dec7b0371f7ac6f2e97959a8fbde62529dcc6c7488b3f0c459801f3eee0c3766

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71a8110b5deed03fe60312673cd1f5ff_JaffaCakes118.html
Size

27KB
MD5

71a8110b5deed03fe60312673cd1f5ff
SHA1

a1bcca9a22910ea61de157518723c840c3107af0
SHA256

dec7b0371f7ac6f2e97959a8fbde62529dcc6c7488b3f0c459801f3eee0c3766
SHA512

ea2bd8aab24fb076d82049d2e2741e5014c771cb944c85d2f87158b744bc8e01dd2d03bceed60d8d57df12bf4ed769113f7fbbf5daacd70b7b5c7a2e47de2911
SSDEEP

192:uwbMb5nJynQjxn5Q/4nQiezNnGnQOkEntoSnQTbndnQ9eL/m6unVXQl7MBTqnYnZ:YQ/4uheVGSJ6e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422794887"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C95A04F1-1A81-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71a8110b5deed03fe60312673cd1f5ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5030adb0e6b03ddb255f777d589a165

SHA1
8b4870b9c3e3330a4ee8c9d7be9d6bede7eb86ef

SHA256
c779246bb03a8a2ef0bc164cd02267858ed37d07b932c11a728441efa6d8e9b2

SHA512
df903c0ba71cfa744276def84c19b9fc8c468538ca4ac1c9b3254e721d7328c38c084f8c59af8e7500dc2a095ccf85ed674d03c30a8fb3f93bb46ed6f94d3923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b51315177f520a85d917cbc327edd12

SHA1
5aa745c069aae520c30b85aed842269afcb76d3b

SHA256
ee29db6edb6de35344a4255980374f823e9ae33420d010f4b167451fae881bb3

SHA512
3ff06abc32067641662df07253e087794848b9284eceae1fe2ca6d5af31d76e5ad343e214173af6dbc52e9cf350bfc830aafddd776c9eb2b311e2e4f51431ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6b1d72903d158e6fd743c4b329a3e0

SHA1
f799e45d6c2c092e5291fef67ded253963de26ef

SHA256
d537f0989ea9c4ae1981944fbfa096a80b5f5caa19e7070cb8215d893e646276

SHA512
38f9e7144939cad6d14b056adbe53f0c6da5c73bdc69eefc4741c7161ca2bfc7f52391d65d901ddaefe2306b859bfbe4cb974005ac95060eb1421808b921c7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65630945f685f08e1d003e78452a25d5

SHA1
6699cf30bd3996e5c66368d264967a779b3031d8

SHA256
deeda56b75a718a6c45501f4c6665a412fd51c72504e7806f658fa7b10e33b73

SHA512
7fcf8fcf996716cc23ceacc8c28d1c7b3ada5e9d8daf7a4359d70140820fb4a79a6ddb83a416c58d27acbd897c9117e80fb2601a784f78134fc7d85a4a9b0f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f86783dfa27bdf5c0b80b18263c63cce

SHA1
a7f8a72332d1d597fc6b772c6a07c8d0e39cec2f

SHA256
50f9cb297a6f83166cdf5821fb9406b1325addf6ee46041803dfc0c8ac5f2756

SHA512
e9b92b5a1c4df639caf332950b85d80d0645c004ec9bfab21ccfae37aa5f8723d9100a9403e068b08c60c5bacacad495d1d31bdc8c80c58cab6998be04e8dfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6b0adefdc99d681dcd869b05ad4958

SHA1
53cae40adab4b4a1e304fecc25c7e51c0adc5e83

SHA256
b7097f3f653bb693a40336f14f7ee5c299ed75aa612bde9784b62d2d7565930d

SHA512
eda7c1a7da1f5978996dc854ed594540dc10b9be8873b1e9caff756d06d94d2d28b7d78afbe2aee4a87b47406e47060adf9d59778695ea91f5da1d60590bc014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa697714b8ee4187519b7b1fb6e91e6

SHA1
7e7f936c93754c90c3d166a5028d171bfcd727f9

SHA256
5d05c258e344696a18de0d306d5fe6e502a671628706e3362dd2b64f9122bb3a

SHA512
3036cdf1df18f1635bd128acb181dccc18a5e9746679542ed3a264f70e08d659ed567b4b8102eebe124a7d98e7544fdcd45c768061d9d073a67664296b7efcf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20170b0c59f0017ff95e61c6667e0966

SHA1
bf35013dbec5e86b30cd4d2d1bf3bc8dc8edd896

SHA256
ccc3b3c3ea3e5cb43d2cfc5239d3e32544f676600f29cfa22c96f88684273a69

SHA512
37fe5b1d83bde02d34fafdc9ccdf882bf4baae369fcd5189fd4ffee71e9f0d514846877544b0594a73383b1624445e2d121b42ae3f7906c6457e0c29cd45d7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42081faac21abccd1b53985f20a862e

SHA1
0bd59263c2cfc358329bac1ac2a33ef131254a06

SHA256
04df82e7c3d604da180e2f804ed38bc2597e9cd5ef2973526cc5fcf64cb52cea

SHA512
b80a712898785cd753e5051c820e161175bbe5ee6991961935edef834b283d2314bceea910749e82dabc96bc3d3032baf0ab8fe8841f5cdac3d47cb6a6b0e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab540.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit