2c9ec5af10e83064dfc289a388f9fb57b214d596ae3ba3efe90b6bf78b3eb075

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

742ab9dca7447be305c031df602fc6a5_JaffaCakes118.html
Size

23KB
MD5

742ab9dca7447be305c031df602fc6a5
SHA1

0749141d3a8e30868513b76ded497364c10dec82
SHA256

2c9ec5af10e83064dfc289a388f9fb57b214d596ae3ba3efe90b6bf78b3eb075
SHA512

34703b0e6be1585b4b51ef053592fea714a138d4f0a4ec91a6aca4d161f5ff8a582d560cfa7eb5b62f6b282a23df739f39600146bbdeba336aee3e1509155761
SSDEEP

192:uWrAb5nrA3inQjxn5Q/fnQieuNnGnQOkEnthVnQTbnFnQQCnQtkwMBOqnYnQ7tnl:GAbQ/E0q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B887F21-1B0E-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422855209"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\742ab9dca7447be305c031df602fc6a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159cf095a79bf59a08a2828218507f3f

SHA1
b0939b4a8870b17ad1ebf62e3250cca39387f30b

SHA256
e28f6ffb4bd9c707f4531feb783d9685956583012a62dc704e954d02b9dcf467

SHA512
2aa8544edc55cc4e9d67b62f9daad45548fa378cbaa0c5dd68d44a348d4ceb98c91f5c2ddf2f0369194d6c5783cca8cec6021ce601ab903e27a07f408a9f90d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc6abbe129804e848c46dd0df490aa0

SHA1
d224a68973e6fe20ed0cc61b4635c984b9ec0866

SHA256
f15bb30aa56827ab85745873ba681dca3cd3ef27e769143138b16caa82615093

SHA512
303866707cf2c84edcde599e19052c9af706040a1f69f94d23e5e6129adc562e4f6190f90f36b43e56730a67fa604a5f5a8874f7a53ba863e6195f717793a753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82af0ac80768faed15b05408c062333c

SHA1
d370448c20a3a1b8f8009db32e498c9843bb9b99

SHA256
ed30ad012c640bed909739a887a6dc80fbd5c9aeb03862e43a35daf9c34b365b

SHA512
68f34aff7f8ca0812ee209b0c471577fbec8d74d7bb0deb06368a1f1c10dce3c05a1416d0253137d67a3b3518aa44905999918ad28fab7c1369123ae12066c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b9fb1e66a6a74a2b14f88bff9e0e5f9

SHA1
98f6ea703bb81e2dc67a61d7cb148fb1e17dd724

SHA256
dd5537692f6664c67d8536bd927aca7cb16b46d40842ebb662546c5a8bc20d6c

SHA512
2726e81aa26a3b397bd9816d67ec2929b5e481d80d5e0c15a58efa1703d84dedcf36ba41a1df0b7af05f9e71f38572fdf4dcb2ea7793bacb76c7c3859719f884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33e0482e8e2267702107e0ea4b098bbe

SHA1
f5e008209b78a5582a18745b04e4a9a042a191de

SHA256
2d1e7c98e108fa28f6007855e16cded6b57146a355af408c296be09d66092d7b

SHA512
1bd61cd60872c8c3622414d0f4d87137b0a34f3212a0d1cc02bedf6d8ddca0b4e8f11a1fd42335dacf82d389e81285d4e91649f623a0a0ff75e02122d6f0e9b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e221674a628459fe6ac6d09d48e78bb3

SHA1
fbf9ce8c6b4a0dcae298bb109807957faeb87f9b

SHA256
b11bd552b479e379a5afbe06723b0d82e3a26d0b2a51c24898f7e836314a8b91

SHA512
698951962f4848bc45892d2c59747ddcf29a3ffbfe372ecdf807153a86c59cb90c7cab55ca09f63f9a4cde46109e34d1af1d088bd96fece80b323620c7727e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a039d0256c0c553e556aab8bd0fd4416

SHA1
31bc98353aacebcf940c48bedc6c1582afe9f5f8

SHA256
4356b4c98df5492338ff4ec1012f262633159fed7e798413030b66154b4670d0

SHA512
634157fe11628b73dc6de17d1e000c53b18a67b3846a761363214af62b89e2bc2a77b1a7c1a55e1297a7cd3d8b791978bc308831c52372781fcc656b732a082d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08660373b3751dfc0ac9351a9fde359c

SHA1
10eb4126075e6c23f888a83b43a81e8d2b076ca4

SHA256
c4feb526b168fa2d7b4b05d7a920313437be0ad241525208a3dc74bb39a56296

SHA512
d90cd7ab72f6760a08b33e942452d9723363b6bb375315f2a43e7f719d2fac738140a564b2930ecd5653db06106f79abaa71f9a11ca3913a7e6d4f6514e1bf84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff4fad5f90d84080dc4ed1f48ece4bf

SHA1
2657d73767af981c8ef330f4654c8a56af93e2fd

SHA256
3295c83378ec513b5f35d0901eafc56ff1ce4310b1bc6a30da373bf8e036186b

SHA512
c12eed2201679cd7f3e25dc265f57abefd0d0c9f568a1f4faf8b73680b4afa36605801e6a26a2c7dfa5e97c9e0321efebd99deaa2863ef8f61fe86b821b54342

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D13.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DF5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit