bf55d3331eb3025527354f9115ddad08bb8059a6b0897f099ad9f4b748c0f5a7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7479c2be225c7a60bd39b80760afa56b_JaffaCakes118.html
Size

27KB
MD5

7479c2be225c7a60bd39b80760afa56b
SHA1

eadd2bbdb7ee111e0ec3eae03432ef597db29659
SHA256

bf55d3331eb3025527354f9115ddad08bb8059a6b0897f099ad9f4b748c0f5a7
SHA512

056fea1cc9b9daa8731107ec1452b4d2f37fa2a13d1e10f1919a1c8a840d064c6188144699c7bfa980062c88c82a30adcbd44cb2d929347faf7668f3ba53e716
SSDEEP

192:uw3Mb5nHenQjxn5Q/mnQieFNntnQOkEntaYnQTbn5nQ9eZtm6unDdQl7MBlqnYnT:yQ/VgXiDMS/3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9537F5B1-1B21-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422863520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2148	2976	iexplore.exe	28
PID 2976 wrote to memory of 2148	2976	iexplore.exe	28
PID 2976 wrote to memory of 2148	2976	iexplore.exe	28
PID 2976 wrote to memory of 2148	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7479c2be225c7a60bd39b80760afa56b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5f009268e4d953931f8acf67acfe39

SHA1
9ffab2973fa85f7f20ecfa8d5d2dbb644329bd64

SHA256
514b9de8fdb51408f8eef1282dcd37f6c1ecc6edd1b082a1ba097e0255fcac04

SHA512
0d29cf688ebb076a2549edf30e90e3de0a06a271ea3a07e90f7c0f7c6b20dcf20bf8685547c69c3a9e8a9de0b5c2eae57642fedd17d7007795d255a40c9b18fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ab2d23d1de39a8111a33caf5ed8a4e

SHA1
22e5926c0e9a3866a65695cabf677cf1827d2a9c

SHA256
5fbb707a25237847ec49bcf361e97d2e9d23a86e51f04dfe0560dff574c02c79

SHA512
9a1068bfc9e412637d84fac8af8294166d4fd0d1cd912ba555f769423d5b9050ad4bde94ad607dfb779f4132cc87cc0d7026459e7c0c5a5936f883bd0ef5b286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
069d6a34a0dda845e8f9fc3bad376b2b

SHA1
3465232e3db51ccba941869f27148508b2773218

SHA256
f515aacb0c449327532d4ed1e6024dde58fadf767891cd98a7004bdd22c72223

SHA512
d72164e50d60d005eba05c55ff30e46fa8bd7a93642bfe6940006c28490251c41c1e3fe88d762e178a2b52c926f227b907b6388604c6a0b8a4155b4a2fce9b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
516b4abff5654dd89094aa2a00030dd8

SHA1
406bceda1854ecaa1139aa178814d7d8727471fb

SHA256
ece5cdb6b4d0fc3538185ba0af58c4dcbe0127d1cbdf3ab0beaa268577747f09

SHA512
cbe2f8a79ef503b0def068f5d884f2763fead0ab6fc07f65b25e4e620983c996872f90e53fe64710c5e69e7dbbf4dcef96b10f464063e40b4a9ecd627649a417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
900068ac1202d742fcfcb1448bc30b70

SHA1
48764979117145dd358baa97993044a2a7af5d4b

SHA256
6b82a8d2ad22d8664a7a154382bd16745a006cf7bf959e19651c9f18f65dfd9a

SHA512
80dafaee862a8c828b1d3e93fa67377e0b1cc98f6fef5a8769c2fc98642f5e4efd5620c97ea87faf5ff165d70b62b4c3c61685da7f1c34a60fc3f03699e9864f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14acb08fc287743b4f3cedcc6291a579

SHA1
15c40c36b1abc7c20f5768498b3efa74288ecae9

SHA256
e84dee1efaf21d27895173a4778b52fd4d5e475219a94b6cbcd0df1fe3347134

SHA512
9a9dadf82fc16299420c4218e9ab678034aba4c84900b960923e3b4c290d520b9d4acb484f1a7452af5833e6e3c80bfce315d4261c47d8c68d37cd443b1ba5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befefee518f7166466af2834ad1cc505

SHA1
f6366d3d4606b6c2bfccd80a6a0d4ace0c4bb2a4

SHA256
6bebb65ebb130055dba6ec8ab19b3c887f03045d6261b87a6fcc26fbaf61237b

SHA512
5e9bbbad751d095d3f0ab12fb74ec04b7c52658fa44ae33418cfa867e9243ae61845b229259402c90a8109f8139241027d5e2bdef8a2af0153ffbbfb0c14c681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb8471e90f395d7dcb87abffdbf370e0

SHA1
3890557a12a0a70e2efcb87ddf51c5456aba8fb0

SHA256
3e98503e812d83323a93d7d7efdf3023b5f88785b53f7db662f08ba62eb89253

SHA512
c386009ff0b3eedea2455bfaa3bbbd1f933dac0d56685c08f3dd0cc66e0aaabfd98b5950b1da52aa05580e6b4501180127bcb7474530d33488cd80c66ce9917d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e70a49fefe248ed50fe0e28a9c988e42

SHA1
42f249cb0ba6e1294b39c3e67a0deabafca1bab9

SHA256
2b30ed3307e1a4d9cf8148381e4f9b048c16203266c725cb97acc37de21cbb21

SHA512
c85f8025bed3c9e685fdf7d6cb40eb617970c80757e9689e5da3bef9636a685a43e8bd78e4246b4ee7949a9418190cce0fde22a24193362d74c61e6435615bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE86.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit