83442dbac6ff6d7395b7fbbd39042a2b87519e50de774997e791ebecfad931dc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71200ee68609bae014eea94f61c1b017_JaffaCakes118.html
Size

27KB
MD5

71200ee68609bae014eea94f61c1b017
SHA1

2048f127352d278a169ee57ff489ce7325cce50b
SHA256

83442dbac6ff6d7395b7fbbd39042a2b87519e50de774997e791ebecfad931dc
SHA512

2fe7408d00cb442181eb7926fbfd063e3eec0c1aad7827c4517ac185e64e51d8103935ecc315e2c2e9e4dbdd42cf8de040adb5dffba290c838aa0c1fda925781
SSDEEP

192:uwZMKTPLILJDb5nU3Iyoc5AJhtkHTBnQjxn5Q/C3nQie2SNnMFLnQOkEntQrnonc:eQ/gM3drsSPoy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{539A3B71-1A60-11EF-AC1E-72D103486AAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422780517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2196	2264	iexplore.exe	28
PID 2264 wrote to memory of 2196	2264	iexplore.exe	28
PID 2264 wrote to memory of 2196	2264	iexplore.exe	28
PID 2264 wrote to memory of 2196	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71200ee68609bae014eea94f61c1b017_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
158ab37741187c220353ae0664149fa3

SHA1
47a116b6c5b283dc72a957af1a54eeb679d0dfb7

SHA256
90fcd21d2d56cf557148b74472bae7a4bd56da1ffd53b975f322d7925f891ff0

SHA512
745fe95a8ed12b70946574ee45b28c95b71b87986c2da0189dfad6531485868ade3ebea6f60ba2a33c6abb8afad5a80c8e5b19142b5985e1f3f7b86706160061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce863693aef750471a69388c1e674419

SHA1
4770086624ad4acd42af9493cf4295e1babb16ca

SHA256
ed40e345df3338a1229214d95009922681c68f9d4b43a1db89be1172c8ff3b72

SHA512
20925ea0241d0323fe668ce317e6d3a08023dce8d941dc3fa3cddd569629ba31616466804f45854a1b36293598a49cec3244ccd0e116ca237b0932eba34da91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195998c2b1d6dec979acabf04e56c898

SHA1
a9144b534e30933e8cf330a91f7003c264b6b8b9

SHA256
9c1993541933d91f740bfb6558864d4c8d89beee516210f62912cdd2fd995e03

SHA512
2a0d06a03bb785e38028c257b98750be5ffb50db564618de5beb82f3a949a878cd19f78cfb29ad300e71dcdeed4df4e9f935f49bef54af37f80d27ec452e7570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
319622b16e5ad118d5f329543ed45d8a

SHA1
88511ed9eb773d278276a5178e00327e6b38c15f

SHA256
cbbd62613f00609d68bdf7f16606a6900bf29b54c22e3b04b1ac9a19daa08a90

SHA512
d1c615f1b482ab4e17edd011afbad8e7bd6118db56eb9c1993ef259fb534f1d2088d2aa1f4285211be25fb01d9b0b814b4c544288551d572bf47788ed408bc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f491899b5f7502459276b545f49db009

SHA1
32707b3d58c62ff8b4844aff9a5183ea6589818a

SHA256
9625afc13bab6ef5b21b264f5ea306d2e6984a365128b60b94ef5a5629eb6417

SHA512
387039d19f71719bd5cbf2b3516ed32f67b533f7af5ea0aa518fc681f300564526af1499d731ae008524bfce7bd02c1ef17bc5d1978109672331e4edd1d49c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d91e912f0f0ce61898191b65388b3a6

SHA1
fe82525d23b4c2813009f3039ee8ddda0ccc25fa

SHA256
55a8776bc243ea8c1511191f33fbbeb4efa4d3c25a43b7dfc119c792cf980333

SHA512
8ed15b4b8e321e242bd86f006aa8c65631f9f2bfaa7558646f33a78aa06980af54ace67ed22691d3ef06eb01bf5c4305d062319ea0a37332fdbd510a46f4769c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60a9e30d605ff4026465ec0aef4bd66c

SHA1
1655c39efdec2549737b1bea6717638a599397bd

SHA256
3bc24631a2ce547c80d1018486bb5bd27cccd24b6c987afed4dd2b8695e8bdcf

SHA512
b32527883dc199454c55e04828971fbbc75b2c5c83b1d0b8c60b5519509eacd5d36233064e814ead7ae92de39a677043374471f0cfd3edf2abbfc5d1b8002079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749f7b1fd0b6a3858bd9bac28ed8136b

SHA1
d4b87a349e039d8aef90ad11d947ef01e94529b9

SHA256
3baae8083e25c6ddebd8b01810bd04cbe565ad8d601722120bbc9a28abfedce7

SHA512
8c2095fcee139f38085d784abe55d3fe3c0194fa2b4b752e9cf2781f024d33d035f6bb1848943e42ead28524d0db7a2224ce62b7695c7e134212a4e6d4becd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afbe63f8086e732a3e3a8145c227fb00

SHA1
30756d4f99fdf5306d0285383e3312e4657cb3d8

SHA256
7ab3a571bdaefa5198e5d41683adf5f4b4c008c29711869ee73dc541dca9e19b

SHA512
83947087243c2bc93e3ce14a0dd980bbe645acee01ec1a6420aba1420f1b7ef2f3f5acc5b02989bf8712ce1552de257527dd9a4188d820ac009def0292a0258d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
665156af7c7cbc0087c54c26793c0f2e

SHA1
e5c15f81c6e802b32b7dac54dbc82f27e00889c3

SHA256
3c6d4c2a6e6abe8beef04a2232d58be2001d977e1faca41d855555308df2cb1d

SHA512
21f86fd91ea940a927b33e730e9d95f7e1293ce466c736529251032fa4c6109fbd8f94e8aac86854dc6c61b7e7d10279c533fefc00c6f212b2c6eef2b97ff3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e4a67509353040b888860c1f6eb9a63b

SHA1
ebf62e12ee2b5e7549ac44f9afa8ec379ea5f6b9

SHA256
a59cd8f2e84d35515d6b988d7540cc5c949433179d36794d8d45ae3eae489681

SHA512
d9735029c7c0941a9d81ed401067bcc30906102ca4425f6466669759d714c0eadfd5b1f2d8a4c059b28fe6c38f1846e03c0f2ad2066b64df9de0f42bca0876bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC68.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFDD4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit