7f7f0933a8b6a86ba3b3cfef23c67b111a437726a5ec6eb9327cbe003475c28b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b7869b73d00e01caf424753a86d8b68_JaffaCakes118.html
Size

151KB
MD5

3b7869b73d00e01caf424753a86d8b68
SHA1

099992628255f6b1afca93ecbda6baef395f88c7
SHA256

7f7f0933a8b6a86ba3b3cfef23c67b111a437726a5ec6eb9327cbe003475c28b
SHA512

e47d7fd3def5dd53a8b63b64e5f1016bf9a7d4cb223112c484c8585553c0e474c358268b400356a87d5b0c79625bca3b1ba4c624423e05c7994cb270bfcc0266
SSDEEP

3072:tPAjGEq+19yfkMY+BES09JXAnyrZalI+YQ:qjvqIIsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9ECA1D1-108C-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421700048"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2808	1984	iexplore.exe	28
PID 1984 wrote to memory of 2808	1984	iexplore.exe	28
PID 1984 wrote to memory of 2808	1984	iexplore.exe	28
PID 1984 wrote to memory of 2808	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b7869b73d00e01caf424753a86d8b68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe745cf3300f2f883e1b9f021daa1c6

SHA1
139cbe0112600a07ea67df7aa8136bbc281a362e

SHA256
5b32ac3cbf998bc11e048c6740ba0f51532428ace0746cd86e746905c93a2a2b

SHA512
e8196f04cdd67d13803152ec0abfca65697c88ffa1109bf48d78aa5e74b9452f73250b703b74c84f1d0e1bb3b9e71c42d0be2c30e179124017fdaf8afbf56c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6827087fef5d98734a8981f930c06649

SHA1
64174e027ba8eebbc9248a7d119914106320518d

SHA256
740b6bd6a3961b695824f980e0dac05679a0a88734c87f136bd09eb4cfbcf18b

SHA512
ff0a8ed118a1e71a79104ceeb7f07d2550578333041a9660ffaabfed1cf9fcd7220ac1180d17965f7417803fc0ab683e715011b6b46bd8be501a53a2a2ccde89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65fd6d53e84d35c4f399eb626821e11a

SHA1
825586ad578e0397162cce37eaced5310dcd9341

SHA256
4da9a1324cf16a70614368a4306ecfdd8ec753012162791890407ca16d570c3f

SHA512
9d07ace000bc96d284b1aeb8b6a78a33ebc17d8d083d529666fad796439454da144b08f0ef0c239a0e12c6e78634ca2e56aa4d653cf481c416ae05efb50c5ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc051de3efdad84622b1b4e2d95d5a6

SHA1
21fbff12c41c7cad63d1ff54789d5d1d02b5aeb3

SHA256
8c067fe4253b112271249e6cf65f2a777104738e717c66abcb80dd33eae33896

SHA512
77afd97e6a519369100a839994bebfca5989ad5e44592252e927180b922ce7129b0efe97e4f88fc69a9da6c0b9d7a19abdd5b5eafd1580d4774c3bfe4ca00a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9745593df2fbbbfc3992816456d6a0b

SHA1
4e000971b138ac151653ca919d7fd5ae745b1814

SHA256
2ddb530e8eadc1bc19148b241a53b3d6ab830ecbd4e2ac9ac551916626080a25

SHA512
1d6fd792adf3439e3e6affc89072a3f74111bd7806ba710732c866cdf07092fff98a17ab58e131cf47423dc297058ce5fd2a1ef6cbdf9de24b7f9416e00265f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a6f34b5affe069f7ad5b5d63fbeabd4

SHA1
51269af2324999549b530d5438ff8df0f65d5e7d

SHA256
f1613a0b6a9e2446effdd732baed71989850afd1ddf9baba7d50c75ef7cf6e65

SHA512
e9f402680c1982b1c887d48ee7a3922c21e4a21bf81623452f5505f732355c0ecebaa83639668727630a6e476156fa051344ef20b15460400fd363ac4885c3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daaabbf436afcf3faa0a42384250fe78

SHA1
20bf84fb03329e9a82ac386b3cc17a4cc9963af1

SHA256
a2f711d20e28251b39fddcf2a37240e662b2a6485a3eca656560fd55a7cf5347

SHA512
c0240c6f557fd303d9b7d3c9059cece17734aa8297fc66574afb05cad592acb7412430308530d2ef46fbe077713a98cb85c947d5c137d21b1326c48931264422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2cdf2824b67c425c9fe3e04c7aa93e

SHA1
f2c7b903bd9fbc3ac7db48323fdf8efe6a9feb7b

SHA256
4ab2a3d93a7a2313abc460757039cb4bf7d400a22dde5b52ee443e79d93a1d55

SHA512
7d60ab3c1303cfcaf22f6a443e22bfb48655ed452e7d9e095abbe3dc97ca5cf0978781a430988a27c1fbdd94f9be2d116d5515f79fcdde6ae1f34bd3cdbd52c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a653784f3b0e0c13a1379c19f7254ff3

SHA1
b5510f43eddac7e3bb402c594cc349b7f34b9526

SHA256
f850123abea9dd3a785b8518d461731b94ae65a8c844e800ecaf1cb2b0fd43b6

SHA512
9146034da6609c42cc587e3fb2e8278914533c883b4de609c204a1d74ad96527d46c0e16ad5802f00cafca446246df976f0ec2ee050130e5290dd46204d2c430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f31b608a9b4b61609e2d53a55306cfc1

SHA1
5545dffea7281454a03bbe33735af4fee3ad55b5

SHA256
f0f52eb03ba8781ea558143d3ded4450673a90ae3bc5788190b374c45949e3fd

SHA512
039e1e8aed4b9041721bc609c659b252d7499f0b2d4c9c58a8d086d9807944391f7eece06c6378eec96a4615e0f0f608e3fe0a829c6c5681a411e25f84f59aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BAC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BAD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit