34bdf3ae32a2d9a8b848eba77742a4764a8b12147b26891b86ef7d052706bbbe

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07dd164eb404e3fe7fed045ad0a52599_JaffaCakes118.html
Size

253KB
MD5

07dd164eb404e3fe7fed045ad0a52599
SHA1

f15e541bff50154992483df39e980c97da0c372c
SHA256

34bdf3ae32a2d9a8b848eba77742a4764a8b12147b26891b86ef7d052706bbbe
SHA512

403330a5923f6874624b2a1f2702b5fe03a224baa1ce4dd1cafdda56bc92e6045ce317dee46f9023f99aab306adbf8021b911b35ce58f28ce0eed7fd9b9d38bd
SSDEEP

3072:BhTyfkMY+BES09JXAnyrZalI+YHIyfkMY+BES09JXAnyrZalI+YQ:32sMYod+X3oI+YHFsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAF21FA1-0633-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420562313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07dd164eb404e3fe7fed045ad0a52599_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119872f36f4bb78b22e8281c53f4b35f

SHA1
db23d51f6647ec1740f0780702851ffbae978f97

SHA256
73d463ce0a2c1e89f736a2a94fbcaa73f5a3365452787cc15b3bfe42c99d7a56

SHA512
9558e1cfc7dfd42e9b35809735e4e806b78dd27da604b18bc0b5435626660089c4643a791789beda640e5f1ff36e1cd0c54aaefb357200f80052692333e904d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e2d7e4a40af157dc0fae3673a910752

SHA1
5abdb70ddf961f1689b1ecd58ae557ee17b65627

SHA256
dc0221dbfee9e3c2a04b18240f84ce8ca5684e33d7a02365d32d2da7bc6204ba

SHA512
353aedb51232487edfa42bba7a0ba0e9dab40909772f8181bb27c2557c23f4f2a7a76682b5c2544e015379a90c6c7f8544b6a1bdcdfc03f377752c6526164a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79d0de6ceeafbe12465f62796b8f50d8

SHA1
a629afc03e00a3229d06bd9c883d918b32dfc8b3

SHA256
8b71905ec1eef492ec34ce652481db08efe225fbeba35464cfe71e40309b9abb

SHA512
b7865cd46b1ee6ec37f252c394ec653059cc49af48891d0e59bbb4b4275a302800d7d761389edba9e6ad8f8089eeefa8ba93b5c9cc428353ea2de8f4d4973a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0b83db95d6c44a4c5c2d7305b86abb

SHA1
b6d7f4c993d2152c14231f6c6cb9d5a033cff693

SHA256
93bbe1cbcb6547e1e22c42cfd8a0295d3d19eb4be145d021f46a381dde8586b2

SHA512
7655aa80946d47b139cace52c3bc894773de7c2fd1ad2f90bd58a817bc1aaae707a01c157edc978d0c88eb14b6f2a34ee3f2a45f82b72893b41d87255a342ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c77b5d9dc45d4009eb4a7b3808f357f

SHA1
7ce7daeedd69bbef5f66db4a1f68c623d65fff17

SHA256
6a53e85de44f28ee850ae7b92c66920d45800c575dce5f4c5f2881318ef03047

SHA512
4f0b42bd7f4d8ed07120e25f4db69c9e3ef32c8aa00cc770acd8b951ee4eeb8c0888c767e896a2978996800c2d37de93e6d7e651cc3d95a91bda21b8caa57876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0d633b7faaa82d151fe9b3445f511b

SHA1
07e6c6eb5c5d2cfce616599b4a46cd9e944121f9

SHA256
6c7aef3cba43f0ced90e1b9d2c4c2de74edb1a2db64257f44cade91e36ababb6

SHA512
e4538e6434e326f437b3713e6701e3c3d8c5d66a04a13d75b6d914722aadfce13e410aeaf93916025f7325a130b59b3f5091da7c7425ba3794b82aff0dca1ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7d113ca7f1249ab08b01d4f2239135

SHA1
42023b1315cea3a7dc9a37b11632cdb5ee48339c

SHA256
5796b8a39b9b37a7d82ac4ddd91838229cef8074f03e7dce9c48e9510804a1a6

SHA512
f938c83b2aab91c06a9c5dc292dc3f5bc50bc623e145cc396ea6116dfd6ef0d67a0cb1d1decfbcc60af689c68d00abcf9c4643b953deec42408dcae281889d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe54278ccf04f7a5d111b195e37b423

SHA1
303755757cd469074f8ac43c08525be10101134a

SHA256
08ccfff58bac7392fffc26eed3d95c1415b0fe51fea64da3b053533c5f773506

SHA512
2eb8127a9dfd9431788661b363a567e5df141c8bac53891728c48cbe6cbe2a2e2dbb2a73e0ab1615fe91e49e39d32fd74d7ece6a2245a6f6b0d725f8f1477dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1fa8f1bd44282f7af2d5459f7282b87

SHA1
470cffb6d4619e49e053c8c8c145d3aa40ff962a

SHA256
c0b1036ce5397bc0795d27faee685d7d3f195381b3aefec9aef2140fbad11927

SHA512
6026c5f6f39c6ce86842e931590256c2d6729c40889d4dd86fb7af522971734c14217e53742af2341918fdab432737c6d5de3b2c9f98453874dd115bddafd231

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D74.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit