baceb64354b93521839564f971caaeeb2a0f121bd7ba6a765822c34ea6a32ef4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a748d8ff9877a3bf984f72d2b0821983_JaffaCakes118.html
Size

28KB
MD5

a748d8ff9877a3bf984f72d2b0821983
SHA1

d52320baa9e7cb8df4b9fbff34508880a30d8a64
SHA256

baceb64354b93521839564f971caaeeb2a0f121bd7ba6a765822c34ea6a32ef4
SHA512

2e7df3d14a19115cdac936d84385aba268258e12448261f867d9e66ab8c4bc9a416330298f104f921f6f8790009ebb1bea50857afb38722e62e4dd446589df7f
SSDEEP

192:NyMowpdb5nbnQjLntQ/w2nQietn20gnQOkrntGu4nQTbnunQHXCfANpdEs8wuMZQ:AMo0EQ/wi02u9Ee9ElWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424486238"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C519A551-29E3-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3044	1992	iexplore.exe	28
PID 1992 wrote to memory of 3044	1992	iexplore.exe	28
PID 1992 wrote to memory of 3044	1992	iexplore.exe	28
PID 1992 wrote to memory of 3044	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a748d8ff9877a3bf984f72d2b0821983_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f89fc2b90b0726406e2c15b0b2550f1

SHA1
e3f4e14232a4872041cb870ff18bac407b4f2c03

SHA256
1ede6334a4468eb443fef174d60b5084fc8709b8f948ac2b41cefff32c2afab0

SHA512
158a4ff8792fb6dc15979f06683fd5ad1e65b1f23a6cce427444899ffddbb6b6b6e0d3477544bd88e44190977e50b959f101e88f6c84966a18da1ae83a775bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5f469b0705f699ebb487b3a020097ac

SHA1
a59ace1393975c81ff135629d2e87f20db8e450f

SHA256
cae204d1461ac5f501e3eada9fbf7d27849dd064c075987aeb1cd659e319cb8c

SHA512
e731b457f29aba429d6116fdb3d81f8da5bd9b4b8afc3a52358c1a98226d5134622aebfd2e13135ae6f1264e7d4c3604748203225c457c80f364bc679a1d597f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59eb5c875f80b533103cd57aec8cf98

SHA1
5c6193f00d33d46677d41fcf16426b7f17c94307

SHA256
f7b54933f7891dae2a55e47b0c1d12cbeeaba3514af2cba9b5ac61a0effc3e92

SHA512
9746b361a37e64b0a089887b471978c1d8d337cf47b8866d2876ca891e231b4bc2fbc443b680c1806a0cdf327768ce5440cbec37fe046a62ae5c547cc93bd01e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93e89a7b2bba67b1298883ec03347cf

SHA1
504121a30293ef35e2cf5563978a5fd546e828c2

SHA256
a8471d00f8faf00417c414f621c5c3dd07b01b473e01bbf4073f60b51289fa10

SHA512
cca2ede9c963d25bd13576e352443d133c50d22fc1649b818f07ed2ca6095e88d305b0dd59e33cee8148e89d63d7158996d2e4572d945e86c43c9788c2a24aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4165c669ddefa2d7fb5968ff8b36ee86

SHA1
3b4ea82024ffe516e24e960327446daa3fde746d

SHA256
145187c45c0e35a080d754f1add1455afb6683115b39a9f24945b4845eac1e4d

SHA512
1cbd07ca5565a2b1883af8488999f17b755756bb381422d7e15bbed35c9f86f7f4370d232c5e8e296f70603a7fb7f345548ef282b8e4c20621e603f719e59c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
760ba30d2a84e1afb803ec78e5f64c3d

SHA1
832ef1cedd24b50f574c71cf933d70cf92c81ee3

SHA256
fac564ce0ac4a559e7a3b2cf7312b18ea8705bd2691efbfc0387be4235fe540c

SHA512
58f97efeb28d1b4c41010964e9a5e6c87ef912ca1f87c299e9fe62d77d64f9e09bfbd700bacea442a91f5a219e01e6e187b75f96214a757c815a48ceb0cc55f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3624915d12e521a3800de3fa2211c30a

SHA1
ca022d9478ab9d75ef33fda741382ac9b0d803a5

SHA256
feee4738ad290ebb690c88c72584a1b1be9fd55a37ba3335d65690a2c446155e

SHA512
8e8073f5ed9d1e85862db676ff0a44fda1dbb4fbc6a0459b94c8ba31c1da5b87e3b78183bd77b44c3597e5f52104adc04b23dc5c90ad3e6ea3ea85655a7c5904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1b24ea946eefe78e5d3be43e2dab2c9

SHA1
62cf8a79fe0ef5afbce720b073023172c00eb990

SHA256
d6ed8d6af169c980fce6a97ba45c2de101f2360c365c4e12dd8544518fbd7ec2

SHA512
d531b3f369c061104cdf796e12ba98e0804eddf4d526cb29592a57a65a13d0e04438030b458ccd0e3f6271924240d6bac7a8348642757a89d5af5f889c4182fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a8e514240c2ce05452342d662ab176

SHA1
49114eef06e8f084b6ffb0f1ee9327e4e92064b2

SHA256
10cc42ae3b630550bc5bb0726f7d63be8289d988765d16077bda81dd4c093a6c

SHA512
b473ed15de460fdcb07ee87e71a9ffafb325338677b120e825de780f1b0eb7bdc5d00193f19f0d230200ac75c43cb99998ce900a73c5f029f9442c9d9e79bb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b19a488479d42f9588146a78c0e98d22

SHA1
d8e8f9f11ef11afa4a2100d9a745e36844058179

SHA256
8e8a57847edc443b3da16466b0061770cfa641eb6a8084e12ae0615936101c6a

SHA512
bc6fc5a2b897072e27dcc7005831b1428fde98e5bd5a7fe3b3eab020e81f3356e24db081c867e316c6dbbd0a06b234131decabbc29b31420c804ae1a77b697a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab772.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar844.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit