e017e7826f9fec51c417e619cdcc23f5095fe4723822355d1a6ad793c5e31ada

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72aeb1cf27aba2cb6c6d586b31bd89d8_JaffaCakes118.html
Size

23KB
MD5

72aeb1cf27aba2cb6c6d586b31bd89d8
SHA1

cbdeb1e846ecfd4cb18fff3a47d3464beaf46d64
SHA256

e017e7826f9fec51c417e619cdcc23f5095fe4723822355d1a6ad793c5e31ada
SHA512

6cf92161484338d682ed6c9e5fb0bfc4c498b062d35718025f27fd5f32a3b67b6394366ff48d8191910da54ca00d222d8ef4b1ddc751493fefb68660b178b5e7
SSDEEP

192:uWTcb5nOmnQjxn5Q/BnQieMNnJunQOkEntnbnQTbnhnQ+CnQtuwMBsqnYnQ7tn+O:fQ/Wml4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9085B641-1ABA-11EF-8356-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422819274"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2112	2964	iexplore.exe	28
PID 2964 wrote to memory of 2112	2964	iexplore.exe	28
PID 2964 wrote to memory of 2112	2964	iexplore.exe	28
PID 2964 wrote to memory of 2112	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72aeb1cf27aba2cb6c6d586b31bd89d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3908fe08c3ba2e2238a4bde38be0ab22

SHA1
a67916817e667e1ed613ba333ee9a7e21d01e1c3

SHA256
a5ac68676ebe2213a85f055802bed90ac8ce57441b14d5fead8b6f3981ac5a15

SHA512
6a03c08b9b2373e5e672b1fee1c9d49c8fc4d0276d66d9695d8862dbd03e383034d223826189f3d78eeaeaa863eb562d2050dff5e8ca396378e6cc3402e1bb29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a805de47e67879176cb0298f01343a57

SHA1
25224ec34141480f3637fda06a063dcef1c08103

SHA256
af5a3af7cf366635ce4f26f7a3604fa67b43c50db5dd853f1f281b5290d84ac9

SHA512
6298fed3934a326f2b3a90af18dd852c027b4010626dba990b4d8a0ddf8ac5ee83e694ce78b78264f769810df0f7a09cae49cebf8a5cf51a7e0ae75c0d48450a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3d121a7ba2c45bf501131b66cbc5b90

SHA1
b992813fb87ad2f96f924037eb787de86dd54f92

SHA256
a1b7319f73d7d485659afa4fdb17cc8c7a18fc71d12073436570029d4269b9da

SHA512
4e72c8c1a6b8cf1ba87d346d07dcc292f4837e55edd71669c72953f61e2ce3f2015d0dd3c0eada90f03cb7356a04220abf1c8223e1b130bee54110c144b72565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dad14c3409d1314297a863675a8be86

SHA1
56e0e8ece360912f0d0bfd1f164d2b85a24242c9

SHA256
2884b36b96ffdcf3a39c1645b4d144c24356227b3254ae1972fbc1c2765bddf9

SHA512
047a8c560595bc172a8ca26b5bbd6868c424fd2ed649438dd0f2ac8b3ea856828e146be3408344a2f801e0663ed4c8c492496b10c54f6d045c3fd3ee48c596e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db652e41dbef5f9f37eae954d28a916

SHA1
b9ff768ce4c9a720e36d4b6881f31a8d845a12e2

SHA256
829caeabe4acbb76bde855b9aa01daa6db87828e645297952facfd1970615a09

SHA512
dcf4628de73e6317601325cb817314636eb6ecf14e18bde7343add403c4cbd905c6218780e50fb48e6b17eff5d9f0d0d260b47e155ec243cf9587fe1da1625de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76c1439701850e57505c081dd249d278

SHA1
075daf7f622a8eb0525ae0d8ee48a51e69c17a87

SHA256
23d5eca2dd78147dfde8773cf290b34af6648ee0ac43ae381d67c5ec48579d3e

SHA512
fb2621ad0d5dffc90beeebd42ebe184fb918194313a95207c84bdda0fb339d8016c451af9b88629ae9d898845feab8e58f0eecedbcaa557fabd0ebe5555ae80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b262dcc3bc135ab100903758442b2ae

SHA1
b6a1ba80b5c38a5194f6befee57eceb432cee3a4

SHA256
2a49c3943ab4e0e40003d759a0ac7cbe7ccb52323072e6173d5a8220877ebd7e

SHA512
60083e2c97ab03aaa0e490c0b52f96d5cdc3bfb0d518aa05d8045964e47fb1080db7d291554090e5e585e4e19f79665feefe54a7372da1458316313f7c3858ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed963102f5bb5a2f711a39991a2a9f2e

SHA1
f9ecd3639bb0726f2103ff936243b0d983c71fe0

SHA256
ac8a4a59f9f7993181b6f5bade0e5f9a6af45f15cb750ea8cc4173a430df494c

SHA512
36b317ba4886aa0c4d5ff0b19610f3b0b18a78a59cff3176e5236d069ee331ab3682cb310288f5e3af996e95caf6ff4fa04b8258ae9645fe748e2aa5b38e5dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afbbc3b418b42472cc7f9a829e9b4e7e

SHA1
62725e78e7ce6f3aa77306d8283e25dd6d001b58

SHA256
ad01178e2471de7a3a41a94e349811a498b7eeb7c3a289df962169e314289a79

SHA512
1c039051bb2aec0d21ed757d73483f71e79c86068bd1633566408b2d933bc5e612da5b1ae678c2b90acfa1e9fe0ca71c25aec414c83ed9d591c6c6dd3a5bfb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6db4285618c358421c8fa54428c7e0d

SHA1
03b645c2e8f75c94cdf097123b9050275eb89855

SHA256
15952ff172a7fbf70daef242d275711b18f8ff24fd63dcaab59b38cc44dbc579

SHA512
5f02eb3f83fdcb12a9192d12e886807045cff8417bc402a6ee20ffdc23dc78e96a15eb44c159ef49478b67f8f1012ceb0f98ef630c56c8541bf9a03b42cc810a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9747b34572a09bb6b66b9e12d7a38d29

SHA1
2b0081905cb44bf9b21f02c93c4e02b9b0a46d48

SHA256
cd963800e8e49aac2ec48c47edb1b02ed7ce4fdc83265b8e808d47ad0a83b1d8

SHA512
18384900f68e2ef6cdf0acdb484edfd773963ae1dee9842af75e7fb676a9c07e174c3068b70f12f637d595cb5f1bb2f229d6f72aef2e66ac612c4c608ade83b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE36.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF38.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit