04780ba7ca4b8e1261d84297f19c8e4556721e218c2e2dcc1bcb561b4802aa28

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71be9580879635d672d2b0d4e966cd4c_JaffaCakes118.html
Size

23KB
MD5

71be9580879635d672d2b0d4e966cd4c
SHA1

ce7e9ddfff313d634b4d7df2fcd0ee6c2a6eff57
SHA256

04780ba7ca4b8e1261d84297f19c8e4556721e218c2e2dcc1bcb561b4802aa28
SHA512

ee19546faa37f60d2d89d2abc30d4a6ea462a1daa8d0439a2ce171dc661b53edc70819296050043a6d35850c1eed0ca87f4b77a7f7f1e1d8f1862a51652592fc
SSDEEP

192:uWzAb5n9enQjxn5Q/onQiezNnmnQOkEntcGnQTbnZPnQ1CnQtzwMBTqnYnQ7tnwC:oQ/BctC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F52C3E1-1A86-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422796965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2860	2924	iexplore.exe	28
PID 2924 wrote to memory of 2860	2924	iexplore.exe	28
PID 2924 wrote to memory of 2860	2924	iexplore.exe	28
PID 2924 wrote to memory of 2860	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71be9580879635d672d2b0d4e966cd4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84a6586b990eda8011e738237c3823a0

SHA1
d60745285ea1515f2b27be3a35ee0ad5ddc1fa39

SHA256
55d414d837d9a9a32d1ff55b0d76112670cc54c4a62771d20446a56c39bf0cce

SHA512
439b34238251815ed466e5376bf8c6dd1f0c7e06f829e850a0a78856dded989ddcf045a1adc9de4be307366d8829fc27f90ceb826b53885fbf138f813f84ca15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95475b659c1d7e5a65ca1c2cbbbd70d4

SHA1
46a704a9da112326615e8c7f606247190a2146ba

SHA256
a140ae73d9edd1cd0c02400bdd763bd7f37a098dc4485394f3cb8e1bb8310a7e

SHA512
698907d10c614124693228c685e884c803c19d14a8a175176d5465f111fa8c05dc031c13e47de5111e8183b8abed73235da51dd819b796fc8ba283e24142e980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf630bb3abfb88739ca278267d0b7d0d

SHA1
84196f1c2a337f574eb9f9427a9138899581b056

SHA256
0d5552b29d9462738d225fd114d05bc8ed3a15081a0b5801e770d669a925cb26

SHA512
060b622f6108e8ed2bf07da4f9aafd37c53800a132e81f5f43523831f6ddb1f8b0c971e301a7ca0306385201f7fb4e2d11c5df570bd7bc98dda58eac7fd5004f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119f3aad57a3fc6adfa82d6a154b97b3

SHA1
3478c62596ecfd1690dab9f7f033d79a6c613a86

SHA256
d17bd71c44f13d830d9954eb7e55edf3f1eb0f5b357523a0548b98bec7233fc6

SHA512
8eddf2f60bc2faa00bbdca934069f5f67bc7af8c01b9bef8e8128f39588b8899ce6ec4c30a781d29d5470592f95ad9aac1559dcea165a32735a3be154006dbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3639bce43b19e3f69a9431f879637d2

SHA1
10e1aca68107f0831cdb3bdc034f527a016cf9f7

SHA256
99b4c2e69d178e0ae1b4954428abde3363867db18715060542c0e6b719ea3dec

SHA512
aab30a38adb8b2a94ab48747b544d28bd40f813868624afd89b9f392bdae16753da723bb321f97053a5590654487764c86a83c7a8cc85940197c380894e25118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad851b52d13a3f921efde3f0908181e

SHA1
21f9fd228f9518ccf42f4e1f3dac241a9ad28123

SHA256
db0d625a40b07899bd6e99727a221d07fb4505f45c7fd786bceb73f31ce4fd58

SHA512
8e2e9b6cedf2cc39ff2f5a9412557b5a5b03981823e663d1d19010b905b82958565660d4fe53af32f218b8a9e83a1b50846670446d5023309597b73a475e9d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ef1c5b1645b864749afb0b3e2524d16

SHA1
d2b4f61235db3106e93a7e341de006e979c415be

SHA256
b4cb6f0dac50335e48f1cb337f4971eef2f8fc49c88a0a2f363aa0db5f8672b6

SHA512
cb8e776ac77912dda3f3a5eec8825a183b9da95e81360579b3dee7c2c3864a4825cbddb29125f7a34765fb6eaae5b1c62ca37c766c616e7a1d012d16dc4776cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33ae952b4c2f0ae497a05901e03081b8

SHA1
bc18f9f7c4ae2888a7c2e5a9505a2a1abf8c517b

SHA256
c31d1b1c85341748017c03be78056d1da5860536966ecd7f57a793f63307cf77

SHA512
9ae2888d5e2ab44aa43041b746d1634c304976235456a33d7cd5dfb2d0819af80c42b6746e086a62c26de7038ef60ec54f3b00cd16a10ee106715e9fb638e445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db005709ea5934317f35410a974cb2a

SHA1
598a01553ed017b8d117379117790bf8a30c9207

SHA256
b8e0f22194dcd4b5dbe81539bb4be1a8f7df7284a2aae9d614f3b19f9e51d531

SHA512
620439396c9ea5ac83d769c1aeb5ef613e94a8f38f6fbfd058d80ead45eb1ce05a53db8ec32449c4e721adde4c2554145e25cda40580af8ce61a1741e87d6db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511116d8111fe50f5f43fd1f19f0c34b

SHA1
f0cb48d6b4869d6ef305975ca480e3e96ddc2931

SHA256
ac0bc562e410a2016a09e3829787d089409ad9f6d7a7a13dc12276ce08015f49

SHA512
5f7326e2b03efebaf846370bc09a36691b9b0c72aab2e8f084a0ce0012800e47193050cefc8d5d53ac63631847ae98da6e106bd23055bce8c857067668378a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5430419b5b862396cdf316d1415f66a

SHA1
56379cd020c5e61712e9d7c11e7dcd434ad3a13b

SHA256
f55592d6f0837100c053313f361d6a5dfa096b83f6bc034c58f77cc9481977fd

SHA512
e9d7cec35b6cb2b31083c32df97688a3e6793512805bf892c7d4f39c41e9e00c92d226fb0cb586011c5d9b6a372c284ee2cc8da78467d7ce5528f0b1c66b62eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18D2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18E9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit