b8a642c3908c7e95667901b72d39424ebc258146028e03a01a28e4192b15c7df

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a215aed92f08a825764410a824c9afcc_JaffaCakes118.html
Size

131KB
MD5

a215aed92f08a825764410a824c9afcc
SHA1

4effea6c09271456e051d5b12ad355e5fb9ad213
SHA256

b8a642c3908c7e95667901b72d39424ebc258146028e03a01a28e4192b15c7df
SHA512

8fce9acf2b5122175faaa4611645eafd5f45344e51ec34d2c0d3392a71bc9f13b31ed6596e81aefa73f96f5bb53734d5668d2db14c80bc7bd77581acf1d115b7
SSDEEP

1536:SagtHI855lGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SlHIxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADF69661-28F5-11EF-9E06-5628A0CAC84B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424383980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2352	2356	iexplore.exe	28
PID 2356 wrote to memory of 2352	2356	iexplore.exe	28
PID 2356 wrote to memory of 2352	2356	iexplore.exe	28
PID 2356 wrote to memory of 2352	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a215aed92f08a825764410a824c9afcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ddf204aa85724ceb97a295aad40385e6

SHA1
ce2e43fcd59ad82bb5629e400e8c96a3d94c69cd

SHA256
ea2200a2f469343056d1bfbea260d158f82a86350ef0a91a9159eedf62d4c434

SHA512
95df68a22fd294d1eb1907fcf35cafcc79b873bce07d1f9861f59aa1a0f19997e32e9574fd7176e1f37306a38783ce2af20f1ab2601e514c141b425ecc5c127c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36f18d80d57e9c0031c209842e425cec

SHA1
6248b22f7a4a1a4abb062d2a06cae28b8d444a5f

SHA256
7b38e931d35d4ce4f85787517850cd76b2aa7c413c641221225a454cf12424a2

SHA512
92f7893d8f1af554e2ac48b57435191705f860cefa5f9213937112165818da7aab0ad342798cdfbc833d7520f7c5a7f8bce78bc9fa6a2303a3bd7d8aeff09770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
962139bdf4205092ae3145032fde4884

SHA1
bfed0d2748a7997d239e444c324df14d4cc1a92e

SHA256
d7ed59848ecd7fcbba2b4d374aae34409bf24a73bfc3e3bfaf6c56dabf10556c

SHA512
bac8ffc32f26a7abce2eb9f6b641cb26e83b19b713c57228ab12ab5a97c4dfe80076d3f9d141827859f8e56e86b84d032ae2478d5c86ba1caaf6110fd721524a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
521c935628cd843c80f5936368591881

SHA1
51e07cdbf26797e6e39831049015b2d344492ad0

SHA256
1b38c2460a0ac7035ce3b076ea76629deed56e1473c15b0200178aaee6023d9f

SHA512
e9f5f60da5eb21cc9b02f609f9fe6281e8a4d0cbc14280326bcdc227541c780ef0877fe45845373df38d2f0f8d247cb0e3405b3f63c84b2a2219c6903825a509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140beaedf8f7b6be2a8dbd61c40f619f

SHA1
dabb752543e8e3a324b1694aa9a40aa229ff3fbd

SHA256
c1e09b25a274807fcc826ea5f5ca8c61864a18ebf29062f70c6d7553d84ef71a

SHA512
122ace1c0ffe38256fce1b2631abe68fa8d6469b5c83a482e71ef23f3ce90788e6698b405a48688c7edab9ef79d34e23a795ca5678315c148398b67a3187f7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9cbf34581a1be0bf7acf3e48bdfa26

SHA1
fea65f1f90a120472a5fa4de1cc32b8636859b06

SHA256
2589fdbb06c2a7c9f8ae005cbac201f0392dd70bd6a5f0b6effb5953b132cd15

SHA512
6c95ead52ad28ab89a4ed325232c86b425faa5ae885e26f0f2c3b4bf9460fba47cbe6bc7b31dabcc41f7e55e301de248214acd110985b3cefdd5b0f1df302175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b9053c008dc551ae52ecf836e0d21c6

SHA1
9dcba44727978dab30268dd970503f7c822e1edd

SHA256
188b298a6871767f0bb19c889832377cd8448e01b5a1b3c8038344beb08cb873

SHA512
c95ef0070cde6b62a7836ed5eb112045c5c4bc559af4b51f55a1adc9065b0847eba2247351ad5c9d4df1bbcfc117d0b2ae0d5f9a9aff0c949da43c24551cac40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f2050bb0cb603eec7d6f554d6cf9f9

SHA1
53df9ba55e2ffcde0c0ea77239041869da71e8db

SHA256
53834210480308cd89af5b79eb6360b61e4f14578b42494af3f2dd78ade806c2

SHA512
4be89ffed8884b1b6e5f6465fe9aa211fcb9ecf1eba61dddffb499ed54943b9c86dd46bb948fd94b707de2b9db4aa71af82330ac36b99cd401c041c5cc337c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77b9d19aac13c80043ddab5a6e864dc6

SHA1
303fb1deb164184e867728202fb7383552ff4135

SHA256
15f3b5d5bfa877fab674a5b3fc53ac194ed99eab76d1491e1542eaa61c99deaa

SHA512
362066a95e58cf9863a87aee1be411c878d850fa5dd71eeca9edb1543164ca557a2dc9e57359538be32edb15b94aa6ebfd4c9f8763c8a97ec84b580e3fcf3f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c7f57af646100cd3f521eacae64cce

SHA1
4bc4d5f7357e669acdf1298b96e1feb46b1351de

SHA256
108488576ec1a23a40719c946a92ad36e8e54ccb3326fdda688aa6b5099c57a3

SHA512
8576c7fbbfa6251f0990f2b2380cba60402292608327fb427d094d34d21ab1aca24dd04785231cbfdffd0e7aca16e331745d2eae9aa62179916be2db2d7e648e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d1a096d06ecfd486c0f58a94d067b82d

SHA1
f073203355fb06e853c59e234d7d06d5646b7bda

SHA256
4de709eb0c5afd6a85ebe10b0605c5f2d1be9923b3f5a3543014c1fd3fb79b3c

SHA512
72b415930442e302564024267c492efcbbbfa4cca9d38eedb9198113ca513a341b84e9160c544977c7e7046cdd56c8700680a7b49aed1842b1193cdfd7ca47d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar765.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit