8ca23a9025b0c97760dd1f0533f50833b9c515d4c37a676ed5348a3b2d1c21cc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

724b8f5a20f07fa656f4967377a3d9f0_JaffaCakes118.html
Size

23KB
MD5

724b8f5a20f07fa656f4967377a3d9f0
SHA1

c1e4e76b90c520d71ce80d60f1b90b98047f74f4
SHA256

8ca23a9025b0c97760dd1f0533f50833b9c515d4c37a676ed5348a3b2d1c21cc
SHA512

e659c219ac000851ce9dab905e11558f8649231988bbbf3774c6365246ea039d0265e0eebb325d22f1b91499d86a39644d5969a03ada7f71619875767858a7b7
SSDEEP

192:uwz4b5neRQinQjxn5Q/MnQiePNn+nQOkEntoKnQTbnZnQKdjfvMBvqnYnQ7tnwh5:+Q/Pwj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{114AE961-1AA9-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422811759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2240	2288	iexplore.exe	28
PID 2288 wrote to memory of 2240	2288	iexplore.exe	28
PID 2288 wrote to memory of 2240	2288	iexplore.exe	28
PID 2288 wrote to memory of 2240	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\724b8f5a20f07fa656f4967377a3d9f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b0d5f634de365e9c43753e7e712137

SHA1
33ee065e79d1179e79ef85b6fec67a09cb5ad32a

SHA256
aba63d5bb89a3ae77c5fcc2322a0b265a7bd9304c775c3c91cd6da1c5aaf5f31

SHA512
6596df77c57045a543aba07d0d9a518eb2c4da17d2c88fc7a15c0a3f65b084a40591280ca040b7bbfd84ce6558c4f39ad40e4bb5ed1619254957a9d1a2e0cedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c439c35221ffa33125a4f0d97546ccc0

SHA1
8d40ace9e149e67856059de0f3636e92bf5cd792

SHA256
0ba46e2a730adfe1b3b029b5647bf1b84238a7ca3931fc84b1171f4826721f83

SHA512
b0633fe68bddc9288abbdedd702cb0d7527fe993d16875a54122bfb4e4301db427776779e3a1b4c1390bf5de552ce76857f682d56b6cc0bd71afb91d3ef460a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2283e016c49d3f63401a550405c4a56a

SHA1
c94af4f5a049612836042b43d8e1d8640002ffdb

SHA256
6925d093a0ec10685d882019149a00cbd188374e79501ac0c34110b50847b80c

SHA512
7c4831bd9a1728a28027cc45654ba6423e07ca73df867e130ee44b0461c7ee0c7b42e19bcf4d1b6431c75f426ec99117765ec17e7fe9fb58e090b8dfd5934014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c47e373ea51201531a7ee18ca3e22011

SHA1
f4513159a81b2fd68120a47e302c3939b521fa84

SHA256
40c81b71b933288b8abcfbe3012e7d27b946ba2c3a58105424d88929864f492d

SHA512
c7f317b8939b3dd3d8cf5370428bd914ddfc2f824676cd6d443cb01c4e9f3cdc39abab54632a23a8afe34d82721bba7dbc0b85676182a1d8b8b755a84e6f2820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a94a2a47d4d659f7c909380e7abde877

SHA1
389ba04303902a5efa4180a4b327aebf07b85b8b

SHA256
3189bdec1421495c15369edfb1a37b9b09e4de4c641ea478ac68047bd2ac0944

SHA512
ca571564bb0b6a26b66a67faeda54f015d5c7607ed02fe177fae82982c7a29fdaeaeba424b289074e8571f0f2519776aae7e3d15b155ea00894cac194d4c9e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b58ff27ffb221ae1cbf2d335be3c50a

SHA1
d63e297d2d966be80e7fec8a67f848c7dbde470f

SHA256
f2062c940d345e149af7f95bea8259e2d7e2fded097e4e446ff3e3cc886c06fe

SHA512
eec76246984d0b9f346e2f61c02693dc9be2ee35bb6d5a76afd223070630713ed377a431dab54c2a7d8cab9335e070a2904973ec2ff22060e4eb7c88a5118a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1734ecbded0f98909045ae32f8075950

SHA1
1a8da4e23dd59d42911d67d93befccf9af680c00

SHA256
39536cbf3ad572c58e3641dab85425ec27a20f5cae63e102d0499792f49ec9c1

SHA512
2f66a8c92feb827092641771dcceec4800f71370d4ff17cedef9d6deb43dc1c3fb8f3192a883ee3e74dac27b6b2149ed0a8e6f1f541d35b9dd18f983d54ab86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e04b23b242de485efca135cca3ca048

SHA1
4df7aab3cbf1d46a327af357af42dab398c22160

SHA256
b6de15ea9bf8975697db2e669c29499ebce427d275cde41d2daebbfd44b4d70a

SHA512
785e7cd7075b067ad9e6147f193c0e93bbc519d01f2d96593a2f0dbd3b98602e545bad253a80be25b01f9f4d9d0882f735eb3b222455877f33e5642b2b772be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5174d8476fd7f62406db334323fe514

SHA1
9102eaddd2d897dc701413d79d42d339b021f2bb

SHA256
5a3d90772adafc81b4319add9e00d6dbf9ca5dc5d58f1280a0cef7cabc31ee5a

SHA512
4f24853e3133b86faa84d5dcc4cd1256aeeebb7223000b5eec821fdad543255597381230cb1a3e465f6fc6e378eb3f949994c9a0727d37b5e807e7775605b91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c12fbf6d1c95dd2d946d2d37a9e2f1

SHA1
7fdd67091d9cd36fc7982e7a55c4d17fe9286466

SHA256
6d87f8f38bf2596f133b53f1782884b9ab6ad796497db71b5ce4a845aaa9e91a

SHA512
c1e54513300a4464d62d69e59943304d4c27678b1ae70848e32577d36dc7db3081e81cfbc541da51fe88bc1c946aecb0974abaa97124b8833b4343ceaf8a2e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9368247ee9c6de580b08cceaefa939af

SHA1
1d33809eca86b3553d7e73b0e6da9d9b0da474cd

SHA256
d41ff9f65faf68f3411cb368648ae510103873e047b2480b95bea77556da4704

SHA512
09f29e5a0610fca185e37f3ead36aaa7581c26fe29f6453e1c0df4852dc2982d8d64bbf8be63e563eb6e26376821ccefc6a5f5742a8af1200fa5abfe728299b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit