28ba25285e5baa9025f2d24d2450e47f1cb570c29b565312e0f4067fe12ce7f7

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html
Size

142KB
MD5

3d11dc97c4f2076bb80bdcd67f2d9bed
SHA1

856c4728b42c60811092ee06e9d21f4cbafeb7ce
SHA256

28ba25285e5baa9025f2d24d2450e47f1cb570c29b565312e0f4067fe12ce7f7
SHA512

0d3604ff70c54836004876aef66bb1207c6fc07e645db85445d6eb5a544218dbf9cc9e9e49bb203a67cd7bd25cfcbf4607ad0075664153b751c9efc5e76a8b42
SSDEEP

1536:SnzmlSpNQGx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:S7vzx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421805734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBA74141-1182-11EF-AB14-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2328	2612	iexplore.exe	28
PID 2612 wrote to memory of 2328	2612	iexplore.exe	28
PID 2612 wrote to memory of 2328	2612	iexplore.exe	28
PID 2612 wrote to memory of 2328	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d11dc97c4f2076bb80bdcd67f2d9bed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
489666b2ea3d91b0463deb0e4d348f84

SHA1
8ded99e8b94a35d7da9d6aa0a0269b0757dd779b

SHA256
38c0526959ec8f59fa086bb8b35b5da9027c40cd8929936379dc77f0979072a3

SHA512
c2854a4c5a89cd96c5077e0bdd7231c02bb02420437381ba4eb9775fa8a899038d78b460044a67209b485a0a4d360b808c7575abdba3a2737b0a9f0601ec19b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ee1aee19c58798a1dcf3f3731f83f4

SHA1
46b06ec8b5a016b942b3b8cf3fe7c97f93d9ff27

SHA256
ab489c6ee3229ecfa55995d034bf3e0c99469cf6381d2c5685007f5da4a55963

SHA512
010f7faac389ffe4690568f0951b2a49f0d73661ba7565c84bfca3bb2a343a4617a9443e461ff756cc38f577b5656e4a5d4baead1a0884bb9a69959f173c4926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58aa470f69573713a99d03984acbeb4d

SHA1
4478ed91d84dd87db1a4e50da42ad94ed9c5f8cc

SHA256
b0638f4e05d8722a482bc6acab49c042e58d6b17607608f0a44bc63e0774f47c

SHA512
c95a2807aae7606e697b811c5b115be5a80cefad40176f7459528514cd5f8634d8a54ea046cf5820141d7d5e32d7bacfd8a7c2f5ff819279edc9e0f91df90924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
879a3d79ddd641dba29af52f0daee7d9

SHA1
0ba3711aa3a8bfe89df74bb17b5dee8ec42dcc3a

SHA256
63b38b869085f34eca1aba1bf18681339a64a682f00d8e6cc3b9ffe2c3ae370f

SHA512
27247f578469a09b6d45d7b93b01c3219e61b2ef713f71cd40efdf470ae30fe6b63cfb292887c6ffcd769df51402f0aaed4d4e6daf0742a8f46e7607cd4461b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbbfe6d859da06154b91d1b8080503ad

SHA1
c37f3c9e8b353672e25c128af94db7e7b2246bac

SHA256
452239667a65a571b991af01ae1031caa474fae3c0295913351d5f62c575e324

SHA512
5ccc87e6ecb052c605305869b653e7623325ab1b17f7517c766d9e738bae2b38e7a9778f4ffc24b2d00ade8b062bfdac678250f98aaade7883ffb91af39052eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9de35c1c6a266df479307cedc3946de

SHA1
d84100232f784949d03a132a010e965d64dce28e

SHA256
cc8c3a782d0ed26641a3576f17ec3a476264d9f19f0be619d62f2e2c77d65603

SHA512
5521d20e294c78988b3a03864adb764bef7ecf6558868af2534be9b838977d9da908649b39ff3c6496b44b493ab1e03724e2f4e02cd21d8e159a26818e8b41ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e95ecaf223d8d62ed2db92a7fdf0b8c

SHA1
32bd31aff991fe7e773237c24784537c603c1189

SHA256
3c6b303e266053cfaabbcc5cea9126cc636f9dc4eed8505afa4a8b9e0f4ccea8

SHA512
455e3235145a0541fbd2eed41b00bd7270b8bef8260f31ec8e3d983d823a46218b814707d9996ace4cdc5db3bde583e3ca060b59636ca09dae3d083161115f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188de7a56649af88601777e75c7c846b

SHA1
716e136dab59923dbc5a3ab5210517c37e2fe732

SHA256
c6946e0e3855b1b6d2246775c39b61db71c4557bc1eb5a38671013ffc297f4ac

SHA512
3873f32c8b58694e2c2c17ef83083ee5421231cf2a422212388773043a4ac9d77c63782ecbf2c7d036a847938a02a979f7a25bcbbd8eca020d756b2b4895e5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29e1cc3ee599ce44dd06b82c3904698

SHA1
60e856984752fd3194d1d02bcdeee3d13a827cdf

SHA256
5d92888aa1ffab920c652bdcb7816b92c806ee616a8f82ea16068ff2fca9f89d

SHA512
e980be41d63678a03e2a6681bb44c3ff4c3510a04fa1c231da67908443fea9b54ff4423d1594fcaf0f05407ec9a5bbc7b9e52e789b4d70ecec37ac17a9c68051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f5b183474953aa9e78fb13d4a196f6b

SHA1
2c44d6365a745d87f21ed385954eba837f7b1749

SHA256
c1e2258b24f9c4d526ea7b83f3e646013d3cac7d2ef78f468258d78759f46ecc

SHA512
95fd84539481cf772543596fe1d0c6d3d061ab71f3fdb742e619f1b148991058579b6b73166b667ebe1794e4e743a9fc03b1a18a165a5118e18f74d14945f16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de583c029a231c404e5481fe4341bd7

SHA1
4ef67328c472633c5fa5921b6c1ecea86ce4e774

SHA256
cfd99bc38723cd523ca151c65b273f490dc653241fc249deae231b4b4321e66e

SHA512
9e82b8fd84e193bcde35e8c444ead4726a2e98bc48a3ae501b1be42a3e583abb821ce5aae07379f38053da5332e88621a700553e5fe63363b263e9ead90ff4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59e49748d5851be12b21cc34a9017bda

SHA1
25c7e476c74343490191f1f0c19191fbc2bc1629

SHA256
df6e8f37b232836d9216e26667d5bd749f75cc5e7534759b38ad34c897477146

SHA512
a9bf47043e0892c21d6bb82cb83d8cbdada4e431ad6a7b6d5a250ff04f912242fc46fb72783417ec8269ef73d94c2ac9f4bbc9083acb160b16c57e25e9c36bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9ed11f26f925e1960c5b2045669d22

SHA1
ab126bf933f86a8f241c1c27447ba6e978b825e2

SHA256
a1267306b24dc35ed5a53249187d32abd26ac7fa4163c7254975eb5a0e6efc66

SHA512
62b68596e0430317b3b129e24a00aad761a6172fcd3e2bb1e3eb8f1d63e57426f0458f75d966dc8d6df09f3e43ccafa17f38c3d796ba3d61cc6f32f2f84bfbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa67932161d72fd0238a4335d1be1e8e

SHA1
142766bd5995a8083268b88e325b8963ce5532ed

SHA256
e8809a6cd1675dfa9c502678714609b1cc7a1ddcd21374ca38f5d4b3572debdc

SHA512
f287066ef1bdfe095a8a3e3dab96af833c48590a0f514f8ba9ec50075791ee425a2553cba40e6d1c1b9a6e8ea905d6b66a9f4e7152becd21360b8bdbb3bdb221

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1077.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1136.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1139.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit