7f53bdaba7f6051b867d80317b0d3ac9f03eeac5b14c0fe7f9b2589ec9202e74

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ca6b9daf9c1e92da22e0c822938c864_JaffaCakes118.html
Size

100KB
MD5

3ca6b9daf9c1e92da22e0c822938c864
SHA1

e1b4bfbda18bbb8af9c0c3a43ad64bbee1e1ee2b
SHA256

7f53bdaba7f6051b867d80317b0d3ac9f03eeac5b14c0fe7f9b2589ec9202e74
SHA512

70af429729b8285ee8885eaa6c1e8e7b764db382d48019d7922845639deb23f62e4c5984a211c1bb02414d70f53b5f2483029b632745fbedc7b3d62e1c09fdf6
SSDEEP

1536:P00NCw1z37oK15zpOJaB2XergExUkmXNcGKICmSiU5ZdkQlUMS0M:bCw1gKVOG2XCIzMSR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421797814"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AF452B1-1170-11EF-8B6F-CA05972DBE1D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1844	iexplore.exe
1844	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2132	1844	iexplore.exe	28
PID 1844 wrote to memory of 2132	1844	iexplore.exe	28
PID 1844 wrote to memory of 2132	1844	iexplore.exe	28
PID 1844 wrote to memory of 2132	1844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ca6b9daf9c1e92da22e0c822938c864_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
074389d323c7126dfa8f15f73ca1275f

SHA1
749b7015b54c9c9fe66b131fe501b4651467fbee

SHA256
2b91e93fa690b6b2027c4d9b4000718b500ece37a21f6456f1356f2febcfe84e

SHA512
01a96e8fbde652e752f0c3233b2ef11620584576735c1a69ffce57132f58c1513b95e983839472832e8e95e30f61a619b50cd1e76a6807e0c18138db1ef82a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1acfd189c06b80c327ff5e359db8c963

SHA1
a9a5a4f1251f807152eba2376f07765ff2f10a60

SHA256
95e98d62f1fb2031c0bd3a74d4d03f309977db8786d68c984659a76a0a6a3539

SHA512
0084ed77eb11441cb473b7113f089cdcf394961df4879363a98cc54022c4443b963067eeb39f698819260e2de481524afe17dc8fc0b9555048a6b3bf5a177de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ceeeefbe3ae9b674a7c07cd4d8165e

SHA1
2c7a01e13c5c4a3432b10f8d1cdbc397cf2710bb

SHA256
796eddb702181e24c12669589c017755304df82434bb003bf71a01782f178715

SHA512
f062b3cfc126e4dd2c314d757befef3f5afe94f09737f8559045420a4a3f1e97d501ee7a7a8568193c3601546f83205242175c6d6a1ed86d4ad9a8d51942a978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6693c9ff6cf79fa9beab955497eaf255

SHA1
e3c5d2eb10695595f27fffd4f0061e5dc2885248

SHA256
062189a8cc288359f532d0e4ea7e810ee4f0eead37a855a5420e3f8da2164a10

SHA512
9f5d346cd35befcdaa13ceb97aaa531a5455a299738ff42859946dc5a99f288232f728e1225ee9b8514edb9d78b07f076ba551c2d052739a03b84660077fdc2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1980937eaee8c0745981465e59b0b212

SHA1
f2600846d0c2a226ddce2247f5dc3002ac011bca

SHA256
0b1ea4914b9d9b91bebc5bb42d5c45b170df62a52fd53d1be8eab85e25723a3d

SHA512
426a6f784ffaa1951425a33a43f008d83784693310a274d468158320facf1ad99ba6d1602dcd8d0f0c8867c39f28633672341663dc119c40234453ea10ccd62e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ad34e80872735a05eae5fc3620c08c

SHA1
76ae27e602d7a1ab087cf6b7459b4d9d67a4cafa

SHA256
48414da6d04e656734f803b7e616ec58c4da68f2f4b0cd5851d5e75dda46dae3

SHA512
7d1281240cd7b6e16219ffccf88c5062f0fd3ea65f62d65cdd34ebf94471fde0c7b545eaa36b55395b0b24f79cb38308690738f10cebec9faf81c3fd7b3e5402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb2347bc5f6f870b6f515f7ff225186

SHA1
6257ba969f4eb9b9ac05ae19ba9f63930a986e81

SHA256
b9a0a8d505ddf3425283a73bf832964218ebeb8147e3f151fc8874ac897ec6cb

SHA512
b81dc068a3ea9a9d0e3f3d5c95cc27714392adb3f99726afd20fd8a54467d3e2537eb7472e233ca637691aee06f956b1995557943cb79bdfcc7725bd95a240af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
293d130cda66a9b8740dc3af80fe3fef

SHA1
9e12b0b9ed43ba7a9ff913b14c1e10ae1b9cae31

SHA256
4a870150ac1cb97e2cca08da4d7d0b3cbac970a3858aa4b67a1067671213c0ea

SHA512
8c9cfdaad7b6dd5cff3b63d8d3e476429fd91a928988a6107660d88612141cf6c519bd490c87ba19abb10055a905a5f6485fbb0f8d8371a8d573e95fb8e8c4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34fc1ee968f58fb7be7c7b177f9a2a68

SHA1
7847ca9f6a74ae9e36b72c189626dfd37d8e8787

SHA256
01772423b1c23b98756cd9fc740ac3de4db2c7e53250331b26718327d8cb7c5b

SHA512
eb7495345563583b289aa4420726ca7acb027de2b1b35e60002187ac173d3809e0dac484bbb4df077e718db16afa89d421f8c4c2d4e3de7afa2d2243de0b98cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC81.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD62.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit