66fe1b533ba092bd6a952c9fbb829a7d6ffdb5eb75945839cce6e3b7a472db43

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70499d6537746ab23b3f58acfcb78f0b_JaffaCakes118.html
Size

23KB
MD5

70499d6537746ab23b3f58acfcb78f0b
SHA1

ae0fb6fcc7546ab70c1ab16a6b4fdf63b63ba87f
SHA256

66fe1b533ba092bd6a952c9fbb829a7d6ffdb5eb75945839cce6e3b7a472db43
SHA512

0b75b7bbbd6655df7dc3ae874c7c9318c5ba47e94ce744df8905e68282832f0eef9e19e8273f7a7f0abd6bbaf4c8a6b34d9ff3b3862cfc9ca10fc7ef09bf47f2
SSDEEP

192:uwjob5n5qnQjxn5Q/QnQiebNnTnQOkEntYKnQTbndnQ6v06J4RnQNjMB7qncXnQU:sQ/gv06kZd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE57AA31-1A2D-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422758765"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1388	1908	iexplore.exe	28
PID 1908 wrote to memory of 1388	1908	iexplore.exe	28
PID 1908 wrote to memory of 1388	1908	iexplore.exe	28
PID 1908 wrote to memory of 1388	1908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70499d6537746ab23b3f58acfcb78f0b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
22ddbaf2fefce094733225e5d28ecf5e

SHA1
aaa6cca0b239416b93bf3a663314c78697a068ef

SHA256
6d12d7cdb643ca7f943a7f198d32bc40215b3b647b105cd9a228f88b6c3c67d7

SHA512
40aee089c05e7d6c71b3d8dfa2032958c69a997635ff0facba0fd728790a9bd395765a7b657447908514d047ae3a0aca036fc9080f7563f8c37ff727f598ba5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d7d57fb65eeac88c1164271d09638f9

SHA1
bf36f81fa7cc3b44fb1466400442be972bc63a74

SHA256
616f62a58dcc2480259ef32710f14de96a9447829eaf041baf93d6e09a678c6a

SHA512
00d6f87ee1f9b52da5dcd862f2d8824c941074618964fb2c6c411c7ad0eae38465c95ba9997851ab1d1a647dbd179161e4afb429432abed7545370cc1348f61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f60b9443ad14f1f6c6d834312db03f3

SHA1
d11003b93295bb22ac58b25b332bf46e982753bb

SHA256
95670fe20c1db422853fb01a0c8aa9a44e114b7aa93d35f4c2f5207d4127f1cd

SHA512
bfb737ad0f322f6af675562ab5eb1f86bc4f95b56abb30aae44559211d7e35d779b8af2ebbcebd9d89eb9ce6c39a7c76d7c1fedaa0aeba2c9a2ac1776e5d5326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d98d9928b56bec14d884481827ad95

SHA1
c9974201085b5bc76a932ebf7fcc906c8b9532dd

SHA256
f729613be86e13d6dc117017a91ef96d4c3e9e03dc754c4de8cbbfccc88f9bbb

SHA512
c526b81c27f61cb775b47e083feda50f9216f080ac0e293b213a7d6dc8c541ab780a04fc9f70ede31f86bfffb373bb5ad92177e3e114ded769d05c04c64eb6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d938dd3286d50ac5686879fb8f9ba659

SHA1
962e6808260ae79387881f7fe70f6c2794edd849

SHA256
db4a69265a1071f284babda58c6eac8fa4ca73a59f2416aede71bcde2cf4f008

SHA512
7dcff0be0bad5da05bb82835b8db416359ccbd56486d9f2573e886b05e7862ddec950b1868f1a444795b3e99f8c42dab2c49ba3424d2f38dec66b00258e49fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57189d031b6c42c6313f0df93f28d95d

SHA1
cb99c8421b109376bce74ca5516bde92fd0087b0

SHA256
81fd1293d3176238ba88d8035e7e1373f75af9dd8b14c41c710913f4b354b4f3

SHA512
c062daf9ed22f7f158b59f32bc8f7bd2353e5d0d27ddc68867d463635587253a27e5a0a5b3c2eb4279c4bcf050651cc25fdf81b5031e108942848843ca9a2d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299a9a15fe839f8a49331bd67f388965

SHA1
136fa13789f4cc9bea0b7ce6247b2203a214dcac

SHA256
3a0c23a33aef3af32a893cc12304c2231ed35ebb0af4d4451f3be32b532a5fdf

SHA512
b6776a43544312bb057fa151062f1f01983eb02dcb0e18b6657afef1ec45bc3d355f724de911aad2bd8c57e909636e0983c4440626637885eb0d7c998480061f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f7f1b17fff274ef4b005d57550ce766

SHA1
dbc1ac4561dab267db45bdfa04009f5cc5c3edf0

SHA256
0aa9b63e82c65ea78ecd9c3b2e14cf28d346e6777e4f89f9a89eff4c79cc752f

SHA512
8338db2f3d4d5f3e1cf0df6de7490860174b226842d0f77a0991773213d4652641ab9abd9e124f41fe4c472e832067133ddc21320c894c5866c3727bc42f7d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae569e8774a8490d3bae440d120ef839

SHA1
f4bf007ff76acc0f13d60dd110402894b4b214ea

SHA256
0d949a722694c9181b1cec180711808c28a8e993553ab201e5961ba05f6fa48e

SHA512
c3b274aac6c797f77ce8f2de73926894687d5138df2360f9093ad4310ff9a1b23e34b775d20a5a82cadb58457890b1474962b38aa989c30b9dca367ce57826ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94eecf01589eb0937e9e2e0f815fbf11

SHA1
4d8e72a1041c40fb43758f061b2e8b5462ad920b

SHA256
e517b73ec32f7d93dcc8a1ffc8b175f972dcc32c2b098a94749aef43acc7d240

SHA512
218cc6663140e64d2f20e205878a63d620afd5e3c6743c778b05e1beeec4bfa79d79472f53bf941a7405677442f921c2e6fecad563633ed56a901e99bcde5bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7c8dfebbd464395c082556819569d729

SHA1
db4d9efd1af68ebb9af431b9a9440d291bba0b39

SHA256
a303726e7ab2e79074a23838555e49933f35b59c12aa2b6af38d46e238f293a1

SHA512
e5ac8ee3c08608222b6770c351636144663b7b6dde567d2aa2b1d440fca53ab63199f8597050e8fcb1bce018bb9e0f195d1fe2bb3854df5b9a76271046b1cd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit