d79b7ca7035892e4152c3ed35bb18fc14f99440ce4664955e87a2605707debd4

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab53e2d53146fd7cc42673a5cebd49f7_JaffaCakes118.html
Size

13KB
MD5

ab53e2d53146fd7cc42673a5cebd49f7
SHA1

3fb751d471ddffe99b8ad03106c724b50cf5d8c1
SHA256

d79b7ca7035892e4152c3ed35bb18fc14f99440ce4664955e87a2605707debd4
SHA512

063c04ba475270e95b9425b4e71ea545d12d1494826c265661f598cc65dc1033b926b87836eb06cfadc748779ff1e6800edfbbbf2eeb31a2eb891450f918c247
SSDEEP

384:W0QIh40/exCSkqQ8cGQ8irF3L7bO2j2uip:p402wSYGQ8i17bO2j2uip

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424558919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDC98061-2A8C-11EF-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2444	2008	iexplore.exe	28
PID 2008 wrote to memory of 2444	2008	iexplore.exe	28
PID 2008 wrote to memory of 2444	2008	iexplore.exe	28
PID 2008 wrote to memory of 2444	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab53e2d53146fd7cc42673a5cebd49f7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
27daae9b60dfbc61cff9b818a77b8536

SHA1
5997fb699e1b4ec96f4c5b3b72cc52b7448fb21d

SHA256
98bac6c6b60595d2de647ff3c2898a36fb2124d16a145c45b6c66ac17a3bb141

SHA512
7ca67aaeb81ffbe6dc4d4b24d7be444a435e97bd2fc22d202a17bfbd5bfafa446d9f412b55d7e882bcd4e72bc411b1592bd7efa05fc925412b41350733fcf22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b2de2cee80979ae9ecfd674d46192b9

SHA1
16598a0a3f16fa402ae65b4f3e62ee1ebec3e42b

SHA256
cd4240e1ca904c8a567b2d1b7e527ba39fe0305c8e76e2c5be196815c0bbd575

SHA512
9b4736cf37eab18e9bfaa482e471e0e21445147ff9b5dda743a8d3534a6e59b6b6961ff0f741f105bdbc8d33d6fc37d034b4eb3f25a17a135c09562ca72b7ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26b926abbf1c6078650d9d38e015a9f0

SHA1
c086071cf5c0ded51364afb78cf3e745d716b477

SHA256
6a30378d245bb50b840567ea8f86099861378c2eb2c975bf234ef9d0e664f14a

SHA512
2c42cffab2d9ff3ff978fc266d0bb2622024ddcc160282f7e6f2abf657c8756836bfecc000c61c7530d6178e6dc7f0d399163de37f9f01bbbfe6719aeb871338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e679e92f5671216400fdc3f70ba45f9b

SHA1
cd659b3ec088fc58e15c7e929f27acc964edde29

SHA256
c097259b7b6a11573954723c77756628b41684a6aed3fa04942fd424fa1a9457

SHA512
496af804d2bf038cf38fb24d00d972f38dcf322b92889c978067c93bc52ffc59c36d25560b83b28569007ab953310dfd7cfb6f84d32f84330e4272aeff4a4b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7917fd6fdb246bcb8efe956d3fc352b3

SHA1
5a96f994655a0e95eae89d733b1598c56016f590

SHA256
31a059778daaca81719924f4a4321e78e1e11381a29d7eeaefc752f96030096c

SHA512
1b695999b9975c89ce8ad198680d090ff20eb4b6c60b5e14ac87ecbc4d449207ee7694087372dde9d44ace9d700c26bbf5ed4c8d06f1079f63464656dd823c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28bdf49049893b56eb3e016987b0e218

SHA1
8ca0060860d9ccd2be06bfdee7c045b4a0d7fcc3

SHA256
05bb7c461cb283637470fb91ca0cb1a40614aa53efc5f28591bfd0e974cd145f

SHA512
0de6220c4c0e2d8d25081343266ed682815f7a3b05114c5bad0f714e45d797b1d616b7acb4991ccb7c6f558a8e56b45af2b41106cea6bf9866dcfacb210222b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d857437b4cb713678082d33e9964550

SHA1
051f2231e5c0ba288facaa7ec278f703c0c1e7f6

SHA256
a9461b5d67ff0c822247cb302b656bc13f83bbae09f33193ebea6bee6a4c98a0

SHA512
07997d3277c6178d44d046697a3e2443627c8248719364357bf415776477eaf5b577767507ca20c2a23dc12b727876dcbd3545893ca66eb04c9a3ba1f602e701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa49dadcb4849bc308b814f70198286

SHA1
009f9dfad051e4f3fded85c59086ee00f18cc3c9

SHA256
be4421ca987ee1329798c094ef1af8b9a03e07c4493fd4cfc54dc4c57dbe16b0

SHA512
0a097c6eda97d4fff309c9c77522ba31650a1fc3fa506d1c97c45c54f8afddfc257a9dc3b8de0ab7c594be120d4d4faea00774e9baff979f7f4458a88af8b7de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
499b3ecec67e7c53468eb2b2612d4033

SHA1
83954f0d91cf1241fc1ebebd0cbc771d4312a298

SHA256
8f5ef2cdf7ad02dfc87f3d7aff24ce43cdc0566f90c978d60253c484d338e4a9

SHA512
bed7fb784500c8052b4bfab74879ae19f99a2f6ca2af0b8a719f6d971042e295408ec70ea94b70c4a42bd9818961ebcce057a1741bd8ec03a284d1d1a156def1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
312bc8838393ff78b4b88dd255714032

SHA1
efdba888bb90afeb2eebdbe5c4c1b2e1006333b2

SHA256
ccfb800d062eee8237ce813436780444fddf0a2cd76c6fd2a97e01554f8f5f28

SHA512
e03f4088a86cde8d2c7401f55b178318b0eddcfb6318ad5eb6a7082f9567ee96967b3d0542355a6d7ca282a8b7569e178963fb973b66532989a40aa2bc1ccd60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11bae8e10f19694a991d467e5b757a43

SHA1
5be0a35aa5cf38b6a4f6df27a392c9eb6894104b

SHA256
33a0c0dc08430a6b8b8923785111401aa4a4dbe0c9e26715e4818175b1d8ca55

SHA512
436cae02adcbdd151856513bc1235e59c456d276196f1e5bbe9491cdb5d02e2bfafabb085de3527aee71e61c10459d88d8e1d2837f1ec32fef22be79a67e16a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e07c9a51ad3462af80d990c94753a7e5

SHA1
fb26068c695e9d261e03d7bd61d612da58bb7976

SHA256
d8b1ffa282afd877923aacde253b0f3629907b6fd2821ca7049d97f44803a1ae

SHA512
5574b91c68a0ea9202ea6e3f542b33bfd9c212f8105919381ef9dde183665f886ad1c42cf4e557552f1a7ddd34ecedf989e898847f6d49ae611e37fdb3ec50e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bd270c8905889ef39ad5fe05ebdffa2

SHA1
99e52261f3fa0c892c31bad3bba4fce2cd6f94a4

SHA256
0d0f7e200bb5d07f8d429d1fc72a1eb368d14a14dc618850878da83bcabc4ebd

SHA512
8ae7aac40cf06150b606f114c2e2af7e64b7e2a5b6fc580cf372549158e8c48e675bfa24b151ec62e6394bf92ba79aa9e472b24e2ddb52fa6475d51a8e82d9d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
66e82cc966928c1cdd5aae0cb550c77e

SHA1
5c89b99e56e04833331947d78db2705bd739dd11

SHA256
7eb30503146e94bc8ba66afdcc683c88121fe886cad1e1a6b0ee63f0549b5b7f

SHA512
94ac52f43c3cf182c949b01aec05dc4837810116754a5cb1b680e647873f111dd04b9bb8ab4d8d33d3f43f37e1cde812c5dd842382424ade7bc6d537bb6fec84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit