1f9e0bb40e7f4d71c09a44026998c383217dc20a6aa6eb192042ae97eb5d93a1

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73a571b876a13257ded54cb7392be731_JaffaCakes118.html
Size

145KB
MD5

73a571b876a13257ded54cb7392be731
SHA1

ebfbabf2476031c207b68a7977ac244156626c01
SHA256

1f9e0bb40e7f4d71c09a44026998c383217dc20a6aa6eb192042ae97eb5d93a1
SHA512

36da7a74bbad869d207f5fa983e114b875c9ec5c1b6f6d7f36683012569d0464a9a3ded8985c967e9f2f3bf0bb18ce0240af63ade8881e506de2ffd4de03329f
SSDEEP

3072:cdcSaVMIxCq0Opxxlzjk/nyfkMY+BES09JXAnyrZalI+YQ:cdraJsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DFC6D01-1AF0-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422842381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2324	2344	iexplore.exe	28
PID 2344 wrote to memory of 2324	2344	iexplore.exe	28
PID 2344 wrote to memory of 2324	2344	iexplore.exe	28
PID 2344 wrote to memory of 2324	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73a571b876a13257ded54cb7392be731_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045a1ead88ab554dbe657dd55e94414c

SHA1
50f4c90d36c1928d5350de6088607304473fe260

SHA256
6d8aa912d2354d3960e8b1e1ea68d3a9a9277890565dd357f85c6171bfd25215

SHA512
9b841afe5d355058a8b6f676ca8c9b250fc74f51d5227593c5f4fa2dea7b840cf1281cb73e4baca6411e8db59966a43368fa2758d2891eb1645217a6ce7b933a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3b719954835c43e19647744cb08676

SHA1
ee10c437dd32435ac4a51743be751805fa9d7c13

SHA256
08c10cef9897a2ba40ea3503bedfc4b60d87225930bf33433fdff13090c1ced7

SHA512
2c486c0155f67cb0e4a0dcba77358d20c61ae84398dfb193c0ed28d8160211e08fac6a21ce5e5cc7ca2b25f729ea16afd3044e31da63c89a98193614117eadba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e186697586acec7eb67fcf3b5f31ed07

SHA1
517b2157c85e2c03576a931a9c0144b0379e5d0e

SHA256
108bf5c0fac5cea02f6d89a1f0e7d0c41a5726d8bf374f43e008f18e44f98db1

SHA512
1a83ed6897bf0c0edbb27625405e40e167126df4aa3a4eaa5115322a72b7b44e94068439bc4f56e452ae3aa17d9b6439c47857f208722d208c0623d47f494610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d9db7c594003f3159d73f8b2650c557

SHA1
37d2e23a263bb018a584b66fe4f1a5bd1c241df3

SHA256
1af77aabc6f9b5b878882a4ccfc4a6800e51ead5bb78e56fb305deec2e0c010e

SHA512
4b0abe8691b02d137909d41caecee96eb6cd503e21a85318c29e871640261b2fb7b196e14d240961c3095d9e0e2fabace57ee59c0f9c4e3d70f2cdd3f9d95cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42cd3a655ab64bcccdd675a187bf8585

SHA1
8c3bc716ec8bf08f5b17cce22e19a0d8bcdfd0db

SHA256
693cba73e596512497edc4c36fe7540b9cf05fe82131fdef0000eaefc7818339

SHA512
cbd2da944ea7578346d483cd966a8fdadf4df9e3bb7bf716d5bb2259e510d88644a75beb40ebb95fffb090afbff81c6233c283c41df08ef1a4ab50e0143eb27b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca6bbbd5213b75025991cd4b3c0ae3e4

SHA1
8ee45640280c7a8ba285ad17f0e978f91295a54c

SHA256
30c68519e2b6c04cc479813585b246994775388313d40751dc38e0248480a268

SHA512
524f19a533293d6d37507da3f0c7ce51ec1e0a4417b696f5d638893f025e56b2736de54b576719d1ca8e793ce5f99aa3a6b0d3841f96f3eab3113a9935ad805b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e143b664550420bbf11b0afcdd8d924

SHA1
4159f462907d256eafede0656037dfee4ada67ab

SHA256
63a4618e5fcb37a18a6dd404fd62249c729fbd086e146979b8855e599c7431f0

SHA512
793063ef530fa28cbab50c6f20ae7e0ebafa066eeba0e4a79e5a1fe18ec9e23a5125e84d9aa274fe3e6b18c8c7ce380c78b67d150beadb6994237155621b9313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c2dea2cdef2caaac57a88a29c8d938

SHA1
b4eeb021eaec93e95b2be036c710c4e903129a0a

SHA256
977e3cace1273765b2f0576dc2947e65d084ef9a150056d8e3deaf36ade67de1

SHA512
c594ebaccf34e5e7e4f6b013da341fb9b95978533ea512489ff9f5198b84a55372bb54012af3e756774b9b297a1cbfd5658c4e62e7536c770d7cda7ec745084f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9fdf10d105a76b49bff8569d5eb288

SHA1
79d3e211ed9dbd254922dec1b89c533128cbfe90

SHA256
a8f5107cf4b70070167f826255e2e81fc1f8d6d4c6a68ce1c5795d5481ec17dd

SHA512
8b863defa1c80b2d4cd0631bc0247f0454e3769342126191ad8e94c51a4a3170a3c45a7c241ea4b3bd90f15eea7cd24442785d7cf0cee69dbce56eddaeeb05b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3f5f9016fa86d32c4829b32c94efe6

SHA1
9875746ce4662e0a51eaefab84e7737945e7b453

SHA256
64c5dd60715e5bac328ade1be2793840d859430104a69b494095e7f5d6a60225

SHA512
ee16d5f497e026796d053a1a513f8dd7d289da1bcc5a5e2b72ea30f6fe10fa28d3a677ccba810d21766f36815627bb8b957484e6bbdb6a51c923dcc7518169e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21F3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit