7bad25fe731b42ed769f82231be21d4b223242e2991275ff5ea80a5b72d90689

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7131ffc215e2b7c2f83af6de22f1f906_JaffaCakes118.html
Size

32KB
MD5

7131ffc215e2b7c2f83af6de22f1f906
SHA1

097e32cd096536f8ea405873d7ef8aab312b25d6
SHA256

7bad25fe731b42ed769f82231be21d4b223242e2991275ff5ea80a5b72d90689
SHA512

716c336ec45e61f07612c68edf0f3da18ba211fb44b4ffb3ff71be051134c22d8e5e0cc2e75af9dc5766d27441a47742905819369b0bd330084bd520d02f570e
SSDEEP

768:SxFPM2jlqPewzNb3eaM82fH2cXTrN6MEFEN3Y31FoykyivPfi:SfPMglqPewzNb3eaM82fH2cXTrN6MEFv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1A3EFB1-1A64-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422782366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28
PID 2364 wrote to memory of 2044	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7131ffc215e2b7c2f83af6de22f1f906_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1852cfa9e198385d6301104e6829329e

SHA1
ca4624f26bbe143c42cb4f685e2363b010e54042

SHA256
b62a9165a8a6e270a0d39d618c083990f5258524410ccb8053664654d3386023

SHA512
d11a33f3cfe877f0c5c8f838acad3cef046f54a6edb19ef8a51846f0da03e5ab10e031f43db4b0d64f93598834b292353ea7f0b28cb7605dad3e51d2b5c97758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ebe3e06e6b0a6f035a795db31a030bc

SHA1
1156783a51e24dce62b336ec12b3724f52d55146

SHA256
e2ce7bd337143473743589bf9ea072af64b3cbf9a79067eecc1c093163657c02

SHA512
1e5dfd8a4186262f4ee0d16b040a28b6a8dc0e375bcc03893255fd4d001d40ca35d33e5d9b531c7410500818f3021c999f5b84989f184267323365d285e603e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
282fe755153123f23e7e2989bd2995c4

SHA1
bfc888005d17d11c79e01317f8f944f603693c88

SHA256
d9c2142672f38aa662e487bb89ad64cc6f2b64dd39efc4cd465523d296deefd1

SHA512
a7f1bfd3d6b8a8a057392aa6125b92b3fed2954700ab2e47849844d3811845bf88c9ad44c4c39a25097fa0f9751dc2b32c0d16427a82b05af660a0088124e7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4db00b5af05ae44b8f2eff605e4d1d

SHA1
2bb83d121b8763f1a0eb067fc2c20c4ad713a0e0

SHA256
8cb45f19e26f71dde07a63a84f11aaaa080a27990c4b3ee3bd315250bb2d2ba0

SHA512
500a61bd92f7d1b476c749752319fea9ba49bdcba728b2c8a6500ee2d636fb5e3151ca5fe2c24bc8fa34ffc3cacf655caffc651ffa73a3d36245f956432e9286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d84e57a4b251f1e45b5d8e668e0a5dc

SHA1
1e2d29b6a22e72ff12bdfcc8e2f7606e5c349da2

SHA256
543c82c73c69b0addd00082df6f28667c114e9c11ecd1402b6bac4e0201e5ab5

SHA512
456c1534bc6c42623bcb865adff126505a2fbc0aa65a8836b04f53e9c51f5365b0fb5d010d78e62690f1db5d8924a141bc2a057f56e780d510cdbefa4a1cfbe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f33bfb29cc5c2b4056e52848e55113d

SHA1
388f7f0d948715f84131ed055905e3bfaf687c1d

SHA256
88513c2ba12614a4719523f2a7752f159422d4bbb7454779ae60bf75e9739dd1

SHA512
fbc5896a467a01a7775aa77aded9832db1d9c1f1b709c58f0baf412af8bcb099c9b17a383c5c5812e3410c84687c4231413ee9fb24ea92d88cc3567f284bc19e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c498e82e3fd900f2daeab46b688ae41e

SHA1
782b463e30400bc61aab7e17f9b208296172d936

SHA256
78d816c0019e4c89a18b51bb2e260412f2b9425c19a168476e598218eb4b4113

SHA512
04384ab2e8ff2f702140c026751dc97b84b15dac7ddb066a01ac3777df1aa0e9e94124ec6e36f06b42e8d762f6e08af104dcc877be18667b8f893146ebfc16f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c12b9e4f0b802b551b4d59252ebbe2

SHA1
b78fd4eb7118fce6a2b1b7dd348cd4ab51268683

SHA256
1d7ee8782e6e17e5a0627e3ff3709d9d70fc703287a3b721eb4ed035b53218ed

SHA512
2b7a1d94d2056968e707197ae6c4b0de0b072a310cd3e72e606a66ab3fd566399a7e170fea6de581d7de86bebf7cfafed23ca43a3dd79ab52b484d1b0f846dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a21233ea8be15a3d26e8054b2a1b50a

SHA1
ea986df86b6ab87c1e72f3062aff5d5133e34d41

SHA256
77d62543d53ff15a874c039c3713132d3b2509c6e4c6de2bb9a4e2d21d0bb3c6

SHA512
fd12cc3d817ba01b15f60aba33220571d43341acf7060c83a0a0a07dc91e3676927290608da709c747a7c4884deb56ff4056b3b76db0bb08073b909099995345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
963d3a74911c27ed82ea10c77a7d5e66

SHA1
2fb07e0b79cb00947bd5a3a39b941263601ebbb8

SHA256
ec3f9f10e6bb9cee060a76032b33bf7c4c72a20e0bc5f6b5e1c1ff5e99eac446

SHA512
61ea607faec63a2f3bcb0c2daf294572e0d127cb109369b5b3f7915b3063125545e338fe798ba94dd57602df7cc2c270288d22600ec8e6a0511bd24cf7ac51fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
62695f1eb7a26549edbe29f46bec5a58

SHA1
6cca7718c144f4ae795c96a796362aca5d73a1ee

SHA256
1178f52670407969361871e9111019ae984201c56753fdf3f7003e6514dd75cb

SHA512
75fd414b5faf82ee5e12fb12590bce67063ff8ae8fc50084d80edf54a2deacd1b733b6e4f350b1fefa041815d7cc2abbbbc8c2b57474975ea7373f29256d6c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit