9823e2cb7627c95d661bebd4e29b030e418e7e928a9e0759298e2b8eae4e77a6

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f66facf764e537f3a63cb14d04c2eb_JaffaCakes118.html
Size

213KB
MD5

68f66facf764e537f3a63cb14d04c2eb
SHA1

1fa17998c64b19deb4408d494b6a77b11b004c55
SHA256

9823e2cb7627c95d661bebd4e29b030e418e7e928a9e0759298e2b8eae4e77a6
SHA512

d6ef0d60377c1393dbc8914fdd42b4d196dfb97c5ead4112ed5b03235fb6ffd2b80bce31786677ee0c3bfa7f8ee6236d07a5772cbd29d76282acfd39c176d647
SSDEEP

3072:SShpguuAn2oyfkMY+BES09JXAnyrZalI+YQ:SSrYlsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422581511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAC236E1-1890-11EF-84C7-4637C9E50E53} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68f66facf764e537f3a63cb14d04c2eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a71fbadea572cde738089ea889f66026

SHA1
b57d9a03e6ccd57d849ba8cf03b7f90febac1e14

SHA256
567a628548253e5b669b5280fa6778a2d03648de85ec17a0c56ffa39fb69768b

SHA512
bc255482ee1dce2455f33b7bde4a48ecd425a0005dd1781e9bf66477d15a9cab37845dc76c67f134c15b7446b2c72c01f65643fd4f98de1dd4921208ce532fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9afcac55975085ca05fe6989cb7163db

SHA1
bf591d63e0619e6cc9316c5ab43db55ed0246f04

SHA256
cc77facc775517cb620d9d4354e200e72964761e218af2693e6d20cd0e2ed2bb

SHA512
f6b4e06123a8f1d7c857d6ee10b3a20c7c1d709a6692d3be86fbd3e79e67845722e6a9c08f94af72ef336818a8781d70cb7ad8162351971edd306f4f107b3ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e3a316ffc964191ea5e22e79343a60

SHA1
848e42eafff25e3cbd4ee31c2b70dfc78119c344

SHA256
68e9dd64a2ef9426578fe49aaec3389e389ab4809bce12a0e7ffbca7d173e276

SHA512
a8f911fb95bba5bad394650b7f0ca502402b9790455ec795a70b8bed51a0a67a8965eaaa79165b01de5b24b87a31a739f2abf3865a38aad3157128edf9e27645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471e3da74333189f724a980bff34df28

SHA1
8f1a7d0a69772da4e3c87525e253293a710c0fbf

SHA256
8b72e6dcc8dc8a77b262c91fae0c2b1ff37c2d087a4fc64823c570fd6d3b8b93

SHA512
b3afd543acb2335bc13ac928a1a4933efc9f5041e4883466f6f9cae4c47e0ecbca053b1eb5d4d8bdff97c29b9485b7f38cfd878840aa662d717a55cd1df3fb4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
269ca3e328e8d79ef9b4ea04a22d9bd1

SHA1
d30222795e6f9034eab3d9adacb1dde7ee12c2bd

SHA256
010353a4f228fb768f8ca1a048c6623f49eac5224e5fd2a89168af7eaff52a35

SHA512
96be1fb986a0a6edf12b03a67006dafef187bc2d08d561f7fbd07d3e13c7f6ff0ffa12f61a6f576c5712447ff3c6ad683576c267c496bab2ab9fe3ff1907e2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fe2afb891928b7cf373b7fd07d9331

SHA1
d7c732a5c766dd7fb29ff53636a370caffe3b989

SHA256
b029349d7f1ca18628153dea71fa425521cd7e5634da219639d760a061d35eef

SHA512
9338414a3cbeb225af424f6364568351417f9c4b635235d5adb2bcf433bf26d3c725389f65f79995385b4dd037422469c5230c1fec10b41d377abb3be241b223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c7a1e6297d1899fc263ac73e35396b

SHA1
90554b1e84c6538092de7cbb15d653142f068bf3

SHA256
0f7e025ace9e43bc7be4d163b1c1d6603be8b0b40b6d3a10b1ccdd3b81090c7c

SHA512
75bff7f95b8a45d9cdbdf8079cc4a3ef5dafd568778819c6fcf3c1de2daed026737822ebe0af405aa04bbadb8efb38f2fa89a4d0f34aac764dae018e876dd362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c914138341142f101f25d1dc8ba51900

SHA1
29d65d4b4384b0ca98c2415253debb5255ed924f

SHA256
9fd9b61f667ae11f70b1c0914b531aaa99eb2f317210ddf2ecd1c0239e152e89

SHA512
080217d4cc7fc7567d74073f41d9bc4cfc98ff48a5dc4ed247041d09ac6f2e3002136f7e4adc2b677b8617e0e617de9c2b8ebc71785d2ee235ba35067848b5ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2eb107362be86f6ca5d3a7a57aae3af

SHA1
2faca9a07514ee85ce847464b1d8df9e2ebbda14

SHA256
ef9de20155f2efa9b0067f323bbb440f47c58d221f2f3f3db30e7b8b8b247011

SHA512
c507af30bcfbd88a729e70bc9596eb8680194f35f5bc4e3b038b179612de8464d6a7c6550aba761917c714cc3751c97cc988374ddc374ab7da6864d998e83935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1eeb571641d839b02630b1bd46b999

SHA1
f940fa6afa19567739fe80231b11f53021a0c0fc

SHA256
4521384ff489624c02e2bfa6d20d6e465dd12c09138f02949843acd5d1d28a43

SHA512
3dbeb7c34d357688b37060dd446a756f2871f5d3ab328563ef571f3e5caddb061395e631d51673d6dbcf537a94436c135e4f50e0b1195a2c41e47909ad044569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7e6765517a5e5dbb77c6791f6233248

SHA1
56fed528bb924c478bb37c69ff081898030c458c

SHA256
4e6a8bd520227deb7fd09c26027194b727c6c302cf4178a7066a218a740c0d09

SHA512
86849659eac3c57a6d71150e4c97b92c4d82bac6bc3d925e891343e8772a37186f0fd2347dbf0863e242078dc1b0945e1d4c4eaadaa45dd92ef94e3cb82e59f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF34.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit