f36c3ba9da2fc99f94ef52c5dc4814c1ef512184e03adb1ede71bfbf57e78d5c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7128056095f5924268c9c64eadbb0bfb_JaffaCakes118.html
Size

34KB
MD5

7128056095f5924268c9c64eadbb0bfb
SHA1

ee4241244408c46e25fb91c0e3801ba97f99303d
SHA256

f36c3ba9da2fc99f94ef52c5dc4814c1ef512184e03adb1ede71bfbf57e78d5c
SHA512

d9fb2a4b5159b0c5d00094852bc7142c1fb8703a820ff4af3f14cdc66baf0b86bf024798af19f20be68814d058f42d8b531db63ca1e943bee40d3bde3a369db5
SSDEEP

192:uwnmb5n+GnQjxn5Q/FnQieYNnInQOkEntT7nQTbnRnQOgRcwqYIcwqYwcwqYQSkT:dQ/jJoa5SkAvUar9B3CL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{150F1D61-1A62-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28
PID 1652 wrote to memory of 2184	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7128056095f5924268c9c64eadbb0bfb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c0a75b8b2030ffd78a260d652ef503

SHA1
faafe3d0d84b18d7ac6a47c9cd502a9fc2f4df9e

SHA256
52c5a1b0a06ced908e1fab45c5af3aa4deb08c61818e4b13dbc4a97452824c80

SHA512
9c7fde6d760c1a7eecfc9a8e89cb124becc4e71d916f45a22f54560e409847a5a675dfa5035120501dd3ef5340a6d81f5d80b558883a6b3443f1ffd9b63f702a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a615acbedaddf9674a2a9d517549aba7

SHA1
d97f9a0e0881f09c531853da5d018aca8ca35e38

SHA256
7f7c2cc4057629f006d0c7457f67313a6db8525d4cc5c4b79c08a1066e865c4e

SHA512
1a2522647cff978d63020c5833a0b7ad2c8365214947e836c62499dba6b572b776634831bfc2f6b0a78efba38639fdd94beb766474be65560fd21508ce25e311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edb8e35546a6935696afa209516ed9c6

SHA1
7915a26239dcb781f0fc591db301adb38325f845

SHA256
7abf26b6116a74b4f7daf25b2d1bb59fb24b6a38795b428a54f883b94e99ea5f

SHA512
20edd55fea99487ceccf5430019f467be44ec722f8882b00caa34bf13dadc7c933e2de0c0dae3e488723bd90fb6f5e259f25abc79c0a2bb9b54a354000f42668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87efc04f858ab8815b52d02dc9bd6adc

SHA1
7305cfcf30db524d8516e39309f75f53675914ce

SHA256
467cbab35b6a443c8e279543adca7094ebd97e3a1344c0f679080e105573661f

SHA512
01c964b494b96653b3c942ebf039f259b47d1b0b366676621b2964442803e8ca6f66497440de72dc07913d8111b46aab6608c6eb37980e32f1b7f2183ca6a7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595862ff886b054ab1baad479942e87c

SHA1
6d6297aa9679839f24cacae8a837b483429280f8

SHA256
7ee87e9f89976ffc285d3bde74c1c039518d16cce30ae437e42fc7926879dccb

SHA512
d89851cca85d32b31b4fc6b9b637a689474e214759725d8e8cc84db13736dc4eaf039249217512ef963a61576068aaac649afdf2e777bc3224ff1b1a1430e92b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16d0c9ed7998b995adbd8a241bbb0e2d

SHA1
6a5859f7641b3481fbf796a0dea886b8309cb421

SHA256
16a9426a16db97bc1238626ecdc7a1d87b6568189c78427af8d6cb7033da3f06

SHA512
b08d8a578c09104992473f40295c2c27a2bd7013d6e5456e9166e274c5128904d1025f4e04bc22991c93904f2f5cfef09c2e14feaffc0ad06f748104bb73a916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e252dee1c7e031223d3aea99a3a3e604

SHA1
0160c00304c2b54bae5a5c5782336d0e4e6bfceb

SHA256
7de4fdc1c5d95be2be1c6c1d9abb3827983bca86c31617e33e2d209e4559a7d6

SHA512
755854a4c0ee7ed6427ec5f71eb8870f46bbb169051444ceed14157039f6dc59e8a59244d92a9f91d95519a2dce76d1c1612626665d9a6716ef3acc3af5bf832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7316bece48ebdee310219c262664fa16

SHA1
b3891fac6ecd60e98e3cba2167b4b5fb60af43c7

SHA256
31f6e54276c70702008d84c58df4355afd0daf3c46f3b3eee09791ea8817ac38

SHA512
00895a4076c62880bad07c14b6901014ad9481a84f07019689c2f2c187b30e7cac015af722c01503ceaffb71714e8ebc0af814e056c19921b1acd6cae96cd27b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b03685125f599b87b8bc86a73c73d9f

SHA1
640ed7a2d0c12293744fc8ad4247ba95a74446e7

SHA256
a74bb98581caf475faebee91a4b9eb3487437a5b5c28e4c88b3410d1a2398af5

SHA512
3a8244488607f5bb410b5525ed540a2285e6308b31f537daab0e170ed280dba237e95b850c8991f74d5cb6326d4b652cc514776861968537aac34390ff7babbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F36.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2037.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit