6aa7524a33b9fd8549b3ad94349650bc6b3108f7fe72b5b33406a2049da40293

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73475848b914d550547ecb33500d5cea_JaffaCakes118.html
Size

32KB
MD5

73475848b914d550547ecb33500d5cea
SHA1

75fba2c7e3973c89bce2c4958d80e467ba90f5e7
SHA256

6aa7524a33b9fd8549b3ad94349650bc6b3108f7fe72b5b33406a2049da40293
SHA512

09e1c89f9c05aa5b8635d91449246738f71811e6519a9eb8417db131ea92afa3ea6130b56445dad5ff2c54560799a222028989a4c18cf23e028149d845604ee3
SSDEEP

192:uWfdb5nzqanQjxn5Q/CnQiexNnHnQOkEntaYnQTbnKcnQHMC6AEYLWPY6NJoky9W:KzQ/zF4I6P9NQt3j1OSG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AC6C881-1ADC-11EF-88D8-5E50367223A7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422833732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	iexplore.exe
1200	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2568	1200	iexplore.exe	28
PID 1200 wrote to memory of 2568	1200	iexplore.exe	28
PID 1200 wrote to memory of 2568	1200	iexplore.exe	28
PID 1200 wrote to memory of 2568	1200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73475848b914d550547ecb33500d5cea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28d0636e1cb1872d21fbf09c18bf626b

SHA1
e62e0e55cc9e6005a48d806f9d85ae1a0a9678d8

SHA256
43ab4ce7bb0aa175646235ed0486527bf97d1d89973dcd42ee59846b91efca08

SHA512
0405ab37621d9e1e60be365b9f1b5e1bf60522d9f1ee398feed8c1dcfa1cc1e9d7cfc672a9c8719678b048c7cb123590f72558d2e5a23ca4f24e0f9f46bb52e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaea65d91f84d8bec8f715e14b132327

SHA1
0a598bf9df122565daf88d22ba3b30d81cbcd7e0

SHA256
59e8f0865495d43ec2fb37544b7e72be67781d6645f17cb31cf7d4bdac9a890c

SHA512
2a0c5f396aa5258fc0f6176c846cd7a4ab0a4bc7c54b2ab517f8ed82f7eb9efdde4e9015860688b1f9522925d85442face48ab8ef12f4849f1788a7e9e30c1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e0ab0bbb28f75c41dbaa004dc8c3d7

SHA1
be94d212f8945cc658adc43d31291a37c327b704

SHA256
b95d7af4525e88cb5342ebb55240a1f319426d67e6cc278b4a05dc9c6280c026

SHA512
5ca0602647044ca0ee85a8f1e2a04e2033ac43cd84a121cb679ec8cb552f0beeca6a0f8bc5f46f208d5f8d5d1378aa9af6d9d375c33709dfc2fa56b15db02677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374f01f56e1abaf344fd7d0146dbd29d

SHA1
a8386a03aa581fc0dd063ce2e8a14a054902841c

SHA256
0513408ce3db039ac9f7d6a6f4e38d95697fb1a3082bfccc22b3062fc2a74074

SHA512
1c9b51ee9f9e0b0e01ea4dd0f57d5a26758bcc1b39a08acf2447d9fe71168068257c77e1721a6a416b7095b77c7d0ee15c97d32b5dd806055f4c0824a47586e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a444ba5be9832bb0daf3129eda6ecc3

SHA1
17324ab7cbb01ac1bf171c82b863bb1eed733598

SHA256
4998ed7f77065b74c8cc0293784f9cbe6f66385f451af7743ac7cf524d90694a

SHA512
f7eb73c2da846694e4ea72f0a7e52e1440eadadfeaa9504f87aaad58a43d0f672a418db58fc9a956b31bb7167febdbfb6cc9080b9ae425239bb00334c2208100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ea77b0eb4e6ae0f267330ca4839e0d

SHA1
8048b374965f596bfa002f3b562cea2c93ff1c38

SHA256
1023a3c2fb5bf457746013c7efe65c1585ebc913cf1df6875b68c032fab319de

SHA512
92eb12995dacb5212059432327a1c142f045fabc6007abe913d0f8df5e7a766014495419ced4dd93d2c7ed4db5e79b20d068f08371736d234e59400342c0face

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576ca2a841af808c166ad67c0989bcb3

SHA1
d409621a9eb77e10d07bbbd84a60185de0db42bc

SHA256
008215d9275d8ea730eec54b6ff8dc9147a18e933a2e6288522b8b6996c28772

SHA512
dd599e1954f3e0c57631e5dbae69d1b6e22342c69a05ce016c2919c953e0e00736ae041c713128e280127692d38166ba204204f0cb9a25497f62ec72ca04470a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96d46ae9b573121592d9c6aca79617d

SHA1
1afd9684a64ea00b8e0b1e27ae6c6f62cd577079

SHA256
8557e0ef88a9eef3010c908a466c0fbe020bcd9b6ea065471d0cb1844d68b2b1

SHA512
7d0a13f8c085c587f1aa0531a8b8246e34f186633b8e69936b8255c536cfacafe943dae4f0a99f016d3c8ae9047b3e2e4b5eae27f00980c4e13081b6f974532f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f09027ba1adcf7b38470bf870ecbf0c

SHA1
d1f35ae7cc779446251f3759bf3ea304b55f6d70

SHA256
71a0c44abac14fe9bcfab5e4e17a50d891cd36a7b8ed53efccbd09155d5edad9

SHA512
654607040fbfadda22394c3095e80dc5c59f5dcd288eed9b4342376af1f99a5e5309d63d6d7e64e44ededddb5f0945612f7bed2f1c0c7db5280f87a37395707c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit