1fc65d524014adf178b26b6628980881949ca669d9a30610774f801d63630b54

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

730e30ad397986af0132ad5ef1840a38_JaffaCakes118.html
Size

60KB
MD5

730e30ad397986af0132ad5ef1840a38
SHA1

d56848e49fe55f1d93ff708e0f09ad7ed2421d64
SHA256

1fc65d524014adf178b26b6628980881949ca669d9a30610774f801d63630b54
SHA512

3fddac8718528228cbee932302145d7f08f01b5196017653c8066f75d4adb15038b711bc31156f800d5e6eaa3aac6c74bd701bdae8de9dffb194d78daa732e5c
SSDEEP

1536:O8zIOVtyGuk0leEvM6e/6UaEVNu/yWKv9rCX7CesI0sciV/P9Z1I:nVtyGBSmlVNu/DU9rCX7Ce2sciV/P9ZC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C228641-1ACF-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422828287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1632	1656	iexplore.exe	28
PID 1656 wrote to memory of 1632	1656	iexplore.exe	28
PID 1656 wrote to memory of 1632	1656	iexplore.exe	28
PID 1656 wrote to memory of 1632	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\730e30ad397986af0132ad5ef1840a38_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
8df6dedd4dd10eb8211463f82b129e29

SHA1
ffc6e51cf829b481d789d8e3e61f6c7096fbde3e

SHA256
a8400cc21263f2c44ccb301a3a1ef66a1ff009fd4d301362fd778e7b23a386d8

SHA512
25fd6d8684ff8db3d40a8fe33267fd01d6456a84f81c7e579f7508c36558cf731a0ec8a2999a539aa5c1985dc45f7bd20d2a14a343b2326030941858f24c57f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a789e7261e711ccb81fea924a229b3c9

SHA1
191a9cf3951ce2701cef1d158aadcb03dc14e768

SHA256
438763e96dff5d510e0f5114fbcadc0e0c1b0f3fbff23356409f82bbaa0ba18e

SHA512
245823ddd6ccc2a4af2a7cddaba0e71e4523d9312448fe7ab8f6b1bd1e29bbc187410765f1a06bc11fef030dfce6bb67b8da42cc764532740bfc2498de9ee10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d9988bf69ec7d6083989211a7d2270

SHA1
ca0cfd0ad0e5837baf680c3fc9096524c93c4dd6

SHA256
cbd2ea176aa86f77a18d60edd250fe321b3ff9d06f8b038779e7080a991593b8

SHA512
840adf6e8efeff5a82d35d73e8899d7539f604471833d39b5a6c8d0ae76f0d5842712b80bedff40dc6d2f74dcfb6457a4ac8fab7f8ae384a8e2a90ef031761b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc0965a68d46edc45800e8f75a1b11c

SHA1
a5ae2c31acb2259b19a1e454016cb46c2d39ec02

SHA256
9344d377e8bad058c2469e870317ef0ed1300967d8f45540896c7e923da8118a

SHA512
70b7851cbcc2b8232e82449d5ab6c20330c70d44cc076bb96d399137b1d8aff37eadd3173c68357d517d745890ab5f945a971d977a9842464a8e1c10974e4c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66f3fca50b26b9759b83dc5d5b3ac903

SHA1
aaa5570d84acf4e6d71dff12c110bf702cdfb689

SHA256
ed371277933b254acc12ba7b4c9a3dcccb1cffa3d8193832c0e82cc453493fe4

SHA512
cc39616b9cf138df0c0aa27431f596b33033ed37c06d09a1b4f28a3cbbd8a760559f309a4051665b9dfec60a67e5d4b7e0f817cc75eafd5d519f1869886ef6df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dae34fb739671194f21331b11b4dae4

SHA1
48f8539a0010782f1e4f5e405d6b5c8e077f45b1

SHA256
5a8dbde6c308f5433d034c2c64046f6a027923b5075d24b0d741df9095981c68

SHA512
66268758782693475f317856111fbd6e42c63a1c10539ab62796d39a054a5e77cea3a4431ca8523c7832ea7adee639df47a5b76f2105f2bcab33888a2e91c4f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f853b13d121715d85caa43f443146ad

SHA1
cfeb90d81190391ca7941e09b577b06b14f9a79b

SHA256
4e26b724220b9d673f85d8ca8c4dcbbaea00bae9db5a7e8df364e0bf0d4f5c6a

SHA512
2b4879396c5098b1b6cba2608007acfe973ef95d62bf60573902f1e497ae4fa1dfe188510f110267f5695e35e4ba1d71d65a2ed12bcb63baa01f75a19f8cc011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0183a003fa5b185614a9878b0c6dbc47

SHA1
0dd6d4e40ab6d7852d23439a0e7e02624605ca58

SHA256
68b05d07d5b65d6e016fd07dd2a7824c2b4efae11d1224dc9f2b034e70962f9b

SHA512
14c78696fe368abd4464f83efae381bef9af34267f7b7555eac356c3e3038d34988da00006700298347cd7c814ec264b72ead2f71ecbd0f14f8c73c2c4a5a46c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3bf3cd7b42f81a9b78624b82591e52f

SHA1
99b6794117484f693e06447cb3f60e666f488bb2

SHA256
3239f2fa8f1cf4e170205bba7d98c45ee554b40059c44ca6d3bcd98caee6c93e

SHA512
81be55c5dfe89696f623daea90e647870c8ffae6a398eeafbef942c1f2a4bb3d25f66a817f32e9c99ef071adec803677c5a83bd0735930f2c7f2f6c1ad32792f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26814591adec04483ce73fe3367900c0

SHA1
5bf8b7ed0a9b9833ced6a5eb0a6a42c8a14d820a

SHA256
cb07b49e87e7699cf76af2a02394c5038720bac47f6437c37e9ff5b0d82c385d

SHA512
9b5618db23fc623aa0a3c11585855a8932ce43c970c34571ceef51b2158bcd30e1b838579bf15e0d26af5fed982188c0a0527ccccadbd8e5db6fefe7f141319e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01bc3f1af5f166d46a0279c7e0bfc99f

SHA1
1846734d551dea03f6d3dd926769b7d61e5ad0e3

SHA256
348722b461cecb28694d90d5cdaa1431b950e9567ee8f0425767698f8195672b

SHA512
0c7a2dfd4d61a0bf965619a3d9b7d2dad07d61c864abcb34849022ab6fed66bd49b03a89a2561fac0c533a23f702fa6363ebb7d41a061691aa0b2f614a13cb9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c577095c04d3ee87e311fb40545aa704

SHA1
768ee20614724780bb7896f905276a4ecc107b6b

SHA256
4b53d8abe1d9e54d8fc0923422f66716afc435a3116a5dda0e5897a40ed95b4f

SHA512
57448d921d7808d7579bd172ab26792f5e6a696407a1da29ddd1d5640617714d243a4d321071c7fadbdbbffa8a0e353f2d09b0832b8d26913ffc2ea6280efde1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb16ed951e7cccf73f1cab4e23cac76

SHA1
efd6a7cbdda3da0e6b87ca20c7b263636560a0c5

SHA256
b02bb581e65614a61bd725bdedb3ee9ff847011728eee21dd8edfdd6c4b19c51

SHA512
4a2b6cfed0e90bd5db0f08bd9c1afa8a97833e610be1db6601145848fd7740e139db37cc2afcd1ff948df53b6a96907f31b18b54b85be59f5e948d9981a278bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1056334ba2b77632d2e75673a9640842

SHA1
a21c53061d35d6d48c5c12d1970b0d5d89e07d26

SHA256
304e55909a6c597c7ec8e327f15e970e318902898001625803521ad3d94391be

SHA512
858b473ddfa5adf9518cc07903f5848aeea301dc48ff5d9ff1cb582503d433ad080bf3f2ced2efeb970e455e2dbdce61e83de65987ac4bbf82e04877987d82cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2204.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2283.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit