5b980e56d25db5c973fe1c290f11e0ac4713b91d79c782cff9f3c58a55d66787

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8abb92643114fdf79915bb9d16d0e95_JaffaCakes118.html
Size

19KB
MD5

a8abb92643114fdf79915bb9d16d0e95
SHA1

fdb5ef9dc6ca6886cfea0bd8a9a0a8c48f343e23
SHA256

5b980e56d25db5c973fe1c290f11e0ac4713b91d79c782cff9f3c58a55d66787
SHA512

3b6c5e6edf31fa4913ec46764631529523d4482a7c54f5c5602839e798d1d97a367a6cefff248ce8ee7ff2c8bf31135f3eb9c64608a8e7e55d7d9f959c6e2206
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIejfPt+4D5ppXRE/iPzUnjBhLvTJ82qDB8:SIMd0I5nvHpsvbWxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90D20C01-2A25-11EF-8414-4A4F109F65B0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424514498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3012	3016	iexplore.exe	28
PID 3016 wrote to memory of 3012	3016	iexplore.exe	28
PID 3016 wrote to memory of 3012	3016	iexplore.exe	28
PID 3016 wrote to memory of 3012	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8abb92643114fdf79915bb9d16d0e95_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc6b7806c23b24e12f2a9b33918d6331

SHA1
924bbcd8cddaecfaab11055751484c545aa4185d

SHA256
4c796df7fed5b35811e81d094c767b868e9c2ac26186f6cbd2303985100a9ab6

SHA512
e7411db552b60ff3b28d5d75503b419968ae9a52ef29420148cbba1bf20085ca993489713c6b92b8b59bc67b164777da38838dc0aa63d599cb0fef3e6a9f213e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a4a6c464b0093a9a2bc0bbfeb4018bc

SHA1
2a3c7182d800bbc449a3142d3c051efaea0679e8

SHA256
02ab248c1b6c01c0e11fd299cd2e2e1cab02276ee38210c0a12ae7cabc385ad8

SHA512
0db45fa11c0e27b932f8f6f2ceb5da4b3bc52aad0558394816f32ce8d367c0db76ddd480d674847584c40de8d9b6bcbfd065dd7dc7b48a001840c9836da8d53b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a516ebb38ad39503c3a7bb75dae178b

SHA1
671c26208c221b424f96712f054fc327b631b198

SHA256
f892e2b0d2228fda025bda03e4e55846a51596d3eb126ff9ed34957c4dd4a0a3

SHA512
f3c8e65b45f77d884961e4b25c7b8f45a11c13c6b3139dafaf387dd90b0255dcdc21e4a117828cbba5d810b51fc56e5fc3c01ba5755436f6e7bf842a3a8dcea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a800d19a55ced478c4459f9464dd19a0

SHA1
e72a91eb5c1a8eebb616b8a084f2063eebe962a5

SHA256
3f10553d94191c56c99e9df6d46dbf9f5606db8a8f51d9049661e2f687ba9e78

SHA512
a62b93aed517365286996759a1c3cf77031d80e3ef425bbc3ee297afe04eb8a280d3a34ebe14521dbfe5cc1e5a7223fc317ec96384af206d555894b6b02536b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5e554405d487f31d87338d8e9811328

SHA1
27b9ba413ba426709f6e94313312d8fe3bff6ce6

SHA256
8ab949e8d34969de14b0f4318745be1107684b1e2a9db7e41db7abf439985f4a

SHA512
24e5b28c251a6e9ea78354881e5d04288bff7d7c399f247eb6938e9fd1a8b463b2fdf8729f1183219a37fa987af31a354a8b1027597f26fb7f17734a16167082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0637c5b1b22a3c3c4e9932f1ff31ee3

SHA1
8d801df3c8085cc879043ea2c45f35ca44e99862

SHA256
7b158101aa80da80cd203d492dd2f546d51b6cd4626bf22caabd1fd5eaa8b95a

SHA512
0f3dc701e3196b5a597119fa249c2c805938f52323d7a680f9abc08f2a039e1def74cbce7ad865b333472f80ecc5e4d08df87f095f2bd17c2865690552552cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a51626d673d3d27ca019ef2e3255d6ba

SHA1
1d1b3f34df306cd4eb9e18d100ebb34224267a66

SHA256
a74b1f6923ffedf4bfe0a15e7ed4c2659b18e1d58c8a989941d2d758234feeb9

SHA512
05227e3e1c74db377fa4f4a8a6f2e4c0305fd4e49deb6350a7a20798a063c2c9219f38684bb7757ec853277bb7d1b47d281bd9f0577bb9bc835fac0fffe0bfa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef5fb57709b45f2400e246d540ba580d

SHA1
aa91c24059b719b14814ba5837ff3c27b4e4d2f8

SHA256
8c2a5fc37ef2a09a2222d960de5932535b34d58f925e54fe9921a45112125e1e

SHA512
c4cc89c258b1b3d34ad52693da41b7d53acef5c791d5cd217214a4749d62b295aa1d8bdfb17bd984411543441a6583c7938a8ab7886346401379a9de6d9bfd2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb5bfec06a5b4d68520c173f201805c7

SHA1
44d98cd4c42ed392c8bd35d5cd1f4e85a875a217

SHA256
4df6d86520b5017d1c69997e5402ca5c6c2909b60602bf182aa15e3fd753b60f

SHA512
225630b99d668aca9965bb9c45ec62054b23d9d6e2c9751644e642c5da6fe4af14a811461345faf7484ca7d0c4fe2b6108f2075559174045e2196e44e8c65e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88590327003754de6c0679f399a649cd

SHA1
d32fefd8c74e1e2f8445cb8b20b950689c3f89e8

SHA256
0a82dda4292c5b173ea4ad8421cc3c553d63210568828df9d5bba0120bb50ee2

SHA512
a73d158a6fa07b31c14b9e032cfc9d1d26852724f29e16a03ee13f4c5648266ab00273a3b09bb8460beee998060551c68edff5ff2950eb84a273b7e34a72fa71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2129.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar221A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit