8a3dff2b9a8beb8757dd3f3f3e0cee7f29743de23c74ad33a3fb727a32cdff1a

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079e68a2c5e0708a52ed41f6d16ac312_JaffaCakes118.html
Size

19KB
MD5

079e68a2c5e0708a52ed41f6d16ac312
SHA1

2ec52fb0d4f9ce40ef3577211ab975f7b7dd3956
SHA256

8a3dff2b9a8beb8757dd3f3f3e0cee7f29743de23c74ad33a3fb727a32cdff1a
SHA512

c5bf53f5254edbd42929211ca05ab9ff49de6311d62ed2bd22a4af1f593689fb1cd5b45ddba51ef1cd0b56c3d6c868827986dfaff7eb362b23fc6a4db9720b07
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIz41zUnjBhvR82qDB8:SIMd0I5nvHtsvvaxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D1D0261-0620-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420554076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3024	1712	iexplore.exe	28
PID 1712 wrote to memory of 3024	1712	iexplore.exe	28
PID 1712 wrote to memory of 3024	1712	iexplore.exe	28
PID 1712 wrote to memory of 3024	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\079e68a2c5e0708a52ed41f6d16ac312_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5494e8356522005badf163a439810fbc

SHA1
d9db37eae7728c5417179d39d0b8f4bb0974a118

SHA256
e96c728410756d5494df492dcfb9d92943a74c23297ade54b8ba5ea23b2e5fb7

SHA512
86fba57fd465019deeda3fb72d3b70cead131b20d8cb4bfc094f2b46bee14531c6150a0997fdeb132a5c0ef74e86982d32023b3bdc2721c942dc2de6aa491bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7cf974cd593c22a8d557e819d9f235

SHA1
1f3b95c6aee217d1f1805cf20c76cbc909f7699e

SHA256
6bdc008e59d90685ebd6ce0345a7af98e2e2e1b84b3853ef62c99ec36b224d5a

SHA512
58fe08730a134507049bbab1d61f4c419238d9b6759391338bbaf7da146476f355a3b93cad0c4ad46ea147585b1b7dbea917967e81d0d0456ab774767ee3dcd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14f3798d1bc1b4861aabac2e589eca95

SHA1
c42e974c15bd5b8e1c70a5fea4f69a0e7e45088d

SHA256
b4292a98bd1979bc415c52ac3f747746e08dc781375c99688ddf5411355d5b37

SHA512
eb08822e540d955051d88658fb10a2fe3afd14bf0da1856861cb0e137c7128c0adef08e509beaf89f796315ad1b95b96d80662661b7b57f1448c42f37198ba0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb073617769bc999d5d6e140bb69dd47

SHA1
5a5fe17692c20e8884db4c17a5dd06b0d1f834d7

SHA256
0608889e13f49c33f9f4943c370f87d6780fe1291b3beeeaa3b8e0363369e484

SHA512
3f44950916e184f21a5dcf2f9e1d8c6a067c3e1024e07fb9ad3c17e4a8d3225d2c20c3ad99a6ad44d2f3c26a75792da7595b08e5eefec3cddd56f0bbbc8bf4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b64d29f12e1e2971ca27d6205cf56e

SHA1
ee97ab06ba97ee08c511726e73800da7d92923c2

SHA256
0aa2341d3ad46fd02f43019f673b879fcb160de85803d422bda796c1048c8bae

SHA512
d9c37c081c2557b287e153aeb0e5aaf76aab0916a2df3f5d649158713af82732bf0b66a9e8c537238e4c7488c9cb38cf5e3fe2bad4c3c8accf3f4c9188fcbf9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01d596a0dcb582e0087458fe8ca72038

SHA1
a1488349b7eb14162d38794966e7f5bd7cd0cb75

SHA256
72fc00a9d77cdf8e4fa47c72099ba18692a6a1fd841638e867cbe17ab4413235

SHA512
7d94666e08f6562e4809df814476bebb62e526482213d58e2696ce912984878fdc39f08044cbe2b1aef2e5d79d1b2b13c255d7813e0ec07bbcf2126a8a0cd8e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3510526248938073950d08392a0920c5

SHA1
302769303f08dd197a40d0fb4c7aeee38df25bcc

SHA256
6b9b1c95a7cfb40e1c362bd56417280661fc53d80f390d4d1414ea15bde7c802

SHA512
47f6a68cf12d820b4b6fc3903f30615976ce1ea4ca5ddce0039b28ab363cf52e8a07f1dcf4b99b4a4eb37a05726324a8a185402e057ea719ab7133a7f105b67f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9adf23a83c88bd0f64cd563c36c44862

SHA1
aafd66e774d91afdaa4043e2cd0ac9656eb4b1ba

SHA256
2083e847368c1cbd116c1f0827c17c25286b2aa4a59868157939340bd385f708

SHA512
76bc585cbda38ff835257e63ceac03948d558dd79912c78bd401e18dc28035d78984971220dd8843697103fe26773b7a1aed7dcf29f911696b53f3c411551b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b703b683ef15abd631689c92ea385db

SHA1
61e5cb1ebc536d69c0a213c8b8de8844025793b4

SHA256
480a1642998807c890ea9beeb97ae1778ba7c638372a3b4deb2bfa5f10ad969d

SHA512
aaa3b4659e53afad787a08385adc54ce190a1e6d27abf5cee19bdd3e2f0eeb979a433c05ae144fa383cb60b22d9e80d3f37645f3b048ba60fc8c2204ec28187c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
542636f1fe70be751eff4107b15254ec

SHA1
9047da340047e115cc8fd5f80322fcbb67e918e0

SHA256
21a9b6cc53e1e664126c7929ced23317fa0569ab778e0fe6439a7ab14bccaa29

SHA512
271de47c0c001bf85f6edfd2945948b256e73e47245cff09d8fd7b0ad660c573bda51ae3d06c0ca3f4f1c0af0b13622605076fe92ddc437fff75662b291b8ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0721218ba7198f846ccad610de0b79

SHA1
d40bde3e1a5ec3fba17d0a3f197c96af3079e617

SHA256
a17c544e36672c4f04ffd0642a70bb103582414650cb197323dfd93d4ea13a6e

SHA512
41b1ff00874d9df6e42f7b4036b562d549486abe3444f13a80b3cc91aa5d6e8b8486f948e4378b6d610341b36cb84435b82d49c522032c279ca9d65154b0ca5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89E9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit