1a8e6c0eac97fb66ec5f9481eda6272a0fc7087e62ca42a8161fed3fc430cf5a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04005c01d1bd6635b37168ccea3e1f48_JaffaCakes118.html
Size

34KB
MD5

04005c01d1bd6635b37168ccea3e1f48
SHA1

09bcd5efe690ca152dc6c1268b81f475f311736a
SHA256

1a8e6c0eac97fb66ec5f9481eda6272a0fc7087e62ca42a8161fed3fc430cf5a
SHA512

a86b3f90a486d405507711e160b20e823da36633bb68c931b4079425080d54353dc896ba7a08f21e55537bb6e96e53be2bfbbf0353b62b3db7113a6f4d64c1bb
SSDEEP

768:3AW1DuQjI1OR76w9taEUKFmxUjldqivivkmkyJ:3AW1DuQjIA7JthmxUjldqivivkmkC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CEE8D91-04F8-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420426837"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 852	1724	iexplore.exe	28
PID 1724 wrote to memory of 852	1724	iexplore.exe	28
PID 1724 wrote to memory of 852	1724	iexplore.exe	28
PID 1724 wrote to memory of 852	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04005c01d1bd6635b37168ccea3e1f48_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
facf165e578a39ea8f0e2e4a7dce4280

SHA1
4d215d84fa06d778d229a5696ce7b5d2e8957cb5

SHA256
453cc4997eab7d6b29432db9c4f929ae172b8f3ab6feda2633251954f64b1102

SHA512
6ceda849402756b2e8cd3eca7d0be1f4c975114e9fbc210b4643d6f19e0733cf3e0fd7f6e5418819b04ac29ed429275ab65cf8fdb6d60739ab0804f78dd77241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0a995d1f938303c0526c040aebd93f4

SHA1
b0910c4674bac18e6388471fe736a88a156a6b92

SHA256
dfd426f310279a1ed41a7d26abbf2762ae307c9af76e32d61623d929d06bb3a9

SHA512
f5c018a40de5302d5317098637e742d6f6074f1221aa4c1e02c2ac5038cccf3e153d33bf78a70e0dc13c90d624ff77b273f4c7a092a913372b83de36aecb5446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd02cf3a0adafbde58b03b503444d1b4

SHA1
179bbd431af52d18ac4f48f53d512054e90115de

SHA256
4ce31ab34b553ccd04ea6f11f669355317bbf566a00def4ba2f3cbbac77aff72

SHA512
fa7eeb217f07ef907557da061bb0d41f555e7671933032a625def85f79ab2bc8b1ef11fa2ae6917670154a7672661cad4ddd09144f1baa0424e60cb6fb0087c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9a94622f9e1becb376e233ab76f72d0

SHA1
d258523128fca1dec470790b2c6381eb2eaf0809

SHA256
c7b0e526ca85cf82e764aac10e9b7a74e4ddef3c558444296d534c802bc96932

SHA512
80cff756107f373170f5454578762081e242d6609452fabd73eefba8a218b9aa3925e90d5d565530642039aa07be637aa3e7a1fe74f14bcff0a7380f93534ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d6e0bd356f39919f457d5b7fa828584

SHA1
38c08464843f31b0755976fce0f4d01704dda92a

SHA256
1b49af14e7f54386f09c86332d9b038165457e22164cf9ee0d69a38b7f62c103

SHA512
daa3b35b4b835adec38c056e8910d6f2f61bdc8c3a2fcfb40da0b74d0347af5a7bd4d390942f04ac8aa7e489a4294961baf31cec4ac35df795bc174f2820578d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dce4071bce0ddd62853d943458edc81

SHA1
b26074226cc4dc488a60b14efcc5070c1f80a7ee

SHA256
fe2c1ce981a7502db037b1c26532794669138e492bbecb051f493138cb318870

SHA512
21f7119227b19344c561261a0b6534d0cb7ff39818043159ec27599ddde16f0cfd13e641e0f204cb8999064af4a8317c919367ff2c89f19518812141f105bc74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040630c6163d9a199a9a78014bc933d2

SHA1
0f4eaa88bcdae0bceb97ccaa70119890eddedc58

SHA256
3f56709c80db0adeb4d3de9075b6da773c9c4eb80e51047b2d758881c8a39540

SHA512
2493c563b6157df3aec23fdbb9c581970cdcfd9b4b809ffbd4b9f08ead6538c23c5b3f0909025fd5d7712e1a3424eb14501dca8295833c0e2915fa825b1cafbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c2f77e5b6752d52ed6050efd9c3fd0

SHA1
165434a6e9278734d1449a5ae9c61579a09ddf7a

SHA256
672e2e4a52b479adcba112efb21ce3e561ca6ad051aac86d83023cf6c9aebe89

SHA512
af22cd0594efdab39dc08e59798355192a4b8011c5e765813999e0b72a517c15aa4fb9eec2566b2eacb8c3037fec636d5367160e6e475d732b21dcbd5db13891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
300443764a97a9a9ac1b9ec30d1fa11b

SHA1
2c1935533da0bd93e57561e6810cf892ebbc2b27

SHA256
7ae86f278fe5ec8f58781c49937881086ecfe009f7cdf99eae058296810acaea

SHA512
370fc2f3f8630153ce286c4ad5743601c62e21852f1f49edb568f4ef572a5ad751af7b30526a64f46d4d11cb7cbfcd22a26ed8cdf4a44d64560e0c4d058ae06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf270ee8fc1924cab0d7a0c8356fffa1

SHA1
d4ccf1c2359090f7bb6ac844fcc7f80a5344f206

SHA256
7b2b5b19301194cb376a98757b16d88d4c1099dadef66a6ac350968c21f2c079

SHA512
d3bbcaf4ad7db4027c7dd58efe93ed91776b5ebc981965d2a18234e50ee3b66decb96b25d1bebb0f9f52fd50d41bef47d47e47619067a9085cf00655a34c5750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bbfe0808356ad54c9b8af6ce76dc2001

SHA1
53e5e2c5bf084a6598c698ec287c806ef343ecef

SHA256
a8fabcd6d7965836d022ff0d410487ff21d54a5d786ff7b6a6bc0d7c410c696e

SHA512
9c8aa9b6ad6b57c270eff161a8f3997d98c7d31db07e6055540cc179bfbb18bbbdf8c52839287b47f9efb8d61efd4fc945b5d4575c9bb6a602aaba91970c2c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14D8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1627.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit