e5d02fab806089d94fcd535654432118be06ed349cd0db0dabda8d569b6dcbd9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1aeca66efc7e61d948138e37dbc33c7_JaffaCakes118.html
Size

23KB
MD5

b1aeca66efc7e61d948138e37dbc33c7
SHA1

d7ca8ac5e734606e91f38b82bb187b34cdec2695
SHA256

e5d02fab806089d94fcd535654432118be06ed349cd0db0dabda8d569b6dcbd9
SHA512

d0ec4c4222cad4bc00c40c3660ba20d1b538aab15ddbc79a9e750607389cda00ac77d7d59b1f5b0581c799ebdb5459158635b14275e95acad08944337bef5c64
SSDEEP

192:uW/gb5n1+nQjxn5Q/cnQieXNninQOkEnt8KnQTbnZnQ1CnQtPwMB3qnYnQ7tnEYH:gQ/KZu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1506C521-2B97-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424673204"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2576	2208	iexplore.exe	28
PID 2208 wrote to memory of 2576	2208	iexplore.exe	28
PID 2208 wrote to memory of 2576	2208	iexplore.exe	28
PID 2208 wrote to memory of 2576	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1aeca66efc7e61d948138e37dbc33c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
180b22b8ac9e033de933b2a2c4f31988

SHA1
3a4a5d776bb7a13d2e067a5f17788dc117bcc54e

SHA256
fb33a9be4d06a18cc5e0e284b71d7cff0c6524424a1bfe0b7d00ca26ae8c2407

SHA512
263b6341bf1aaedcbb77c659e82a0145e457d6df8e1bb83c7dfe04aa5207ef700078ddf7d6bdf8887bddb881e8358a3ce7638e6a0bd2e43202e444ac462a3474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a606bed334518002f0e09a9f19b1ee94

SHA1
12243b398adab7a4de0498b1fac3f3e388b0dc23

SHA256
50d460e70f04f0865ac2057e37296cd63de44ea35826b363833fbc4e2b1cd129

SHA512
c6fca7e8045a32994080bc97a475148b34db6fc1aebe25fe874b99432d9c6887e48d79853fb637b76f6852a135a1cd8345cb9aaa845c11fc12672e985e7b8592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f2a508095e99fb897689bd7fdd49f57

SHA1
ee77fa76f886f927c9b7cda5d4d86179937bf559

SHA256
34f225e001de0718ab15a00ddebc0360103dddc2068cef19be1838484b8c058f

SHA512
0b38899070cc6bcb3dcb69a836dd85f20b3e0235d8d11dd4f33431cf9affb05c2c92437933694682698fda09d19e38c4ce1a18c64a2273e009e9b710b19606fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a756e5e956a29cfe9127de5620de2d1b

SHA1
18c4fbe35e75c4ca6f471c6ecaeedbf5803431c3

SHA256
813c84fd72131fd4f9f46832c54fb560c878431aee8d10684d04b2b9e4a60ec5

SHA512
b1aeb2dcb85c1fde9b6a4d61c1b252c12b6f478f9bf38b05f421726a371dda65603bbed2e2db38f15c8c03a3480e328b253a6c09231da16a0e6df5b88b406f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9afe62409596fd488c764d20344b499f

SHA1
5dc259a073676165dcf05bde48db0141753f8729

SHA256
0bee081776d4be77476e1d05a363a66bbd2624ea3eb4e47ea43b3e104a669d7c

SHA512
2bf96dd43563223d619cd7e8f292d7a83005949196a93153a1f14c711834c611da518d8787187b663e01c3fb32ba1f6abcf7e6eb262b422a4e9ef2d6e71f9e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8287b84c7c7460c1b34c792dc9414317

SHA1
5c8985955f2486b31092459d96b111d3c1c8c9c6

SHA256
1800d6bdf3609a39d06b52277da84674f7aed37c121984b00524f50e63c360da

SHA512
8dc223fe303b13cfcc32fce0d4fc844feb2a0b4b4b22c73ef1997dfc422e6fd485e0a11c47738d789f9f3ee7b393ef3a8214f030c7bcecc94248ea40aee8a75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ad9f6b23ee5db5749612381f28c2d79

SHA1
2bdb4ce26b7504e220b821d1c73bf706d98b1af2

SHA256
b58031d975a460b6ba0c446dd3e204786e7fea0171d962f3ab9676d7ac6ad9ac

SHA512
fd52127a01eed23c8e8fcaff2ef14ac33ebaca331e07f9d06a8e0c8eb7aa29ef3eab87723f71033d5f0a5c9b56be85cb18d3f6b6cda76154b5ae0bcc05e66f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618d214f674183cf9064c89ad2daf7c3

SHA1
3b06cda95be3227379e81f45fa9a4d91a3eb49e3

SHA256
ba4f38b402ca7664c93b5441c823b7c52463aaf13c2f41b6cccb4ef77638b333

SHA512
24a04e7fa57ebb7eb8ef710f26a587476041aae9414c1bc3fc575f46f64d294128ca28ab4b7b7554438fd481741aa6d4b1c221bf3dcea326b6346a12c4b705ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8d1a75e33dc2c50320e35fab982316c

SHA1
65d4e7c7c7b2fcc4b362eb5126dca9690172bf9d

SHA256
e626ab2314c76288c81458ae3b2bb3665111e46088b5453ccf551b23909f8d96

SHA512
53bfd9c8bab8970cd19f61b8e749c78fec0903cefd979a5bbe0e79fc8ab97502916b8cbddedffa2a858b62dd307335191692552a4aa49242639a8b286bd6b30b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DFD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit