72e79f635fa08f341dc7f8d3c7c7c3153c25ba6822e818912f3d335beeefa3ac

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

493c47901edb6e78383ebde69b1f0312_JaffaCakes118.html
Size

202KB
MD5

493c47901edb6e78383ebde69b1f0312
SHA1

699dccc38014e535ef86b8739f33c6de5a401723
SHA256

72e79f635fa08f341dc7f8d3c7c7c3153c25ba6822e818912f3d335beeefa3ac
SHA512

36ba8857093d98c0dd0bac6102766ad61711ef544784e1f6e0103fb3cff707f10c549414e4f6a3f4c86d8c79dac945275ecb3ba355621273a5f642f205576397
SSDEEP

3072:RBHTGFZw9DK2oAL2oA5Ixlsc0SwJ1SjIhXCos+/g2oArL1/:RBHThq2L0SwJ1SjZb+RZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421991368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0FC3601-1332-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\493c47901edb6e78383ebde69b1f0312_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc5f622a8b05476f6b169fc484b6969

SHA1
2aa1666f62a9169b047d50f51a50df8c8a13e162

SHA256
6e144320d3e96fd4cde5b7029dd3cd6d128760dae7f1a065ee18e38dee5bfac8

SHA512
0f2157036640a419f502bb29febe94fb61f02e22af9065debc826559a09c47d4262f217e899d029c7bfbb4fe01710ed4e3d2529911108bae918d48187a452f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f3818755e20962fd85765ee3e66a07b

SHA1
44697020d6b2f04f06375ef2b6ff8759cdb58de8

SHA256
bfdbf99fc48d97277e3bd60d80538bbc10f7a3717e3d78b651a750be91563dc7

SHA512
1868b0d94901d81c861e7f8f69df6f60325bb509391585b8098dc711a6ff475c69a2532c3a9cdd3e2a2a0d1046270962c97d97e93670a4859c9e3ca9445637b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b2903fc74c5cdcd573fc8cf1ee25640

SHA1
dfcb63c2b899d85f2871d7f6da2e86583570ec57

SHA256
f750f24f520d01ac935ba519296f5d620214bda20e54efcb1741af753c75fbfd

SHA512
72ae33a5ab29116f4f48289fe2b89d380d57e8728559009a231b4b58065e9eaec5c473e06319092c921ceb2ce489217e247d51e2a74970e60aa3c423e8545df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
955efe9d07d214de96ef1a55e638e42e

SHA1
d74fd680dd21001a6bfb2b9f6b3b390f9820979a

SHA256
edf16d8b3a713dc66a78372dac927a4b0c0245d796970977918127b7aae47c87

SHA512
26ed045ca08470f9fd40528cf47a05990f39f58842fce9669eae0d790ee219daab290615dc2fe0e07ac85d71c5844dbdf6a552f0725e41ca1651897714b1ad1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a01e6ff5127b474fe2528e32987fcb

SHA1
b6b19b413775bab0ea8a0ea195d747e6bda2e3a6

SHA256
e561687da1ea94b4f6abf9d0fcffc25872b89345f8cc47905e64e57f63dad006

SHA512
b75126ff1005e87feeb45d7adba23dc3755e868b4e3f850828d62d6e726143fe8d6be6d288ff3d250b2694d9a2a45787bb8679691712e8ece8d0ae20a3457127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a151fcca94291681a93c800bb050337

SHA1
6ad225bc9879e52f7d3d3a70e2aa23088933cf12

SHA256
558d797de5df7c754477737804e67a5255c07c7c3be2eea5929dbfde635068eb

SHA512
2f07b5ddebc5b8a85439b939ff909b3fe20748e776365e055d84d8531f3f5011b7bb0c00690c8ea14201c1a2ed1e3866e2580e11e3f0d335db594c28f9813462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a73a25c9d9595445cf15b7662cf5a437

SHA1
fa2dd11916b110368845e74d04899b491634f549

SHA256
63a5bd406fd38f62bb9f7a1f168d0adc7adcb1600d4a7a3f235bffcbdaa274e3

SHA512
776f2f409afeb90d71105301be44ef3766ce6d2b435b8718f497adef4001645e84cfb9ebea0db674d5ef886798854e9a924bb4d169723d347240af37dff065a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a59ce3bca53c06bea7d0602bf6626b

SHA1
422e6dc127a5e57943fb6c3730b8d213b22871f6

SHA256
b12cb203a3a506e380309e3e461626d1420555432d6add04077e5bca9254437f

SHA512
87f3b4c1f06a0e02383a430d2c9b8f6c72908919c31af3bc62e8cec118ae66ff31ab200b6d192d37ff82bb7b5b8c55a35d3f853a19a16c1a4ed1dfcc26445d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca6f66bbb100fe0769fae464f561b60b

SHA1
d36f0d247c68db286a368ba659bd6a3ee7f922af

SHA256
4279e80d9147fe7c31954cafdd2f85f397369d0a3d966dd61f6f7c44457de5c5

SHA512
af19946ff5eb01f31ce71adbdcb262cb97b842068ba593dcafda1fe1b5838b47973ce553c21e48b5b4f676d5ce3174518c4037950e1522589769bd63aeefb10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a47512c906ea8651a7986650cf26bf

SHA1
e2abf335ab1bcb2f09f5ddac98e8a5012caa72f4

SHA256
4ae28484bf07243a364729fde0d119d099642cc0155f51ccf4844c2088ffd693

SHA512
294606e844dff1331e5ad86d33a425f885d9bcb8460de29cde8a4ecac3398db6d6d2d35aa5c7c67e32cd88633efd2a9b115e34f2f6a9498cbd4625c6d0661156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\3604799710-postmessagerelay[1].js

Filesize
11KB

MD5
40aaadf2a7451d276b940cddefb2d0ed

SHA1
b2fc8129a4f5e5a0c8cb631218f40a4230444d9e

SHA256
4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2

SHA512
6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\platform_gapi.iframes.style.common[1].js

Filesize
54KB

MD5
7ef4bc18139bcdbdd14c5b58b0955a67

SHA1
afe44fd9a877f81a3c36f571c0fc934324c6cbd7

SHA256
192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838

SHA512
6c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OV51DDG5\cb=gapi[1].js

Filesize
133KB

MD5
4d1bd282f5a3799d4e2880cf69af9269

SHA1
2ede61be138a7beaa7d6214aa278479dce258adb

SHA256
5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693

SHA512
615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\rpc_shindig_random[1].js

Filesize
14KB

MD5
23a7ab8d8ba33d255e61be9fc36b1d16

SHA1
042d8431d552c81f4e504644ac88adce7bf2b76f

SHA256
127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5

SHA512
e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1796.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17A9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit