7bb4673c408b80b331fc32cc34aaddda12cdab924207b5f7b31293ef209a839f

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

280155962effd51233b5343cfa334da9_JaffaCakes118.html
Size

18KB
MD5

280155962effd51233b5343cfa334da9
SHA1

047bc407723e0fdfbf398ce6ba2ac925af90b85a
SHA256

7bb4673c408b80b331fc32cc34aaddda12cdab924207b5f7b31293ef209a839f
SHA512

0d315ccde14c96481a24da2a687e9bd257ad1924448fff47030b988a2dcd594bb7bdefb5f4ced3fd353f6bfbf91562a72d4976a24c6da3b79336ad6f8cee37c7
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4uzUnjBh6s82qDB8:SIMd0I5nvHLsv6/xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57ACB6E1-0DB1-11EF-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421385948"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2144	2196	iexplore.exe	28
PID 2196 wrote to memory of 2144	2196	iexplore.exe	28
PID 2196 wrote to memory of 2144	2196	iexplore.exe	28
PID 2196 wrote to memory of 2144	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\280155962effd51233b5343cfa334da9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
991384378b71a525a07f55792afe1099

SHA1
a32f0ef19c9d0aca8c20a7ec9527b60897fd7c79

SHA256
3b0a50729c8352c7391776c481db263c39173f505eac31d929a4082a223f51ae

SHA512
1fcd8900b2ebfe96c3e238ee400a1042a9017a41027aea5f6dab84601c45704a08e4c7f65a7296c062a122c34bdcdeaf46f2879596a8939acacb6e40d1c77cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21b8043d64494ff9199744078b235ae

SHA1
15d6899c64764d24ef5cf9d874770461b271bc55

SHA256
ad8c7fa4ad309d436f8faa93e836337bf879766d6138ec7d444c59b4d80f3206

SHA512
7ddf57a2c8f93254f6346169503f998afc4186c31ab24b0c331ccd71d32847039976c53d8edfe1df7fcb0d0e50330c88057d3308901c3034afa16584b921d31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00dc6f40db390ae6c9e2710bf9c7d6dd

SHA1
baff5ef1319da4d3c1df268419680fb378e5696b

SHA256
ed97105b0f1616a6d233df77f8189e2235b4baae2d6d178cbd15649ea5c70b8d

SHA512
e1bf145a5ba16836e747f9245062178bc631ae7c32634e9a41e8731b8c3c345e91c97b2149a0fabcc0a4080df4607bc021e565eee1b34a0607f9d6d913229ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9040b30e5982a728724794528c79cb14

SHA1
86e760854cc0445b9e36432fa8c157e19c5f6933

SHA256
a4ac1ed3a62a832e63a12b064cdc8b451cfa69367727fa1829f97148d5419230

SHA512
5759b1aad2d0da82ef927cc85c31411c7ca6cc9fc46569b95307e6f22da9286da99f6d034656b7fe69b6fc16eeae1768ad911ee7909b88b07ae125f97bf3bf7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba76a4a1bb184dfbae21cedcd05cec93

SHA1
99ba42bce8f354ffec8971aeb9018930b46c5231

SHA256
e5e6881d95560eacf60298c1014675617eac6760ef59c07eb7e9309b2e5afd86

SHA512
2bcac8982801d0a7c98e25e6f61608b27d5880c5d56f2d298a078f43ba6e0a47eb73a0b6e18d34e56afb0aca86fca5c1bbc67b3ca0009eca50706e18166a6cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00478f6e517e2101827c38d49c29dd68

SHA1
c84f62bb34ca9fb19ddcf1faf6782859be4c9be5

SHA256
a8e9d614e81c273540f2becea118422da8c1b336625cc7f203649c59233e3937

SHA512
843ce0ebe0bab49c11a95ee09aa9b827a9b5235364d09c0ea208d12c4928b43e81911fa722094644ef25cee4adc8f5d9f41a68b5ec7456561f028da9d02ed5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86da13492fbb671b1e6523c0d83e717

SHA1
1b6cfd056a2b6787b93fdc4f791bfb5eaf5c5862

SHA256
a0ee3c17807dcafbe77864a378bc5cb3842dde531d58aaca5dfbcaf198ae9b0e

SHA512
a56e1f397001b7dd6937081037fe95e2ffb072bae5cc64a962d4450562c728e62bc76eea9e733294430f091319b38c588ce9f3d603378a12e5293718d3894c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e4ed91f1bf43cf429dd0041c8bc1f46

SHA1
55f2279ed576a0b83644df0328f34d45c528a043

SHA256
396b770237e463e8f0705ebfd6f4653323941d13593a6b2e537774a8286fa8e6

SHA512
119fc38d3670341f6a99968e7c1531c87da300c86983d84d404a3638dd563038c3db7794ce0b0ba7fdc914bf378e412c30de8d421b6b3dade16763450096f5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9d6c6127dc2c36f77bac1eb2b08b088

SHA1
78d5ae8a3a839dd0f543cfbb0dfa39f024351158

SHA256
f7cfe6272574e4c7b3f3ebe2602cdf2ddfd18330ab2246049b418719fa0fa01e

SHA512
808578b9985e12783c4e135d6d7c604c4d4a2aabd402ee67780f5f36af8fafebebb13a86ea9251e2716f3cfebf306f14942392766e3487fe2294e6758ee02c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7447e431e3fae5c337a6a54bc4660cb6

SHA1
b048c9ad56f4c470be9327acd7363506448db796

SHA256
c69b16eddd73604f90df25626c4da4b50370ea8f76c0773728c1cdb3d6cb81b3

SHA512
b645f5443568c9eee0063205d05071147c89bb4ba7843b14470af13f12847df47af808783065962b7e78afffb4b793f0a84ddb8448b58f7c6f7ae1a774cdf39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a999e9df415442b603f4205320575e43

SHA1
c08d6068f896eb7eb82497729295c0f0880977b7

SHA256
324eecb3059176d0ced4c0c04a13e78ccb2d4cf858db5cc55cce7f6a8c6d972b

SHA512
f734b48ba7395c9657b9b42927b13f13a9c11c8dede01947ab31a75b9ccb50e77e1f08e1fcec1a6bd14d8367ddd00cb1e0ad9edc8d3c8d7ddcbf1bc89c5a5b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE53.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF90.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit