7f454ce34512bff6e4f8cb18f4678496e3bcc6b11af8e69daf22b2a1accecf6b

Analysis

max time kernel
139s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bdf838d3d22aea7775b2fadebb8bd65_JaffaCakes118.html
Size

2KB
MD5

4bdf838d3d22aea7775b2fadebb8bd65
SHA1

28ce3e87d42552c710355d9c91a86554864626db
SHA256

7f454ce34512bff6e4f8cb18f4678496e3bcc6b11af8e69daf22b2a1accecf6b
SHA512

534eaa5228ae56a8f5f08149bbf23709b33c969bf7bae96f8892ec9ff81f89ec84b70462aa84e0c58b358809f024a188d73ead10ea82426d9e23a259315d1832

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88D6DFC1-139C-11EF-9A38-7A58A1FDD547} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422036717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2972	2060	iexplore.exe	28
PID 2060 wrote to memory of 2972	2060	iexplore.exe	28
PID 2060 wrote to memory of 2972	2060	iexplore.exe	28
PID 2060 wrote to memory of 2972	2060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bdf838d3d22aea7775b2fadebb8bd65_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57c4c7fd64f7ecc17f15503a60fa1358

SHA1
f3b72d8f6240cfa6c2d2d4d8da5f0d512edb0cf6

SHA256
9c13565644b3e236a0fdb6591dfb710b4a5ad14df96181409c5624fbc9167eb2

SHA512
aa0bbb8cfa8c4016a74edb1b63d08060663ced68143b3ab6d9f80388cdccce8af63cb22b6cb1e81da6dfc34596af56ea2e6c69ba726e1497f10ffba9b7b2db90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
529ae2eba0f65cf8fd067ad893f10dd3

SHA1
9f1050e18c67d4b7c1a19ee01d767ee663d0d304

SHA256
4dd0383e18484d59c9e6a5986359e7c42d9eee38cbb22d5c82c951418d9e7e2c

SHA512
d65fe2f60662bbe07432e09340779eb61adfa89f5f0a1a854e31118aa50d3d92e6d0f08a5afa9f5933a3f945536c09304235e5162ea6df61061628a59295c4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edaec7eefdacf20de75e9a7ea24c19d4

SHA1
99c5579eb389c802b22f646bf368ee6644db3523

SHA256
2c2e7f191971e2a7b0e000aac8629f40214511167d43492e2d64d841532f7817

SHA512
92d454aa17f441e3aec886c96f2bfb951d74f02e8e67e341715ee10e76ba1eb4e1473b8c7e147964a94f490e25b2310e160827df2abc4e9840acb6a98fc64e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
185e4edbe246eab2c14933542d64ed4b

SHA1
37186b00e469525f5663bca5325c82fe6e602927

SHA256
4a3e372e0a3cd2ca98a3e3c9f33479bbf1dce1228afcff6a968de8ac77ac45d8

SHA512
6b08e3fada743b94ff58cadaa3f833c9f5f30ea9eeba23751a2203bbcbc60eee1cb4001adb334fbb88d97d26fea6e6af4a2de97f4d9ffab6190bfe3a7c18babd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d4f6eac8cf765af68733221a51e3835

SHA1
3e586e7426021dd1f0f8cb365ece55c3129af68c

SHA256
b0647d6a5f27014850181793769cc17cbb29ec3e6a08670b193b515e1aba52ed

SHA512
3439ca0c9c7cf1c21d0379a27113caad7bebe72986bf4602da029a51eccdfcbb172ae52c96a9b78b6d869a5917b9faddc1380c7eb25caae45654845c3c925ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8292269d212ced5001cf5a8c7187148b

SHA1
a52301a93a3caedaecc32ae08f98519ca1ee1fe6

SHA256
46a968153902fce5428a7399d53f9d81aa08a0eb5f0ff1fa47644ba39be4129a

SHA512
c5cafb29969fdad786f0d9e2736b84e67fd70dacf9c94584c851922977a14d42a99dd1f7cb6fadf3b3f432caa6bb4d4009339dbef43b4307008769697a9bbc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45c11a919907439337f0ce10f4faf6a3

SHA1
6bfac15db592393a2bd449abd63277f1164fd981

SHA256
e10f51bddb9f472103427ff6e6d52572f1a6199f212a8590092eff9309118207

SHA512
b006f1c9cc882abf906e2f78a6cb3c2dfdfc4e142f0e63fe7f7770b0c8953553f994e76ab9336a2c876dae4461ba3b256ee29725fa44875f57c7572143892d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9a9b367e3799a8d5c7a4af948b0baf

SHA1
f8678f4e8b6e74327cb13cf356ad78bb29f294e3

SHA256
5034e9c7ed3f7729abce260b2b132119891bc828b0b62faa4f06dcfdaa18894d

SHA512
94760687c377d9a4a594129a67aa96cb34391475ebcf7e71f25f7ea8c89c4bd35595e968c7f0929a0882e16115b3f4377ea803457cf90228fb6025a26c39f244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e803b39e823d1c46233acef26a04169

SHA1
6cb27e251fd076377708b51a71929339b4b7aedf

SHA256
1bc159bc1168da927ce4cca6bd0127ff4a883a9711bdd238300e777adf32e686

SHA512
6ce07dcc50ac918bbdcdfc10a6e888dbf401832114428cc651f6978ec83231b380d2a282d55e02e6b10a221c4519368435ed5933cffe6fd7af372fa8987cca85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B08.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit