8b52aa858d901bf94e263e043512d936aad22fa1923ac69557b87b471d9c281c

Analysis

max time kernel
139s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b25b2db098b91c632fa309365c1d8181_JaffaCakes118.html
Size

79KB
MD5

b25b2db098b91c632fa309365c1d8181
SHA1

da4b9c06b32f5f3d852d7e134dd51b50cc0c7014
SHA256

8b52aa858d901bf94e263e043512d936aad22fa1923ac69557b87b471d9c281c
SHA512

ec42cacd3bde736552d38eb397508d34d45fec5ce1053ec12f8f9ddeec915223e0d82fa409af6bddef1deb19d15f400df3ae6cfe848e0c326728330c685fb794
SSDEEP

1536:aXAxMscJ6lwz16yrKs96iJnIXYqwfTF9qvYYZWpoWg1cr3Scal/DR:aMMsDiT/GWKWtr3ScaNDR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6097D901-2BB2-11EF-968C-FEBBC6272832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424684928"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2652	1752	iexplore.exe	28
PID 1752 wrote to memory of 2652	1752	iexplore.exe	28
PID 1752 wrote to memory of 2652	1752	iexplore.exe	28
PID 1752 wrote to memory of 2652	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b25b2db098b91c632fa309365c1d8181_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
500e2e3a15870bbc5586dfff616fb73f

SHA1
1a74aaca82e74deea68c6839260bf6684885b171

SHA256
047a881d84c7caeb992c9c993c251b16319953614e3fcf4ffa871c7373c380e0

SHA512
4f6dea908027154a06fa6bc73eb83784e8a21ae2e8c1faf0c73fe4a8cf1fee1dd231cc09ef5bc7043a05b882fc0ab25cb52674de69ba3ead5822e9ecf9b5fd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c92e0a7f37768d170f0553730f46f557

SHA1
eaa78318b35fb32c9982d4d69292e2e40c005781

SHA256
7afc3a88d5db637dc376b80ed1d44032d257b384f977fe339a26cb168c6e6da6

SHA512
3d4b9a6f6a55cd10fcb02d9fadc51b84747f773d13187cb5b4a4c865694fc3ff31d622808f1aeaa6f1a7d16a79f8873c053b09acdfe8108384a2bc41eac0e4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad29b624a0de64d80711a584580bfba6

SHA1
051c7fbd1af14a0da86fe71bc4720f2afb673cc6

SHA256
e889b45eaa4353de34b68302b6c999bce0874d2518823836c28df7658a9370fe

SHA512
b9754279a9a4e6b3c0680b1f895e7e2958c8908108c1e42cca9ffb0cd2d7838605b459da305b4e34059c48935070331d288eedf310cec2437588f72d63c390ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98972b8e7bf0b5c10570378e59fd25a0

SHA1
e22580fea19b9d7634e5b9eb7788dc000b6fa7e3

SHA256
005625b5d4a973f9729578724440b631d61011f44bb1c1c93c008fc69e8d8380

SHA512
5979dde388768688bdf88a3ba05abc428ccaf185dd9fd36effdf2d34060472e9451704948bc972ed36980f942c20a41c2abce6f579ce08efd533fc20e091b02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecb8b0f96e06ada9211cacfe0e0ffe35

SHA1
899a987f9149fa9e90e82a03cdfd0d6475638e97

SHA256
ab4e651d919a95bb4f30b7d8af05f3dd8c0d68b25d28256ae9f644251fa7862c

SHA512
b2b8c663af756c4e89f656bfc47090535781921ba0184afbf6f7eadcf7f2d9ed11b1e9b4c14b0e70de987d8433dc06a4ad2668fa095be9c4e3ab3f9f02934de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23da87bf41eb9fc0639803d4ddab4f1a

SHA1
f238487399fac00d0c5ad0a9f41aa4339789a7de

SHA256
306966c46f4a4eb44eca2f0ae0fa1123ed3458f142061834679423b1963b531e

SHA512
227788bda1d3dd9d04b81c7cb9b742758945964dee7dedec4b4b634a11e9d79cc92ecc65cbc89dae982d898fa26cc29ba5864044884f4237afa41b327596a351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0f6c22395f8f1c556f013d20da3e07e

SHA1
7031f90605411a4af7241a4a76eb2544dcce714f

SHA256
a145c8f6893a1874f63ccf5b221f5c8fd852c1ce0f86ab60037099fb885f4e9d

SHA512
7ed360501b8d0b1d83880d62ab54888f18e8f356e9338cc952a6961a2106d2dff602987834aec63b84f03873a424f66360209a2500e967750a88eb6679b34a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37ea09220c05d626e920cdd770694597

SHA1
8a15ffdcd24434bb1c4c803324d983e577a2e7ec

SHA256
61608c76a1ac6bde4940d84b166e672db42ed67616451b7781c26f59c3aa45d4

SHA512
bb7e3a848d4de01daba4402713903c869812bd99a15ae6aa9059cc2b9a8601bc5ddd06308c64b285f201648ad778f4ccd7b1dae5d433e11aa1cc3ff4bdc35949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84d5c3c63df69285cb8ab6449909405d

SHA1
8fd63cffb2617515ac775e086c3356fcc23dd610

SHA256
35bdcbb42c0f9a95b481863e1ca9f648700eae8b9eb791c8f31f85ed0553c435

SHA512
baa820041ead4e8f3b8ff7d6f96f818ea4c1cb3d86b548b3326d6d2f5ba39d256433d9cea9dd3c37ff7c688ffef589b2f673052ae5f011c8ed0cfaa4d1a6d55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31df03d168f12437a4505dba52d31cb7

SHA1
efa63002c3ca44c28b2e73cc348035029ba79b13

SHA256
1ee13084870b67033ea899994b5297136defa94d2239ee35ce86aa71bb4634f6

SHA512
6babef39f4643b441afe58612969c3ae48a6d3f8621f7d44865338f739f38b88d70f8011154156776c2344c7190e5026331c24d471b3da7ee0bb48b028d6f0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efb14349427bb1065e1dd6494122f316

SHA1
f937697785bc57f66ffbeead399339145a01ad99

SHA256
f3006396d0f2d2ef52262ac50f5249b8902b547575dd930908b0e4c9b7b67cfc

SHA512
62b1fc60f854550a70664195edbc2b7bc29e212a21c1dd288c7c489e1d4ccaa973bc27fff0191c223947106c8d2779daf6f2a47f5f45fe85f2e3b6f9430908b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\webfont[1].js

Filesize
16KB

MD5
b1214132e520a7e9bd89af99237c5f24

SHA1
45b3a11f70e46248a30471795ab43861e98b48e7

SHA256
36ef095d011c4ced97b0acef551ca36d76b95299518595dc1acab792a2344601

SHA512
a4a1b77cef6938660f94217ef56f5b72c07cd5176c95b78a3c65e52d8764fc957572cf546423f1df30b4403569fae7d7f83b0a4d006ef1c3a85c5680c36a0861

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D07.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit