595c1ed4973972eefafddba8beff642af7a1cd92deb34dc62a93c8f01703adc9

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7381bc62d3f200de0bb0e4329f10e7b8_JaffaCakes118.html
Size

135KB
MD5

7381bc62d3f200de0bb0e4329f10e7b8
SHA1

252c56a931ee2aef31465187e98cbb1ac2f8bc08
SHA256

595c1ed4973972eefafddba8beff642af7a1cd92deb34dc62a93c8f01703adc9
SHA512

3df8615e0cf61c48761096a1f1400b58a5d01e6a0cdfde489ee6daad23555c49e0cbe49ebfb465e6bf1f13eb791d80c60d92ad653f572252c434d96d3f1c262f
SSDEEP

3072:QshyyfkMY+BES09JXAnyrZalI+YmgwcVveN:QS3sMYod+X3oI+YnwcVveN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422839171"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E41BA2F1-1AE8-11EF-8442-DE62917EBCA6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7381bc62d3f200de0bb0e4329f10e7b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804eb6bd1a01ba08baee927c0339135c

SHA1
ce1e8990af761b1823634aa975d382f27c9fdf3e

SHA256
ed7a7e18810b95d0d1557551752a8f752f1d574b777d87797c3fe55549ea9435

SHA512
f2431ab296550c4c77e7a07293ab0c12c768b56c1bf04a0d06549612c4a560d3921cc9c5927ac8fbf8984d62cf433f3d198dbd6fb4ca68e4a3f1ecd3535df5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c72c1361caa93f3e5915583ca77eaf56

SHA1
2300278961faca03851ecdc129bc732a079d225e

SHA256
49dea47083765c52f27a8b8582a744ad5283c3c6cad0ba98636e3e8903174a58

SHA512
f5fb616f7a25a0eb3431650beaa91fc347b8eec7e8c68e477b2688e8a3eccb57e2ead8f1e1916e4f9627f0dd8935cb6f95768c266c893c5487149094936fe1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f64da634660cb60e3163a00467333b4f

SHA1
ddcdd426765b05833052db518ba08d53c68b993c

SHA256
e88351f1bc756b77ad32309d330f887721cff4ed38cb66833cab3cd31ef17c37

SHA512
5a6df2d6d7cf42bcb26734bf9873bcc40c51e6054bc613fcdbd6ce4330c5ffec2ef0a27e124a43eab9735dd511894ee44c531df6f90aabaa2835b2a8d1cfad47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1988da44d1ae4a92deb50e2e8c9767bd

SHA1
4faeb79c68c5428c0f7654b96751669c5a9bc195

SHA256
4521cc5ff3de05ac214b8ca4447bc13e52578f1ab413f8f84b5384d9cd072cbb

SHA512
4d6ec4688a11fbce8f8913deb031dbaa63cd7d8aa798f0646ed9ecd0134c72b25b2d3727a195123d362c5847b301ad425541c21148fa0ef74258bcbc79629ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f30f25bd907258f4bf8dc3eb56f9b970

SHA1
81261ec5d9b304c112346543765d5efb9ebb3d9f

SHA256
523645340dae525bf62e5edb847c50ebf24addc21027354dc866afc841ee6598

SHA512
5b9d20b6fed864a50d8435dde3c36dd7cbfed0142aa6710e9764235afbdc1e4a1f48b501cd4eaaf587d83dad0554801083cb227d1bd69c3c22c108be19f62228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1586335088322e6d28fea1033645762c

SHA1
eed48875766c243844d3a93461f12c5f2307bbbe

SHA256
a81a8ac37f9324c732355c5edf7c6f31abec47f64ace7eb5a9ac9aeaa74209a0

SHA512
576364ba1f99f49cc15344b1045d42b7489aaef6747dfb73b02501aa2e89d308d07e722f233eb6186725fe3e37057620ebb14d477ababe6bdf4186d8374a7b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408cec6db6f18a25b9527be1dd424637

SHA1
153d8bd9b47452a3325fa0bc5eb2e59f64e38c09

SHA256
4ee6a1aa983012870f872f2e6204f15da3bd54ab8d5cc8429ddd52877d887497

SHA512
6466dc8ed0c996ad33c8c2a434e53be20d76cee4e5f393a01f5bc0968e92a2bd64811b6b12592146cf689a8f2fe8d503dbc637d141532f593486ac0275e34c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39aadde9767da74859f50c72682a53cd

SHA1
ddad2b6fc9cc0e50cfaee2858ac3b92c5805334f

SHA256
0761b5c33b18e86c71d465900649fe0423d1db61234e99b3da70599982abbc86

SHA512
9be08f596b81f93ba3b7257f64c90d16ebffda12772d4762ce743b67ed055e01c7ff80036d9dafce21252ae820f808613102b249eeedbb19c1a22d625b9efbaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b39dfd18419419d1ef51b985d5523c

SHA1
bde54097f8991c2944817510d5254171ed642c4e

SHA256
85e6455dde0772f94a9bc27e04e57822c90277013c93bd624e9fdf5661d18594

SHA512
26d9ea95790f7992822f6a9138637351a9b9a8737aad94313b5e90595a81fd8f6051f9df4ac7adcffab79aabdbe349ac196e628b01f90917c9958543612867c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab234B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar244C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit