0177c1d5debc3efb7b1a3222e2064af5696eb6c6ee62ee156d3d1bee0f7b8072

Analysis

max time kernel
113s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html
Size

214KB
MD5

27b3eafc235fc35a269a2ae96fcdcddb
SHA1

80c02ba6662a38c2173fa19712fa0e1863f35880
SHA256

0177c1d5debc3efb7b1a3222e2064af5696eb6c6ee62ee156d3d1bee0f7b8072
SHA512

32d9831367b38fbf1662db45630cb439480fc662b2978e956551ec9f9a10bc0426ffd2ff9b40cab22629855525dbd232976b8c66308baa448638081ff88bb912
SSDEEP

3072:8rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ3:kz9VxLY7iAVLTBQJl3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421380972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE662991-0DA5-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2584	1368	iexplore.exe	28
PID 1368 wrote to memory of 2584	1368	iexplore.exe	28
PID 1368 wrote to memory of 2584	1368	iexplore.exe	28
PID 1368 wrote to memory of 2584	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27b3eafc235fc35a269a2ae96fcdcddb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
852304c71b1ddf1de1d0ba62864d3275

SHA1
bc5461951e59c60ba7a4cb7b6b84c9816dc6f75a

SHA256
e30584dd2b9ed9878b29b603771462efa6128658aed1d1dd6b9bbce0769bec0c

SHA512
4c02f9fea77ad38733e434f6e8f99bc08519b91fc31269c80d05b7886389fbceebc87e81071478680b55bbf209de40c9ee647644a233757e185ae6cdfa217f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04d46a2b027c1e067cccef13254191d

SHA1
cf26f744892f2e551b17de4842133c7d59b0dd67

SHA256
3f2ed900a0acde5ddb682f00843b0a6c9ce5dfa9f56b5ba73d85e36704f165a7

SHA512
7ba21bd544b844d96a82ee645933940571cc70408b483ed210f14b5b5bec8e1ceab2df147a0ea1704c73ce5765bbf3707fb105d82a5b72d86af9651be815e9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcfe5fc3554f3217cbe205b7a72dd6ea

SHA1
83e81f44168345ed6cbe0822e3e847ac8adf3382

SHA256
ff8d5e32e85eddef222374ff970f4c3c39fa81a1e02b70496d81eb9aa2a780e1

SHA512
6d4d23fd8c7010b46ee149efc5889d932fc50c8fa45a619cf7fe30594ef4f4aa2bc91201e710fd4285848143f231297df12cf977f9bc17f8ed874fbfc7aaa8b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae87a8c52202b3cbeb5190d1a471661

SHA1
25586ee71490ef2d7639278164669840500740e5

SHA256
42fac59a25afcef0435fdd55b0d383b51dad8dc11c69bdee299a6d0d1140b0f7

SHA512
141333a6147d4f450a417c9fde69676cd5434181f13d4bde9742796c18f1c9e8a45b3856ec351c6c015d4c078cdd4eb45fbd128d554d0bbc69616ec07e988e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2183a4ea98a72b822e74167717afacd9

SHA1
05002c6751e9b40e017c5c6165103beda1b72d34

SHA256
59caa9105673f040c871af133528dcde404edb2e1dbbf3658b6fefac15b6d2fe

SHA512
bf0581e36317bd1809430e0914b5ef02c51f9ee6b4a90586631198319cea10c5d38842a71821ec19512a0d1756b0cc489d0de3b6380d714f3dec4a451072c837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2030b170d49ac3124daf9375ce441b96

SHA1
5dc4a4cf29aed631b0a7b357f3b5c48e9f743d6c

SHA256
c64f248da984182955a357c6972a938d6b875d7b4477922bfaa80a667d341408

SHA512
227f9efa2763b802fcbcb847fefe1908d04407afe62863db2dc96d75dd8e7e00181559ac8653cc15f5bc2e7e2b8b89416da8d14149f8fa2c06cdb94901452a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f56076396a6a761438b98dd868585c22

SHA1
345d011bd06a2b93cd91bcd88adec9c847fac407

SHA256
a99f07544742c9a455775ed9d3ee94958d4ffb2f579983349221a162663b2b23

SHA512
5968b220c045bbaf860e6f498d19392076d6b2494475c102396211d5e6685cbb7806b508f8e12d9c308cfa2fb472f375622edb34ae8c33ed509f1052f20b66e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
358675c89776dfccd9171a7f96674137

SHA1
88862f63117a20dbf9ffb81bfd84b7e2495ea783

SHA256
a0c02ab677274d0d792c8c002fc4c183d8816a4c2304ce47f12af29bfa8feb89

SHA512
92e1eec428403ae4ac654e127054146c462e31911ba0f1eed2b6c286dffa7141df60a651ea9c278b5660ee21fa1f54193c114f6c23440c39777c89eddc3a92da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc400de3d8a124ce4447ff23aa5dc501

SHA1
8e6c786bd3e787064c779fc9562046f6d74d2fb5

SHA256
5a2f8a9e93460318f517493a70b392c5b39374f8ecb46c775982f31a901d69d8

SHA512
87c7f5ae91d637bf9d89eeccfb1d9884ee895001b489a1a32045f4604bdedae822931d599727c86f36b78c62a3cbdc859297615f6b1fd4befc8d11d6247eae0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc77fc8d97a3f09570d3ff9ad3d3475

SHA1
028ede1c15e82f6d5fceeeb0a85c89e49445b3b5

SHA256
82b57a3ea830b3edb2eb4715bbb84932d8421602c2b473edf2051dc75145e956

SHA512
68cac6ce0903bd5b078d0f3bf50a3baf91dc4c786eaa11a4e23fa2f8294944267e145e3f2fe3026bc809807a48e299517510931ac9de844df799af8623685b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7787f93b3239b881e7be99069a57ee9f

SHA1
3a762678943da17eb6890170e35d91f2c1d799ce

SHA256
0825b0724a25a4027616099b89c55763a692d5cd77bc81b5c08aa37062b09b1c

SHA512
de9923bf9f07b07ab417ad8882134f93087ac3a5d336adbf5e32be51a8dd9ed7e6def25a0b725a4b89c3474bae54ae476928a9b8453a34a9aad6644bd403cdeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dfd0c5080acac42ae04cb293e497cad

SHA1
c7530fbc5d121b675457b75748d2770bf423849a

SHA256
3a243c2eb4d729fb2506cc89c6d52b8f5bd8b5c6f37a536967f68116510dc376

SHA512
eaad083738d3df9ebe9373d1c487c26b7132b5674d983a098b669e478fadf50098cdb9b83ba61d33f9b72ef73721c9fa8f19c3b066a14b4e9d916828570bd2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a94ee7a3603e9873338d2efb74a8598

SHA1
9d9c7ddc4bfb663370b48de84c4cb992cc164167

SHA256
a0eb162361d6b7eacc5a79f135b52bef90aa283ee3a60de5c276bddfead56069

SHA512
b6637c922e248161f6e7a469eea709eda546c53f6c1504e33c3452518b1eaa62a8342e5f5fab102b5757236f94ddc7dbdfa0a8a71afd409dc79b4e6a72fe2641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab892E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FEA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit