fb4d7d3c9d2ab1ab96d29cef75e7635e83ea68b9d9c6b771adfed5b7653b15ce

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

771fd55f042920aa49a913b728d6504d_JaffaCakes118.html
Size

27KB
MD5

771fd55f042920aa49a913b728d6504d
SHA1

87b1c4f74531d0dfd88d0bc978ce818389f33699
SHA256

fb4d7d3c9d2ab1ab96d29cef75e7635e83ea68b9d9c6b771adfed5b7653b15ce
SHA512

d000a81eb8778d0be4cc251966c592431b78c9721adfb0f6e2f78232a6160fe4d18951e8880182d32dd0060844c83d9304ebce88893db74d8f398a72c483f532
SSDEEP

192:uwHgb5n5WnQjxn5Q/AnQiejNnXnQOkEntImnQTbn5nQ9e/rm6uP57Ql7MBDqnYnw:wQ/Pu9+5CS9+n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74202161-1BB5-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422927029"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\771fd55f042920aa49a913b728d6504d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61c6eb74af7e472d0e9678759f9e5d6

SHA1
5a317daa204edc46d10be561aee2ab4c0cc8d65f

SHA256
26e94e7dbce3d3515975026b72a4ec3c4b4fe18509eb2715e4adafd4b4934de0

SHA512
b9713c7828ece7484b014800408dd48ec3428d91c8bdcccd22f7eb265e85d291526d50228ee236c8ccb589a23bef6d2146398176cb0a03f534b2264a4ebc5a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73e1b279c00f8f2640cc29a99ba1b189

SHA1
098f1bf3711783924ef83e1f36b9f963d5fc710a

SHA256
5a1c7f66fe4f8c4508449912901c9a4ff277f11cc4b027c9a0ebec2771950203

SHA512
ee0a42d625b1db99937897713fbf460cbf7b2a0a696216bc17215ee8c4c4bf1b68ea897391844731aa2166aaff0834ead6b46014c98356621df90f7bab4f1170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c777b978c7e44bb2a1ecf8133bf05958

SHA1
cc7b52a30e284d0eb82ca7288ab59c677d16d4ee

SHA256
8cc3c62385ea8df16ed8a52c8472d0adee78a112e537af19165d9190d3523fd3

SHA512
499bce4677cd5d9cda0f29115e1fa0d834e1354bfbada455d625456b825b02551a178cf5314e32740f63a94beaf739d27d77f6563108d02f0b491273ea89f560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e652d93464ee91f2ab07b8f5f453cbd2

SHA1
185eed55c552fc9aa27970d6ca6da958e8b25df5

SHA256
5e8ebbc1ef0fbdaa3e51cd442673e700720c781aa9ef52f01e6a3983a6a06317

SHA512
8d299fb6443bfe5decbb1f1a761a3d707e7a0607b7b547a03ff9e9878bf8bc61ed470958a7de42b3a202312d53804dbd3551051e102ad3a170869806f0800f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ef7b6fd1f7b244cd2d31d209c0c6e02

SHA1
950f65945199b4513f46370ad5e15355d63f957f

SHA256
f471798a3a4543cf40d9747fa8760f094675e7a72422cd59911a24924a25d0eb

SHA512
7ec298202f82268a2ea37a050178a9ee3c4a258d48c77b65612658b366540f43c5f190450ad6ac7ef35bcebcfb11d44b7e96eaf3f7cfd3e62f8e2d68fe8d0317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03391fb0787a315cc088c0a835421616

SHA1
8993828d756ed1008d36741d9ec73c2831c9390a

SHA256
56187b1fdbf5ed6867e4f8654b42f22420372877a0d443961699bf501714e411

SHA512
001f3cf128d6a497bd8b9c9b829323133ffa630666232c86b1168ddad8ab81e7c8377e4a62c4ea7057d4b2815daca3f91b57dc1eb410b66471b3ecfb1eed3420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9fd691867305a1bc2e524e6c0797703

SHA1
0fa87876baa318d06ede4904d4ff4a32de570b45

SHA256
6731ca5a76ead53c6d93dbd084b7e637c9126b5c946c2893a1a0457717d78557

SHA512
e6fa80069421cb9e64c19cfc56a04bf2785c42879c588449a511e6bb7be6e9c21479ef7c0e4815212e3bda47c9a81dd11dffd505d70ac0e716cd52b9b9806547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3432f248bdd0de0ff60f6766e89de0c

SHA1
3a75647c2f4b695c27c0c5ab3f9972c9bd5dc607

SHA256
e85f2e3c5f3d71177643c70a63c13aa799512053e4690a257db854c4ce95bbcf

SHA512
d237da9c4157a61c0b8cdfd174067ec73af87bd52d35e47836b4feb501bf310af386bc4128243afe972b3aaad917bb250da59cbbcb0ec05d7104a8b504ccba59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1feac7a7d1650df23b9da56b706ab259

SHA1
9c4a2e119a027e7d813a0c8c29968b641a4465bb

SHA256
764233e72b80ca63ecba0b7097724a7dfec50930addc052e70183534fa03a932

SHA512
3366da1e30767dbba50f5b154461f65e18c757712c8e317db805d7fc32e9ef1b69eebda593f2cf578dc32e02a7e6556e371cac2f378cc3ebfaddf3c2aedcfc77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DCF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E30.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit