3f8ffff5c17a457e9733e2f93f7be813f4fdfdcfdf20982e984c16328bc3a4bb

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

706a71ca8c6f799acccb48e843f76dc1_JaffaCakes118.html
Size

23KB
MD5

706a71ca8c6f799acccb48e843f76dc1
SHA1

1ce97dc8c6fd13df50d8b1bd1fb1796b8dcedd93
SHA256

3f8ffff5c17a457e9733e2f93f7be813f4fdfdcfdf20982e984c16328bc3a4bb
SHA512

feff0ae5ba779aae31edbae1864e5a70bdcde91415aee9f57667f90ce907b1ee41fd463a0e3affb2e7ee9e64294dea9b33cb314ed824167c66393f56353329ef
SSDEEP

192:uWPUb5ne2nQjxn5Q/1nQieANnYnQOkEntfPnQTbnZnQGCnQt6wMBgqnYnQ7tnOY6:XQ/yad

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422761895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F89CC561-1A34-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1532	iexplore.exe
1532	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\706a71ca8c6f799acccb48e843f76dc1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecb08cd3222391b82f1d2839151f5dd

SHA1
01f66f0cfccedc20a34acb81bd139b7f52792714

SHA256
703c3e0aa787cfd03146ccd9b5be45aa40ab17e7d7b1821371dce65c6ab30c65

SHA512
c28f2ae54add33b012d2f364389866d8d5690d0f0bb22180c0a9e2dd5b946e34b4a2e015461f8947a84ce7ec3891d7e6f408c9ec602263da9d5201a1fcfffe5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3660870bc9bf9cc98351d4655cfc2c

SHA1
769cb0b7e4ae67e75e0f0712520b72683b888b18

SHA256
7e26a1bd77f1f6c88040611155b0de199aae6ef85f68e234965d51987dff7819

SHA512
614605516d90248443428156595a2746a8620b12dbc34a7c2296fc435ed8febca4451baf43195e531b406d2ec40c0eebebde574f3b744484c42edcc1370c77b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4d910dcd850ae6a0068cb4d4ee9c40

SHA1
16b4aaad48ccc93c58555bf8c97efb912ef92cab

SHA256
cf90d7eb2f1ea5dd82b854dbb4d9ebad502b9010c857e8d1854c186b4d72f85c

SHA512
a2f106311aee4f501b5d8b32b39621223740d4202eeec9430d5fc9bf50a6f014c725828d269a65fdce1eb717745d104fb37608e0103db2e3a746aa6fd0d8ac51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54e6882053f3250da4711d45d039f4c7

SHA1
dd2c858137e58208361f617c047e96d357d00d7f

SHA256
c3bb27ec170e8b49980d1d313841825d6b7fca9b307e79e131bc3025fce1053d

SHA512
eddab36a7f9ac9578d5fd3710e704e832fd955de1f10ba07cdb7d7f9816f75b3408661f64bb8da7095bbe31332fcee48c108a354fe5c9b66b03385e25836d942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dbebe2ec3a3320c45c1b6f259af7e15

SHA1
cf7279bb650ca8f418429f0adbcc5db6d431b21d

SHA256
9c578330c98b478f1927fac94152b163295caf91e2363930e724d94965032d80

SHA512
8e862a5fe2b4f7918228870bc46ca3664984f6536358ed93a2c174f9d40f29c23f40a214ff02e453c37a336b154283328ce5958540fa2c8fa94ad4b560e7303e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
768d3e536ca7170361dd159cc368eb23

SHA1
c886c7de9c81c6723671fc1728eaba2494b3e518

SHA256
2575c67690dae17bc530b54ec4df683c30c0b594b32aaf29f6e6265580b6ca4a

SHA512
c40e2b205ede817abc514d5c87ab1989ce074dcac0352b27245af703034653ce796d54278051139d5d2b2664e89a5eb10616362b99c6d6560db973b14470048e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40323adfee59a3ec7a3b5e2318b6439a

SHA1
cd67ac7e463d437f6d15fd91690805be1a3dcf43

SHA256
27ac5835dea24c059d28556f16d7f721de9d6ac12e3b39edd3b77bb8b456340a

SHA512
1891b2500b0830ab35c5cbcc8aebe74ff5d30229bbb666c0f509521b1550fd1c95add6b4c1a8f06bef06f24d5dd8ff4f3e7abd1cc6ed82a0d9f77696aaadccae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b6981919cfb187dfed6455f887e8198

SHA1
fe7fdc404657cde77386b780d59eb29b17be4da4

SHA256
463ba5b9df28788f90a14277476c2e658ed4ce93d38495fcc8cc5693697c5d52

SHA512
b35293d293ab087eac31af16573fffa626ddbe50a0afa0541a1b3e89973fb7443725dd7f63a677d46b89df85057fb81fe0ef83d8b2660b3b7434a141e2b96b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81df7e9ca8154cccb490df1357d4b62

SHA1
1248f8c5a38afeb2230d628bc0cbe409204588cc

SHA256
8ccec98281a5059c472b29e39cb751302f55e310f9886284dd0588a58d10e952

SHA512
74362dc800d67f95d77af056863db7983bacb74c6ff86dda7e288037a53cb83a288c829bbaac1f4dba6196d5b3bf9a71693d7808a667898acfa0dcb823924768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20BC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit