78e789035d85c398a2e90a074cd06806c0ff4e8f9f702ab9f355123e1311b1d1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

712ca16a2985bf5b1659908312dc70c9_JaffaCakes118.html
Size

31KB
MD5

712ca16a2985bf5b1659908312dc70c9
SHA1

fa16e5d9e1de48dc85ae62b64a4b91dcca6d9f6e
SHA256

78e789035d85c398a2e90a074cd06806c0ff4e8f9f702ab9f355123e1311b1d1
SHA512

e7106cd94d3fcbe741590bdbb0d5802cd6fbd4f6aad8b180a2dd66b7f2c6ba563f20f70e6a3c6b2faf9aaf806185f2b4fbd79f807084109f21c1b085b6dbf61f
SSDEEP

192:uwjxdb5n9nQjxn5Q/ynQieJNnbnQOkEntCUnQTbnVnQmScx9E2Y8e3FjbczyO5nt:wQ/EbxFe3KE7wL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422781778"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{433211B1-1A63-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2072	1712	iexplore.exe	28
PID 1712 wrote to memory of 2072	1712	iexplore.exe	28
PID 1712 wrote to memory of 2072	1712	iexplore.exe	28
PID 1712 wrote to memory of 2072	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\712ca16a2985bf5b1659908312dc70c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41c82fe0ef71f33eb201ea1c62680ed1

SHA1
041d9d3266402309dd63b69c0f2c0010b4b36b6d

SHA256
27ffbfe67559140a195479bf9b71cb901b577e10551e7775fd777bbc0129f354

SHA512
7c6f9bbd58ca1950ac059dbd4b56ecd6ad25daddf63b5e31e6a6e3a1c134270139aa783419367e04fbf1a15a72c858c815580cf01043a1fe69b4bcd9d659d14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
820379fa46e4b32444faece31ab61f2a

SHA1
cf41e8b46a839a1d303dd6aacb5b1800d41aa170

SHA256
793b531fc2021d451449c2a852d104fe05fcc991659865a203a71aad81500017

SHA512
1f7966349c69b9f341f55683f1143df2e563c2d6d7fe2872bcbf1e8793be7acb02e7aa52418257bded127d3cdf13502404c8631659b86eedff07b2ff2a809d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90afb4d2bd817df456d1853167b13b61

SHA1
e0e0a0e2f0da7178af1481c267159335d413d8eb

SHA256
c656c900d62488a478f400ffb5ad86d35875b934cfb71df8e1ea7756653bb5ef

SHA512
91d7fef415f7ca51dad3a20bb263c44604fad74baee741d1fff816aea80f5ff3484cfcc69ce2ef214e4fcb267fec7d8a5c56a507ed62849ea679b02c4f7c8b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112ac0785167754f491a4f687d407d9d

SHA1
a821807e68f7df98718bbc3f77dc97288975d7f4

SHA256
efeb2fda5c68f33ed9a84cdb610865e10a0c7549bd40778c808a0df6724b27b7

SHA512
606bab38256a972977021538a5c6427772052767beca384bf2a3eda115e4de8ec085a7201eedfc3d2f81cb09ef219e7131a3f5626928e01fd6bfda883b333bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d6d9d9b6d699571f3a90d75dbe8a46f

SHA1
3cb0bc4442d5a5f9151a88ac77f0c682cc135f44

SHA256
3f17727b1e2e18e96a6eef643f84e7f3d2147278628e14182f358bd9cf024a50

SHA512
375577f5fecd90b1792925234c953f7b6abd1a0862ddfa9bebe27d09270634f9ff3bdbed62669c1b0443574e01b22a772e34c17eada8262c0ce6a32da688c530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a56dcac483ab393ef63b83594390610

SHA1
601b71459c165fe9e5717935705ac60cab1e1cff

SHA256
5331c670790afd1141aedc0fee8fe0b3f7a37da0704cdbaacaa675f1e6063936

SHA512
5cc9d508eb89a3a642f6a684150e4b33b204404d420e6de227c2e0fac8844223ed95a5a2770c7b3a4a814f561bc3dde05eb13c9f0e6d546e72662d2416d83b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59403cfb6b5525627e1fd50753c71029

SHA1
fa15cf84f91ffb15950470add09e4219c23547ea

SHA256
aef7d57011ed278653dd0b9a7c76799ed8637dc4417f1360efc7e743e4813239

SHA512
32561e3ccf9a41776af85871f226e93fe1442f026c163d9859ed6e51eeaf8811037b0e9de21122f9f794bfd65d41536d82fe26a3e6c6d7cc931ed2136cd24189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf643dfc0297710731dd6f24b4430701

SHA1
964df3c4d5d2eacdaedcb5d75651444dfd85e780

SHA256
1cb2161880fb2d8a8f0b302a56d3b61533e323ee9aa14b18651e9abb7aab5b4e

SHA512
03f5e7058de4338b882c985ad6fdc50811f1dcab02bd060642efe42227466a276ea6566bb4a6cc489a93edc242cbcdf9ed375dc92136a73423fed2146b71f59e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92358bc26a15d3ddd60f16ccf334b79d

SHA1
60e94c1ee0f25c2ca64d41361a7fd598694bbe98

SHA256
bb10433bfbe076c692b690415c69c51eb40ed522074d9556d61607bc51ca6e2d

SHA512
40854f1b872dff85e2e992ffbabb3b7eb7c390323081d8130dd385737c8ff7dd80c48011e64a5c4e12c4b65b1f2b5f088cb9024d979efe2fb8e386b9298c2fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1373.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1445.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit