439786e25b675dcebdedda44a4e9fb7ef7e7cb3c280da15661e69d4f3e00e9ae

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

734db01647f8966aa76f4612df6f4b9e_JaffaCakes118.html
Size

32KB
MD5

734db01647f8966aa76f4612df6f4b9e
SHA1

98dd7b8a4905385babf70c4c7711e14f6e766ed2
SHA256

439786e25b675dcebdedda44a4e9fb7ef7e7cb3c280da15661e69d4f3e00e9ae
SHA512

444ecca843d9c8868753f24e75717c4c7f32e507f43ed30c963851b816dd9b129a20be169749a94fba7291c87e7319be2d3a8b2bbb8169d4ec0f3a12b5438514
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhyPZb5nYDuGnQjxn5Q/GnQieFNnHnQOkEnt+knQr:ACk3GDG7GaGNG9qG8Gt3Q/9WSgEQ/jJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422834254"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71F077B1-1ADD-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\734db01647f8966aa76f4612df6f4b9e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6e8ccc4ef0bca02c76bf8c44173b6ab

SHA1
de54fa1517a3f69b51455668cdb468ee7c09373c

SHA256
0cc2462a126e879801922ed336714a47384fe6af282b0df68c631990a4796943

SHA512
7fd053eb152cc408207b523ea8c834fbcbc16c6ef038624ba235a33fb9e713662919d70d6897f569883d919b90711c8ee814abfdba751caa65c3d683132fa2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f6efb4b789af2b3022a5c171c88bf1d

SHA1
ca159fadd0c3d4d2b8d15dbc60837787b5f672df

SHA256
f12c51c45abf79baa36e9bbfce0f73d976f893523338430c5c0b26ac79c7851c

SHA512
e7680dc1f155f204d4f4debac80ba246e061bc0063ab21bd0976d482cea9567e5a23df684237880f3881784a22bebb78c79f6711162fa273b3e5de490da25835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ff3a971f69b271839074a47deded27

SHA1
c38d680a7960e5cb6471c5a2336cba75416dd30b

SHA256
bc9d208deead51c50c7fbd32ce70f2d6d72fbf45cd833752a1463ec0e025021b

SHA512
8a9da974d0cde28837ecfafa6e8e006a4aa6d75c3e2f0eff61dccf6b594997832adf03b592b8076d6a5c4addf6c3326db1b87e25155c06c9981107057910d803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b72a3215881d816a013a04a3a111c02a

SHA1
a9047d9954ed42477a3a1d5be6f7ed91a07884a0

SHA256
6a7ea71d10036f39082c36bd3a179ef2bdf444840bc015c4d71c371ed96b6731

SHA512
92353c2c144109241a051c18eb5ac3a64273d4b4c227f94d510a8c5697266dd17d38f7c85a5e1dd0c53321dadcc31443036d14981a7cb184e37924d75be19255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b5e3db0bb32d897e14fc4067d0c1b05

SHA1
a3f70c4ea124c2d31d53411251f432f5c9d0b101

SHA256
9f0a4a4b2c41cd7ce5fd7b8854fd29ff7f196416325fdf63903b94ab887b91d2

SHA512
d678325c7ef5ccacbc76bab9e8b0d0d4f6b13ae52ffc732dd06dd84d4b03af0e14661fbd33057c735b013a8bfe64182952bc6c00dffda6b59351cadd27269596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2805869a215ee9b31f36b6dd9c59f552

SHA1
51a2b71b83f9e639dd861efbbe9f41a2d20715d7

SHA256
1d046b9d7cab1d0a0fd7283d3ea5ebee9c798b9c3e2785518e2eb8a706cc7fa1

SHA512
bbc289e604434b0663e2792aa1e8a168ddf2ca59f495de99cc686e2ed71f3354c8681a733ae7e72c3e3484f62e8532f39073ced53ed1da408d9ba163560a1943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52170dbbd967970b547ea445d9105d47

SHA1
ef59635110a6f9ea818a4bc0109361210a781fd6

SHA256
99dce5cb2048227db841a015b05148a7f7a1809563bb6685646c51de08a977b3

SHA512
a6608db91860ddccae5cb6574363cdbe4eca7f52b238c7a986489d03a743442cbe5cf7fac22b2587d155deb2b1797e7065e712f4e8b29930f5ad2ddc2d6e1706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c00ba6f6bfa43a0376ae42f4193dcd33

SHA1
6a253327ecf6b6077ef553ed24f2e312919761b0

SHA256
ae022394f3a5f3532085b35491647ab688cdf444fc0ac638ab07f6e0396031ae

SHA512
4913b23c3ebdd2c4fb8a2a9df5628c12d62f6db2b1b2db0cf0e183ab06792e517c01edfad7601dbce5c183c8b2911f36c61f74990aef044cadc94d394803cdbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27d25d30c51b3285ab5f7f730f19867b

SHA1
aabe834b863bea7008c7d1a2a869e221ec116e86

SHA256
2b9dea215f175b95e488e7b0faccc9d4f641277218337f4103ec7cfece1e054c

SHA512
78e15c3371ba0c680279e544c9034ed221f9e9fc438cf9af9026debbad9f98dfaa2e6bc91f994a2fec3fe8ebda0f522f6568f2759c769c1ee7a0bcacf6d468d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab194D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19AD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit