26480cd3ab1090bec10ee51bb8434ee57cc037e95e51b0a82a385bc66c37406b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html
Size

27KB
MD5

748171f9b0e6a8f9946dcb876ae81f90
SHA1

62a77115862dfb01834f45f720fabc976d61926c
SHA256

26480cd3ab1090bec10ee51bb8434ee57cc037e95e51b0a82a385bc66c37406b
SHA512

819ffdf78cffb7f3df0fa4dc324c20dc0bc67dda403999d7ee90f50d5ac7768386bb26e31be4e5e18871a085b522332b6bc68cfa7970146738890929b362a4af
SSDEEP

192:uwXgb5nSWnQjxn5Q/ZnQiesNnAnQOkEntHPnQTbnJnQ9eOkm6Ahk6Ql7MBMqnYnC:rQ/o38qkdS2RC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422864284"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C9FF981-1B23-11EF-A4DC-6EC9990C2B7A} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3048	2212	iexplore.exe	28
PID 2212 wrote to memory of 3048	2212	iexplore.exe	28
PID 2212 wrote to memory of 3048	2212	iexplore.exe	28
PID 2212 wrote to memory of 3048	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\748171f9b0e6a8f9946dcb876ae81f90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd2ef10578c7795c412d5c0253e18b2f

SHA1
c78999653919f74646d3bfd6efe6bc4d9973e773

SHA256
8a31cceab5383c93edcda7a12695a8e68703fc0cb18b367a5462a314665945c8

SHA512
eedd7a5c33252ec61608a79ef119836ca7fcccc707ca2b8bc27a600872c3a039735e47dc807b76b3aa331fa68e8ded08bcb7eec65c1a1d8ee3f8a0bcaad721e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
080bc10c263f6566a4404bcf42063438

SHA1
3ce064bf5084db47c0681efe321e9a9b8f29dfd0

SHA256
6ca0eb0a0ae02581e6eaa174b5cd33e9647aef827d9f84b7ceb062fc5aac148a

SHA512
574195bdc1e874121584945a9d50459bedad73fe658a0473334fd1bdbd28fbd7d5085b9d5893d9aded4002f223b38176555e2fb1ee1272a3a3c884d5f1aa7ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc63205ffd0a789bba9386ff053ff263

SHA1
eab60210b86bf08e3dc219977ca3337881db8d74

SHA256
b36c44d3699c1fb1a9099ff9195cbcb49e348200b188c641ea2381d94b48f33a

SHA512
5739358fa5f58c8589784f3eb179fecb99b627854eb6c686e851ffebaf7aa78dae427c7ad0e48c359197ce53f79dab414e61c4beef93d170c8ce6e5ab85f7c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cda2435dd3ac51fcd27327c5630bbaa

SHA1
eeb0a85dcac2c187b477be16ac97dcdfda980f5e

SHA256
c66b7e16675d1aaf03986be6b3a110c944581ec184f3ca95c93e02b782b19a1b

SHA512
4ab7553837f95d603209ce622389872d2b1b38826f8b51cd449294fe33050f0e3c83718f57a94c49c1a6bf753aab438d4ef7d1e478402e337b92c331808f27e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212eccc3e91bcbbd97b7b4ab2686fbe6

SHA1
17d3af476d4aa8ac464dece78bd28ed1e01583e5

SHA256
4b48f7736787fc08fd6b946011a35776b32ae852494b797eeb5eaf035694eb95

SHA512
4616fcf9e5b1c8b5644817fcf52acd0a57a22f4bd87bce11d00ce0edcdb9cf3fb9160866607055a4790816d8426eff91cfbed1d3026fb45e09ce177bd84c0d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e734e7bdaa98956647e22b5e1f44aa70

SHA1
1692d8638c745c7eacda5e60050cbaad8a1160f4

SHA256
4488c4e86e6a5779f367fee4c102dde506f8685049df5aca924a20a1cdf3461c

SHA512
4841652bdf7d55f2fe0c4d46e50214cb43b3ec4473b5e9b19c36360935d4c36333c56aa66eee76ae5d2f7dc0fbefb669f56c9bfc574fa7aa43a0357ffdd667f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d6b9deafb1ee996843693a07db3b1a6

SHA1
4b68e0b282d466fcaf1b3d4033690526cc349b3c

SHA256
a937a2603ee8ea25f3b044f3b633179b475ea64227dece4917b59a6ad46489fa

SHA512
ba5b6c6e9a4991d278cfd121c364ac107d92357f9233ac423811833299fea72d884ee23b2ec9bfacdf165364d83d5b492dd8f16f68c37f3a263d1261e0a7d577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c739dfc9a1e9a3b93b2970f877bbfe2

SHA1
d12cca61737159bd80a454d26db702f72712f894

SHA256
e5618c437824557a40299a0eb10e3075943a662fc92d30e76a435d11766f9915

SHA512
994b36b2fbc4d4f9598b45164021dbebfdda96a83ef7761f0c4921f0578a0e9535f7758c0b2c40014dd7dbb15afb53af150bde71698cd7bda6658bd102a14df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9000b669aebbe747c3193ec8b0f4df29

SHA1
a9d3ee9315a683411c65a317764f5fa92d1ce41d

SHA256
773a6676fa21a6887a0a992f7339d40ae1ad8624218065343e9690fefc409bea

SHA512
0c64a3f075ce8f1f456687344a15a9cda72f630eb254c477833625607346c470a0bb3b63bfaeb265e46a0681d024b5d88961196cbbe3b6c7c9bfa6254a9e09a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1151.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1242.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit