fe2ad8555a570239d92342282fa28057b19f42939cd5e4468ceba65fc03a2ed7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abfacdf74d41a00f4e5fb50fb147a84b_JaffaCakes118.html
Size

35KB
MD5

abfacdf74d41a00f4e5fb50fb147a84b
SHA1

150508a8c3a7dcbcc3cb1fe869fe319c81f37642
SHA256

fe2ad8555a570239d92342282fa28057b19f42939cd5e4468ceba65fc03a2ed7
SHA512

81593ddc18cda0a4d2c8a081c55a543d454341c794bf195d78b834127b274c49be7c174d31903e558593eb8b7f82c1c483e0e72cd838c800c2ddeb9f0530446a
SSDEEP

192:uWXzb5nKPmnQjxn5Q/OnQieNNnj3nQOkEntSwnQTbnpnQ1MCoAOStEiyiqo/VK+2:KnQ/tp+0tEJi3VT6jHdztsX8Cu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424569414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CB0E731-2AA5-11EF-8221-D669B05BD432} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28
PID 2004 wrote to memory of 1196	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abfacdf74d41a00f4e5fb50fb147a84b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
98174b5ec830a91fe3f64ff84fa12b2e

SHA1
4683d6b2aa8c7dcd65167b6b09ce8b06b1e345b4

SHA256
d6bb4f818c97ab2a3da5cc592cf6681c343a87d017a53894657c7d69820960b1

SHA512
03eb8bf4126acdd97d722c092813e5174f669562061c65c9af9b116063afe57b8b5dfb54d7ade5f80448990f63ae6373ef81e01066a59b6b3f7099e6328153d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
614e452d673cf97c754fd2b61486b838

SHA1
0f553f241439fe5b769b484f8eaabe95e6e67283

SHA256
3d28c4926779b2129fd1aa629c10b73290c45dd8d9b437af18db90d54560794f

SHA512
cc117525ae280a5602458ece973c72f7646644b3682d63a6929bfd04718cf223da313405c0fbcf2fad43b5e5eeada0040c734b04f7e9e5ff479136e98ba0f8e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1336b7cb207ec2132247a06831116ffc

SHA1
b099bdc868d37140c4021a2202a4fe3ba343e678

SHA256
ec2283619dc2c469fcaec53ecc14136730505807bad47d0b3102814f0c401328

SHA512
e15f0325ddd47bbea8285a706f450a2ab7f6d42e5003458e07ac125cda8562e05e83ebf480a32cfba61d14fbe01288509ba878f2bfba7a432a3108e005ad59a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31e44f28048a7a699927594648fabbb5

SHA1
3c8b24af08d5ed8d04cf65bdca75df007902a055

SHA256
c49e0926630422f624858f3879b20cd511e67c5075fc7d599021022f87269beb

SHA512
47c3e87ea5e008fb04e581cae5559c323fd44c72d564b7a978373c5d831bbfb91fd01b9b6275e5d0e08e9f74b4283aa307c0a9c17fc9fc175244db43e08be987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa1207b04b2995dd492de7054f73f944

SHA1
6a1e9c69a3c04e3790964b5a345af7b09895b0a6

SHA256
b76f0fc94598c61dba97107cbbc01e93d3d7beddb84ddc392f583ae006eb2f72

SHA512
803d286cee1b40a0c8af01e53f72ba1f2bd0afdaaac051913281d26fac7b45ec75b5c088764bf00e6640a87091f252010901001f43a2bdca2fa85465e92d0bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d07cde459c14ba58637a30774c6803

SHA1
a405fc2734ffbc38cedf72fd5b609c6853cd026f

SHA256
a10f384d99d7172e4095dc40220b525725c2aaeb7104dcdb30a2d50d5d888308

SHA512
53f3f20779b987d07e9117d3471927e6ba99a32b12c10d7804dc4835e1dee6d13e207721cfc8b87b09224d02aa4b51b22c13f6b676b5013decabfeea4ada60c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00004abd04c6e6bfa4a5e09a4559f1c3

SHA1
6323f1199ef14f9a297d15338577547e5ebc5c9f

SHA256
5ad7f2187cfa71087a96e4f373ccab581e2510d7bf7440df8e8e2082eafe749a

SHA512
3d171cdea4ac34acba08934bc935e15daa0103f47113050178738af60d922f182aa0cea00bace9014022d9bf34bbccef245616d54fe8724fa669b5086d4062ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c868a1d70c9358c66876f5e12edf6eba

SHA1
a0ef201f3ac4b81f5fa4988bae7e8a9573f67726

SHA256
86f0ba7ab1de7330f0e1d1574905bebd7b13ec17a0491f3120f39e8fbfb997e3

SHA512
5236891f0e656368c631e37b002f72a8f3742401611e1f6ad4dd5ea9f0f6c1e4280ba89d2d1a994dc5a267dc965df7d69885218432e317510e35c8db5c77573b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97b060ab590c4ea74dcd24d167c0fef9

SHA1
9865440d8f7ef94adf1b0dcefbd79bc0962a6e45

SHA256
0f45420b47e6090b7a05d811adc399f8bfa8aea614a2a866a90bfa0b09161873

SHA512
f393c26e84bd582cd326d7123b09932e1ab7ec02e708eb15281e2d74aca99b53e71dba443dedb46915d01545a1967057cf301038057d92193b47a247a42c4591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba54188a7656eceb266aa18b72fa4009

SHA1
6881cd07b2ec2fa10187ca2a198bdc355528c029

SHA256
62bba74e6b4aebbacfa5630aab14c0b28d905a08cec003ba2fb928cb054bd4e2

SHA512
7633bb6f8fcc5e719830abb998454ca2972d6a2ecf86b14272a736b8f8e7dc0956ae33c0cb4a15120eee87da3361de9b113c3b589ef0264215b9fa5769c1fd6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9e30c14c6f857a00405d42ae3c152ac8

SHA1
0447c09fe924bfb690e5094b0c4263bc642bd5e2

SHA256
a880dc9dcca777cec9c615e125023bf7bc7714ed4a7cf0dc710b4ada46fb4c11

SHA512
b704b78b3bc72c690692a565fb95b869a7c67e3272f0c6f289b9f88d64cf0e07685cf54c353166a4d897f1c6d62178e6c1d3383bc2a140be9729c764fa56926d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B62.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit