27d97db31ab2cad019791a6e288868649e1cbfa0fb318f839ef98e88d5f7cb70

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03bef7cb17f76a0fdc9a127573eb5422_JaffaCakes118.html
Size

141KB
MD5

03bef7cb17f76a0fdc9a127573eb5422
SHA1

f5a97156cfd37174f7f64c8fbf63ac155a5299ad
SHA256

27d97db31ab2cad019791a6e288868649e1cbfa0fb318f839ef98e88d5f7cb70
SHA512

405705486dd8e4a2dd957d7606b8a70d9d2688badd0169e6b3d813cab8a9389fd6b3cebbabe67fc7dfe8d907686847c426539d6016768f4c6e85d19344f941ba
SSDEEP

3072:SugHbSLx7dyfkMY+BES09JXAnyrZalI+YQ:Sxbax7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4C23121-04E3-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420417993"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1500 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1500 iexplore.exe
1500 iexplore.exe
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE

pid	process
1500	iexplore.exe

pid	process
1500	iexplore.exe
1500	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1500 wrote to memory of 2900	1500	iexplore.exe	IEXPLORE.EXE
PID 1500 wrote to memory of 2900	1500	iexplore.exe	IEXPLORE.EXE
PID 1500 wrote to memory of 2900	1500	iexplore.exe	IEXPLORE.EXE
PID 1500 wrote to memory of 2900	1500	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03bef7cb17f76a0fdc9a127573eb5422_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
28ba9978d62ec0020db609e6730bda3c

SHA1
57aec20e85b7f28e1971097d91155d16e0ca3418

SHA256
9a809c83ad0a72ad0784d787f23c93bb0f000a70f9d222b93aa9b28cebbad71a

SHA512
788576d59c1911b29ddd6cedbcadb38eb07e50a2f440f992beef0d3f6945839c3569cd40f66fae50c79adeb8e254404696dc4dec8b062e1f523e8e0ce31fa4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
49a18cb6602ccd4300af846c01061bd7

SHA1
7218abff0ebc39a0d83e68ca81a35f65bc72fe22

SHA256
fc5435f46ee99401c0ba78ad4fbf8b7f5fa9bad3ed69347132282efded4f417f

SHA512
dfef2f1e52aea27a4ac2054f280a4d00c8f1dccd454c08a275f700072b6807399f8fc9ac8cadbd4403d402e2bdf474e5f30635efa88a87c58b1b4867efb434f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dc246e54edd3acb4614341903eeee6c5

SHA1
4e4a2b1be0edeb67e02194948048d23699befd59

SHA256
41a9ea2634fc86a8701e076c922eac3e097ad76f7f16868f38f747ba8537214b

SHA512
0f31b46f232af9deccec27c97a9428dcc86c101ab55ef9a11701de290b7129a585e585b55e44daff3d148af00dd84314b68ee3a19b06dbba0222c1a3388b9b58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4fb0475a0b162d83f6912fee69748c3e

SHA1
f6ceb997cebf1a773c80b664d875b19d42114cd4

SHA256
7ba168bff1cc38a6bab5e740535f75c28773e7fa3cbf8e8fc8c2e58fb4ee6a56

SHA512
7af12152838f31e185c169c46d30d6acb5da7edbdbe379ac02c10637e12e687e839e8eff5a087bc3ee0fc64132cc4497d7db71a923712e0e8171cc96a3002cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3fc0bd9a1b0deae241f10e4161c20b14

SHA1
19c6fc774092bdf99a62669d1f3b180a2ab5de8f

SHA256
39f7e626d594b989e1403486f8cf84d0b43c593053b41519b392d73907845ae5

SHA512
2b83ddb5ed3afd25c388b1e93bd9d8e5626033ba50cb82b3fbf0846fcc347aa984b8d8c6ea180707a960aec8fcf8e21f42caef3a92ab7f737aae729679d646ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
25c2f9f69c73f5ee2e38b76650c7cf06

SHA1
3e0f72620e8b7bd4c97ffea07b314c0f30bbf02d

SHA256
3dc6a766f642ae4d291da13cb7ffecc143317d06202309316083336aec5dafa7

SHA512
54a8d72b55339134aafe820bbfbbcc60b07f394a07e497d93b57a7ba76d1986ba86cfc9f3e7353d6e90bac6bc69dc9bb411d0cfe28b4c05eeaa93fe61c0321b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c2748f331c043348e07f11aa649325db

SHA1
46f21e5ae7d935b8d10f079088f1dcfdf7706a7b

SHA256
5e7298d7991225e71f7e00631322e49aa28a952493e9fc46fc08451113ae89f1

SHA512
3d796d8f9e535a9223fc95c0c82af5c56152705cbb32c34ec648d3f7aefaf62aa945902fb45f346a76dd77a790366758fa13f6cc95f98bb7bd3e303a60b276a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
42dbb8882b5cbb9fad4708731519f3cd

SHA1
04d62e7409632ba7f9d12a9b7e387a6ecfb1492a

SHA256
44e5fed070dd580ebea55332d752ce1a7ecb60457a7cab16d605ff61bf68a07d

SHA512
caddae1d8d3c595f9bc6358d5b281ac74913512a00458ff19f29ac331d247f4612cac173186564b292f51c7d7833490c657a589fc9f86097331e8a06eed35cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
257a5c02dda617fa90318a8cabfdffe6

SHA1
024474b8081b07883db7f2f25b494fee4cc7bc0b

SHA256
5cc941ed1b6c4ff9698f0811080e4557561eb969f300e6cda123de5de6f498c1

SHA512
e738c9608121744a6a416b52cb218c9a0ba0dcb02ee7cf03e140e96f22e216575b5340410740763061a5cba7a390bcb809f41f2b783bca523ba4bb88b35be1fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac7e08d3452fc806c5f524fa49ad2963

SHA1
9f47cf2dd464f95675acc3f8411160125a3aedef

SHA256
07ece416bcfb409008d1dd7855c173b15823c5a5d9d88c357a3a99deee69f41d

SHA512
afbb29793f3dce14acd7dac95c57b631f82fbe6b7f73539290afc3d3c4a6a3d2c21cc113dc825ebdea79f1e14499ae8d17376de31c1afd512b0ec5e18f828b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
78c93e351f260809ae48eecff41039a2

SHA1
5489a4e674d3692a5ac99d85ae58513cdb4d636a

SHA256
6b3b55fe752830082af1a400a3ce2ab3074d6cb616181be488a077c79433dce0

SHA512
4016f7750f77e835715679acb40341b623525cd043d7e701d0d7d7c5592181b041b902f22cc1c9d490aa79b6482615d10d53a4431c19838884090da3f0b450bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5411becacbe9ee248a9f6e898a98892f

SHA1
645195947e6c6a8b22910c9ffb5e02a114c77762

SHA256
54fbad80db72f793e7cbf39015064fbd8922108d0d6a04f3e7a4af8862fa2a97

SHA512
8c0193dadca593010d1149e313ebeb3e8be9c9e384f36e8571aac661ee4a73005288714d3016f83747c9a47af37ed2e457eaea29d6a72c0451fc631221b6c8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3847fa520605efecf5bdcdd350b952b8

SHA1
818f3abedb226e65573f761509641fa073f8a02e

SHA256
49f0d8c78fafb3420fef720ef879fd9d161e877f977db5b6ca3aa38a0668a5e1

SHA512
5a9bb7d50cc54304b68d6eb4d0a12a7f4df819a207190223f350b8eba9bb1b687227083a0782ffa5046cac2e024a220480121f3bfd73244f82bd7a4f7125d61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8517.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar862A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit