0f719d6c42befb4edb8e81afa2c481c0671fc504cfa2d03976c6ab43e1b2ec97

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a624a549feb9fe3a599b40cf51ca9fa5_JaffaCakes118.html
Size

119KB
MD5

a624a549feb9fe3a599b40cf51ca9fa5
SHA1

6753400a19f0e7c97dc795c8e5ebecc4b62dc631
SHA256

0f719d6c42befb4edb8e81afa2c481c0671fc504cfa2d03976c6ab43e1b2ec97
SHA512

df48882a498247d3ebd85894eaacb8d3be77cca571af4e1e16377bc16b2eb6d436491e705c8f5b1dc2cb771909426aba8cb0448cb0fe539e70f5fef82211b892
SSDEEP

1536:SdSrV5hyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SiV5hyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B949BF1-2995-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424452588"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1784	iexplore.exe
1784	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2168	1784	iexplore.exe	28
PID 1784 wrote to memory of 2168	1784	iexplore.exe	28
PID 1784 wrote to memory of 2168	1784	iexplore.exe	28
PID 1784 wrote to memory of 2168	1784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a624a549feb9fe3a599b40cf51ca9fa5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9762d32598501e8a568f29905de48a0

SHA1
8f8ea83060eb3ed901a4ceb84320cc8b2d862d3e

SHA256
a5ec72089f691705aebeafad0912bba65042156ef4d206d049c2eb2d35d18dc0

SHA512
691f7908c906192ba859ac795380c07c631bd8acec691bee41ced402ebf4d4acdf290aa751a01f688832fb64256e1950753e479dc1a9870500422a63c34a7720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fd129f82c82f963023832686b787427

SHA1
aa0f4bfff61641ba957e67feb8da6f89259149e1

SHA256
4a9337d11a8e911763158844f3282ddf76d57f9922f62d30d9f5a1fad3f1fc7e

SHA512
f3283075b0b0871c67289767103ad90db1abaa95aa0cbbc469e4edf69e479ec9df7f2072bbe7ad3c99baaff3ab2c6adcb62b431e416225a532898643f2f1146b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8ce099c9eeae55374d12e074892736d

SHA1
0f73247126431486309e24b434134d4f0ad858ce

SHA256
88630355b583f851c53e96c74fa6fe0a58d5e9364368a2aacc563168567b1fb6

SHA512
a9d58b3b97da4ea655427f690948226703ac1930a4ded5c1b4bf27e0fa2742cde522bf102e3dfda4d6f0a303a14671e8202b12721317ea2d9c765bdbc635468c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2590f10e62dd53b73255292773a369c8

SHA1
1de531a32c5215f8080be2d71a8466003e2ba278

SHA256
873c31729ccf887686e72a6dd3e300094b718a49b4b07f4e411417056a55f9d6

SHA512
f9435f8f5985b0f4ea8c00b32bee6f5493d8704f5e688803b006003ebb3a871863e18c53b95fcc8d202ded5df4cf01071b34f517271abd0d8203e9d3b332cdf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa280359bf27759edd2a85f2770b136

SHA1
a9f8d4950c09686093769e5eda657dbd2422b9b4

SHA256
b0dfbd8866df318c213a40c67131bb0036050ad6ce82f1dcacf0e968cc7bc99a

SHA512
39d11e65af681c9a315cc749b13fecc036c6932227d7cd0d8e12520c55ae6b07c6962dd952d6b109701fd5c674aa485955f08665a18bbcf694ff12c6d547cc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3856cae66d7504463231e373ee65aa07

SHA1
f688a701922676ddc8f17892e5111e0275a56471

SHA256
9e5eba5932e0093378071d316e19563361a8164fe703d279564c134ad62d17c9

SHA512
e0e51d4c5a4b3f31ffba8e412c31de7d445a5597977a8d123788beefef88a3428093265143cb56564aaeb25a749e224ffd5160c57c02badff2f760019d4090dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9896bd27a48b25a93fbda29f8ffabd1b

SHA1
fa84ecadabcf42690e01da335b3f9953585a90d7

SHA256
cab1de1271ce302d0f42c1a366beffba4244b6834e01913d0875ad46194004f9

SHA512
ed62863c2813643029d5aba99eae583b30151f56e8bbefabc89fcfd79cb12d2bbfa9831ea05c7f05088f5f03a3107bfa4a96c6a38df9901b2793556920fba850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4be623340273c0cceb6e8647c27c660

SHA1
5a56f4504a84b2a8dfb3d4731b8f294a2bce2d9e

SHA256
df2c8c3192e680092d982e80524233782de59f948df94a0918ea254c41253e2e

SHA512
7e1f780cee006565c28a2eb52c5b4e1cd9f988764eafa816e8339d260e6d87bfb3a25a7149617a5e4bf89f4b7944ba77938f3ecb20db854757c73ff0bc16ddd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41af7f92050072af5003aaee1743603f

SHA1
d853853576418ac3badb38fe40b74d450aac42b9

SHA256
2268eabb4364a5bdb281a2f9b2e8d7a0bd1d7b4c1bb31ac143d56c648b1bbe7a

SHA512
c7b67502053a4f0f4958bf2d153f2d831b40d19b61531dabebdd1eff202654edac655fdad4246af4501ace40c23635db87241beaaff7fd686e63da123242b32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a60ce64b5a2c8b959035f4809b23540

SHA1
2249b4dcf417344bba5f85ced502fbd9c84f760f

SHA256
5f65545196e63a19a8f2135aeeece08a223226d0b9c6c993600f94233070e695

SHA512
a33b1f503cb5b2df7eef1f1e5258794d7444bc835b7c291198f9bafd84a8549f0be2b2412e4d4628f1e5f161e6729939c193f3df3378058b2c2359b289d69952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit