d7905ddecef94ea22987435ac85b6034ed8191f727269beefe8f4c09344c9b87

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

158f03f8f4a95e90d56dd74c830ff5e7_JaffaCakes118.html
Size

12KB
MD5

158f03f8f4a95e90d56dd74c830ff5e7
SHA1

9f1b1e29852d184f436b30edcd7331f90ec98a07
SHA256

d7905ddecef94ea22987435ac85b6034ed8191f727269beefe8f4c09344c9b87
SHA512

531babc008c09597b542c933153d15f1a1cca30b072d129c727f7c6de9d3c514bf075e43a02408ed8a6c2a5941b78a22f811a838a816ea641082d4e25b5bdf6e
SSDEEP

192:2VvlIsr0KXyJ+VCPN5Dg8k/w1wvqLkZvBwZwnMZn0v01/6uBuLbdU8d:svlIchVijDg/guvBwZwnMZn0v0/6guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3CC4921-346A-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425643814"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2852	1632	iexplore.exe	28
PID 1632 wrote to memory of 2852	1632	iexplore.exe	28
PID 1632 wrote to memory of 2852	1632	iexplore.exe	28
PID 1632 wrote to memory of 2852	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\158f03f8f4a95e90d56dd74c830ff5e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e447ba858459ba900a93c289c3cca91d

SHA1
668dab64f135559a9732e41986ab9f2a6c189511

SHA256
6e3952b46b10d2a64b696cd41ce70e04540609d13a6cf13a3ae49658316e850f

SHA512
cf13da0b8d88f38402b36f8f93bd16447442709d4dc4bceffa6735750136871270c07e845a629585f2c8c16acaea52bd382f341a118a297003bc6fcf5360eac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fd1c3db9bfef452c68822c92eb5e42

SHA1
c7e424b99325718517a9acf2a868f3a62779b4ca

SHA256
d117c4fe6cf730eeec9ae5f3dd187ddb7e2952d8e80a65175b0d2f93267ff9eb

SHA512
92b823812310abe924e61673dc10f6072c3cafdab48fb55f8b3974c672a533687225a98c1bebe8baf208867058a54fd85523a4eaa6bf0467df371e275e0fb7e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263d2d894328d509516079faf95e3ebc

SHA1
8c37cb7645f7fa322c776322f300796fc625dc99

SHA256
80936a0635e6a1fed583637955add467e2c40ca9b93c137f74a0aa045c44c95f

SHA512
5fd035cb9848c9b87e9747923afa9cf1c9355eece3284b043adca73a6ad9f5ba9e74bc4ca33923ab6ad6501224c25eecc63aee99d34a39dd96821d13fd1c0657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c59046464a2c4b0571823e2aba9d110

SHA1
d6ac5185b730fa8ff734290ac22002c920ffae56

SHA256
1b410d2093427c56c604208471c6b5e1ccf67b2c8e0cdf13f774b3c7382e263d

SHA512
cb354a14d808535dd28ae1d99f5875cd1e0b6b3cd146573dd32cc3a60e7ed9af4935d7020d49ecf263f21307d83c8d39e8591c5709bfa2a7677553aa13542bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e9c154cacf36085ead267a56a1d014a

SHA1
1a99da1996389ea18f88e7e4f4e8fe2ac2d19e38

SHA256
ee24668ec4fd4c60517b889a94f813700f9c64a44739a1cb93ab979112c52eef

SHA512
f8697dfb2ce1107670d074935fdbd66d18b336af28a794f1263559aef77d3b12e448a6e556b5f0c3e1037a6c7a97be85dd5110a32e948006f178deed657c7fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf5f2ae68b38b9c688ba806679291dc

SHA1
916c878ca248208d96aba9b23c793c015f559922

SHA256
026e89ca4991b760a57f635f3a1273d05739c178839d0583c0506e0a1fa4c3ae

SHA512
79149780314df381c2ec6ada326cc3708ecc4a2d6dae17aa4cfd84b29a0d324e1bf654cc47c1e06e83ddc9f17f2edf1e1ef01d9f952d3c730f69055db01d7c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b03a9be85070f8a63190818693f7ab9d

SHA1
a874131527f0ef5dfc61782ffa257934c205480e

SHA256
55c30f3eec627fda7c806c87862b9aee50361d2b0e6a7efc31f9725880afa051

SHA512
b3496e766765fafbbb4e73641a1b0b9943529954fb1072ab567e27ad9c3201c33d2eb2ff389caf54f1776e34fc5719465eceb9e9297782393211431d6d06cc99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c718d475235e7e46e392f86ab0beb5e2

SHA1
e32e815eabd2b01e40ad34bee35717f0d08aaa54

SHA256
8843abf37ef79be9e1c41fc7c39fe9b7217bd4f6b688dcae089b174916a0ec91

SHA512
a44a4aa08358856d2bb78f935081b55e0d7a32c065325e36b7f4b44d9c23a2b0c4a5eeed7d0ed694f6fce27ed614ed3130922a876f428242324a0bee37c036eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar215B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit