65cc48b03813ef4971eb0723ec202d7c99f25396b10d115191d95a1708522ff1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

729607c15431bd0124627706e38fbe30_JaffaCakes118.html
Size

23KB
MD5

729607c15431bd0124627706e38fbe30
SHA1

b8aa46a322f8fe26e82c975b96d37eb9b596d7b1
SHA256

65cc48b03813ef4971eb0723ec202d7c99f25396b10d115191d95a1708522ff1
SHA512

e65cb5d91b9176e00a17036664c1486c1d915fc54d14b71a61ff31ef47424438ac70d5deb531e61bbdad8c24cab9378c9e417ccdc29f18d7051ac3b3fe015eb6
SSDEEP

192:uwTmb5ncOnQjxn5Q/vnQieeNnhnQOkEntlxnQTbn5nQJGLnLnQtAqMB+qnYnQ7tG:jQ/jG9Yt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AD973A1-1AB5-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422816928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28
PID 3056 wrote to memory of 1272	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\729607c15431bd0124627706e38fbe30_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a46cc0371ce49e11a3f830cd4c0535

SHA1
1f4a91e22de6a2bc3362174bbc00113eb7f39907

SHA256
b64dcd16f2ae40ac4065bcb990c2ec40777e695dfaf8b48f0cbfd1afb0c01fa4

SHA512
b4e41e8ea052422a32c12c17690fbd8942db4fccc5970d8251656e9267ce8c38171b508d9cfba1f134b1f951fb79341d34aef2b2f79a810f5e0c3dd44820bd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb9118404a649b642c63a9198774d55

SHA1
3f8ed4fecbad59bf7958297f855913d5b9cc90d9

SHA256
386c6853edb4a8fffc77e88fc1050054f72f3f21ebf93d35943601bc6ebe85df

SHA512
d66ff9d6b518728beaf28bfbb72af36db92f80692586e3754ec4f64d86c266d86ed966f1b19aec5c5ac144d747df9629e2147ed2d401a17cb105d02720a8990a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410169f38df35db63bd9bd645406c0a3

SHA1
de8a4a168edbc3e572f1f037ced77aaf6da0c0d5

SHA256
eeb4b66332d7fde8bde714f7f617ac8b7fb64d974c0fab498a2677cf840fba41

SHA512
9f33020bd84cf65dc7fac16506e4e892b5b5e99fc09f361f6fdfdb9bbe8e5781704c97af9ac3906518fd3e204f048e0de67016db03f5afb042e0dff3ecf4a912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84cd322b7d2c45e45c3e8ebec35ac585

SHA1
1e19878e3c50e9bb3c47e643db139018519a2904

SHA256
1b944dbc535d92c8db7288e999af7a836dd9f9b76e7d4ca28b9bc5344bb6090f

SHA512
e13af63a72c9aa7afc9b90d8fc00f42de77680d1da6501f45a307686b6fcb20d0c2993e4d11fc39d1c72dbf11d4f91ca698fd1e549722386ad4cb4c9a2d77a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9baa32ba8d6c65e61a03ecd2035c15b7

SHA1
8e09ae678c23ee68ab305339ca57b3e345a5d73a

SHA256
9592e37176942bdda2743a104e2d2ed8ef36712dfeea0eeb32a100c9a452a458

SHA512
dbfc7c28c66da8b15110f310b1b6de97948b189501ede58eed16cd075ad485917aa49deb156b0051929ce87a8947377154457218a63fafac03bfef593ceb5cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c238b8c85b49e230e45b5fa8d3df1cee

SHA1
2378e3479a1e1a07f65e164bf0fb80431c4e100d

SHA256
c6182de1bf781864976190b2563c749c6f2f180e0d445f37c2bac8eecdd1e2af

SHA512
077648399fd7d0073fd7f29eafdbc372c35a8031eaa2254e306e4a1de4bed3029d5e37960d518d85644f2abceb2f726b6d123a4783c562fff4b2ad082b7627d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6c6c65f14584c6116a6c572e54a7ff

SHA1
32ab5d0745e9d04437c463ffbba6a67a5eb2c5c5

SHA256
a07ece233b5e7ece493ecb98c2011e800b035309f51b77f465be15ad2db0db1b

SHA512
1f758303edc46dbb13458ab4ee3e55bdb15fef6d4b253d102b6fe45ac1bc85eda0e63740c43b75e7b890e10cdafb845a6e1db38699bcb94feb506e8a8005af54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6d7a2f669457a9ca9db8cf705132c6

SHA1
0e05f6b904b81a5a5fcd3ab5d1cdab4e1cd7619c

SHA256
9ab85d44d3d4882c2e20219526814c53b12876e8f26257e2b5b60da4d22e84f4

SHA512
47bd792dba3889bf02c5c173aa10600e0207a0eaf20c0030044cc4e546bb5e88e64446a1ba6fcc92088d17b8942f30ccc0c70e19ff999721542a5fd5a3d6deb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8455736a10dbdc56593d9af705b7952e

SHA1
f63e6e6e74dce80ff8bd7c381053f98f83c9be4a

SHA256
dae676c8273e80d4cfcc86d32a05b894b55be94bb990784636a31c19d5729e89

SHA512
d6c7eecb225dfceb548b8325c12367515a8daa5b1d78adefc14ff4059dcd7d3d1da592ea5d9eb11f0854bdad9adf7fd375d6f6efef8129537f9f71e0e290e884

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23A9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2409.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit