5cb4526673b0923a1484916a7d129a348f29a6b1058569cf121ca2b2b7f54960

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1714b1fd636a9fb4829939b446f709e_JaffaCakes118.html
Size

18KB
MD5

a1714b1fd636a9fb4829939b446f709e
SHA1

ea86b9b774f58b3494ced83fd778ee19baa58d2c
SHA256

5cb4526673b0923a1484916a7d129a348f29a6b1058569cf121ca2b2b7f54960
SHA512

9ff15283a3d456b89ec12439a106b2ed9360ca3610a2c9ac73e3432a8434bff1fefd7411fd747135a49bd49df9e460df95681d76e23ff980c50915a0976db140
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIb4VzUnjBhX582qDB8:SIMd0I5nvHdsvXSxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C008761-28DE-11EF-8221-D669B05BD432} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424373964"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1196	3040	iexplore.exe	28
PID 3040 wrote to memory of 1196	3040	iexplore.exe	28
PID 3040 wrote to memory of 1196	3040	iexplore.exe	28
PID 3040 wrote to memory of 1196	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1714b1fd636a9fb4829939b446f709e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fd437bdd54faebdf5456213b084621e7

SHA1
cacec31734d9038f41e79430ef669090c4e45074

SHA256
c6d18bbe13e2f12d2f8ac29fa6acb9c31e94e0b6584ef91816dd1aaf4fd733c9

SHA512
06af11c896512c88a88c758f3e667033bc5d169bd9c28a3ef928f87522629b31ec8de6f77168a9f650ee143a00eb310132abaa4cc17442e0a9e22f3587e66b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
824f3df5d0dc3f982df9cf79313f3778

SHA1
e5a3dd9677e26dbb4e065efeef361f64ce244415

SHA256
0c153d6b830e9006e9ebcf9560b309ad71f1815fca6664c42957a2e52c3e14f3

SHA512
a0365280a4c154972221c203c3649f65122987a464ed72a2cdadf0ff2b7dc919087639d996e7ba80500f534c6775c3a438797be925cfee76e2fadf6b339ccb0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b9df307767327b542c16425c17c8dc4

SHA1
b36269ccbf4d8b0600af8c92b4357f1924977a65

SHA256
5b9b3d901ab269541d86c876bfa4c4a972e27469fc12c869dda9c518bf8a3639

SHA512
9fad54745e7075d1cd08620ce69076a33e994d1ba9470b39e0d81e75190f8ead1d66d319eea074f088b1c515cda0a7bb714f54115bb36d292cbffa966328d292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
270be22bfd6649b0e685d29d5943d437

SHA1
b272155c539b1ea3cedf7f91d484d1d9cf4fd5c7

SHA256
2a5b60877963e640287df1a73d658bd575735e28c99a7e081dbf9edbd1c073ea

SHA512
c4bdedbf462de9ecdbc908641cef4c706c7ff752738ab3474661e0e8412e1bf3cca03890597960242814af6e576346b99fd95aa9011b9222e144a25a80ec35e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa1595b5baaf36c6a978795b5e4bd8da

SHA1
0807b63d02d2dd67b1e41dce02ff282bd0bfa10c

SHA256
2329686fbf1864fd1cb43ad86df1c35d2ff7486ef1b23e58e29bb87e70b48d8c

SHA512
e1e913112cda3bc6b838813d649df1f5a1e69b9065ededb16a5a59663a171ce5ad31a17cffa2b214f927acd2ba6648a28bba5b46f2c65356fe6e1b213f2a288b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43ca0f2eae503168474a51dead1e444e

SHA1
ddebe5b772b15b594ccda1788e3db8a95748567a

SHA256
ea994af49a28a4f0ce7da095109ef42c5856b747d5c5c34a5afd1912dcb26987

SHA512
41d56cf7581b695c28a6e546f0faba7568ee367af0d57bea60c766b5c6bd2fa5bd0381c417c675868ab605a3ebde3113548c1756f865c01435e66075dab1893f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
835b4502ccf8c737f7e4eb79b3b65b32

SHA1
9685d771118f4ddc14e7852ed419431aced8e49a

SHA256
a5eca2e1bc43d36f88eebd6c3d605adce518c721900c25c7af99cdc9cd0d070e

SHA512
7bb28ba06acc91e44308a604e489e1f3519d666f3c4e9a3f698186368affcab6650897629e601ef546cb9f4e563af0a32b14ac2f38f66a72a6188f69ec34e16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
829c8eb9248f9bf9e9d745068e9a622c

SHA1
0f761a0d94e1841d0b59c2c3f94cf08f81168190

SHA256
7cb9803f38179eb80d804246000282bb3194c48041438c7a8db54fc060133367

SHA512
bf535817a58dd7c26c3c66b14dc0f811daed4aadc75fa68d7ada1d0506964c4194690f936b2dbee494fbd6b55263ec7646e36306db8d982c22cc2463b91b7c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3f60d824f26931d24b931a5a70ca140

SHA1
1bbddf696ec9f649ede6f43276b8011a5040894e

SHA256
7e4fdc63ba7fe4b1a2e1023f644756c899825cf0d6551b0c34e727e06d154601

SHA512
499b03d6a9a4c73566337179d8c51d778b09bc152d309e144710cb30b6847b83e6fd6e008e6214832049900e4c5bcc2c2defaa378a34394a2105e33961cfc4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c8174c3346d38ab39f4b46a30ef35f78

SHA1
a9636e1f6d9cb348dcae9c70494074bb2c1ce8be

SHA256
98893e5f59c00cdcb24b6dee6c01246d7e60b8b7ffa10294164b8ed6de85b902

SHA512
c7470de6b609e2ade88d915264272362b8ec7977433989a9a43cb93681115951d6de870ee5594dd264f52bed06640422483a90f90748d777cf6d35781973b2ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit