bfd7d5cd2d5e9198176d3c13ac79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0ea8a77884cbaa0f5abebb8608d9c91

SHA1
39a60184d13b51e52bcba6b2ec813d047319ce84

SHA256
c2f94863d629139544f27bc7df6945a5b87ccdb2957608986a3d1305fbc5f6e6

SHA512
aa92f4128587290b86ed9a0b5d2197565d896be3411922ede0273f0c5348a8fe24845e36a017ab8b2bfc1a9dc4fd602a0918531f540b1296852489084abce223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3c11d2229a275dba184006eb607d2a6

SHA1
85b102f09a0676e4e96a390248c3e1636d12d73c

SHA256
19b2a1cd7cb63164adbe0fac467d9f984d3eeefdf53308677175fc082bffa6b6

SHA512
712365694bd234b7f6cff613a3c79ae33353c219a81a51b135977628591a0ba7f2be14d53751e7516323e5ac7da95ff5e47829729b171b8ac55435a51492fa6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60804bbb5d2f967b3e9b9df68bfed57c

SHA1
da49e214f15d35422776936b38dd123377d6b511

SHA256
6f11e61522827672372739a027e81553b3916de5133efb54618e75ed4bed134f

SHA512
8cf8919f1805a7ea910f98270fc9e9ace8d3d84279aafc4300f7f035d475d94cc2c0c73d3de2afb4101df500b542cb20d378ad95023e57b18345e00e926453f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d7a2785ea9f7ba49069ba7627ef1b4a

SHA1
5112c7325ced335f522d755b9dc4f62c114ab883

SHA256
adec0640954ba66d6fe7cb0500ae1c6231bba14b9b969dd0785af300005ce674

SHA512
f8190d83fbf108e67741bbafac5e65fa253b7f49659bb57b0d249701fc3fe2163c0b618ad0315b20ab2ddc1a4a541dd5c9dcf45dbb94b98b1a79ee7e6a3c63f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5661daab903053f02a70f36c8d05e9c4

SHA1
c0bdfff6db5c891a3223f0145e83ec24d8860ace

SHA256
99b1707f7d7191cdd061547d7d65d088b9e562289d3b68bd642c62d2bfe40fd0

SHA512
18abbc0fc32f53a69eb08c5d11900e67c080a851067d5650c4075705fdc8453aff63b1ec26e4d319b6bd2973738dc328d175698843ecd70f7e81a11835339b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ae4aa5eb46f569e8cef0f72633215f

SHA1
ce6219c490c28807e53b5bb8703e2c3f534197c1

SHA256
bde2bb907bcee2ca28c7075950dabea588dd44b2a6aa7fddf6ed26f966cb9568

SHA512
ee0f6b192d3d8ebebfa127afaba30b9fa3ab09e1f7143c04e3aac14021e61499d7e901194faf0d1ee46c3e7160a7ffada56bb6e59d8757b4960bfd96757c2b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff16138b4a9b38a1215f98e42be7b8b

SHA1
8716171b1e194843c389d016e4114947cc4d1219

SHA256
4eb253b2594993bb51dad5a687b4ac3914f9f270f0e9bd07b83de44f9ccf4757

SHA512
508031cfb607db533cdcbf76b0d6f0ad84c161e16b8f9a62901ca4f2f655393045601f5f97714d8e1fe49f37d19e7a4034176dadbf05c948a86c4c4486a8cddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c1d9d0ad1f21c3883a6f124776cb0e6d

SHA1
faf731fb773e937be8d1dbab75604804f810bebe

SHA256
789073a9150e5eb30c96f2d3c25ad3978ef8ffb7015f651a724872e4adef7fb8

SHA512
29a1e8071e8f2804c2dd83f4746d73ae369fbe00419685080cb6263edc4966aa99a1da0d0b86bc905ec4207711a3ef702a125249a4d8590197fb5b13ac8854ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit