04a77b773ed6c18bbbfaa8be2d36a5b1c1eb300a720de7184fe8c414c42cef6d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74a955af236bd9b39fd6a986b6f8c73f_JaffaCakes118.html
Size

23KB
MD5

74a955af236bd9b39fd6a986b6f8c73f
SHA1

ba142e00557c0400b394dfa11b277855e3aaeebe
SHA256

04a77b773ed6c18bbbfaa8be2d36a5b1c1eb300a720de7184fe8c414c42cef6d
SHA512

f82186863d5c1eb9aa91c319265c33130528db0e44b1fe2b1cd8a21b48154973864a64a83b3f263added04f862ca8c35754b6c03117dea59aea89328d72592ba
SSDEEP

192:uWzUb5nI2nQjxn5Q/znQieqNnXnQOkEnthNnQTbnhnQQCnQtQwMBKqnYnQ7tn6Yn:BQ/3ke

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422868292"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B18B8AF1-1B2C-11EF-B7A6-525094B41941} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2228	1512	iexplore.exe	28
PID 1512 wrote to memory of 2228	1512	iexplore.exe	28
PID 1512 wrote to memory of 2228	1512	iexplore.exe	28
PID 1512 wrote to memory of 2228	1512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74a955af236bd9b39fd6a986b6f8c73f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7148d43b5a1b9191b29cb28eba49e9ff

SHA1
cecebd5c0be4e9774b3d508a4f84b04ee0ac9d61

SHA256
4f1f13cbb89655288c82720e9af6c2f41ead36b0b922e8ac1607f00df6bb9cd6

SHA512
70b2c3b933a7829d4ffeb67e106f8fcc1ca74d724ea11c92d5906567df64e6354dc38cc057684d44df9146d402794a9002d57f873662444b3c7f78618a20afb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcebac3934299300d1ed076fa633e8bd

SHA1
ee7dfe2ccdb488502bcffdbbc8db2e6f45eef37c

SHA256
bde9997289d5c585f1b481c37cd4a3eae5acfec472cbf1b3203c69ca99095e22

SHA512
8e0d4d1fdee1b5f20ad3087a21fa7cb713bc0910a74e0b2a0e7a8f8492bf2cac9881ef9a0d5027d04531c17a9df36f81a62555a0fbd4153db0690ff161a0bf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b326fcacc4822b6f01b821c7b8f99b65

SHA1
a509b21d6c527d15bf941069ec31821f2949dec4

SHA256
40ab1f7bce21e789130c483813c67eb4a8b18c7e1c312041e53f3c516cbc2c69

SHA512
0daab79d7649224f05ce0c53b49656cb819c92dbeb250bc1bf90734e3e96561ca913ef606c59d5bf718023a9f6ec3ea36d3e8b773f6725783c39e3fb739f58b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed322731c34f420de83900017d9c454

SHA1
86de5f2fcfd69f8e0fd55d3ac0aa221a900c3570

SHA256
a18bf6876c86c25cfb279c9eb284559b8a2e92c5688b84caefc5c89ed10610dd

SHA512
974659c2c7ce8b9d0a2665244aef71d27ea1692030f2232d0a81e9796b8ac444987c75a180c3c477db6f71c54826a41e4d2bd376ba8a5437c749a4e0d2e89f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774ca8b646f9e3daf989ba127b705827

SHA1
e3bef919c64df556e1e9198a394b34071591e815

SHA256
3919cd5b4388a7c24b3db983f85977028165f564754d54098e2f982dd6480827

SHA512
b1b207657f756842f2f5b265b020cbb19d36c2cebf6e7146278af3464bc30b55ee90113db362a0f34d1b8f1a730e8fb5b4f07a102e8ccdf71fe19639a6d3bbe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb6751dc6ca23958e35165dc5870150

SHA1
c956b97b28fbaff68736d56ba0656102979e1977

SHA256
e1ad934595298308e7cbf9a71a906da7ba8d9e8a278cacecff02f53c83654855

SHA512
5f0300d2df06e556331c71804459656f8f1e2c9d50c7871c39e1b2ebe11490a2cc83467c76e303c898d2a6bfa5603c5af08b1a9ae77bb21cef2b63af9ed3bbd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aa8a646e9ae5f01425bc633288beb93

SHA1
22555e76d905d0131c9799345d333b4ba4576639

SHA256
aacff141c5f52db9052c5dae59ab6b50968c25b7fec6ebe599636cb11e9de422

SHA512
430db476ef52898962c4a11e9183470c12469b617040b3de2df3ca2f9822d93b19049ebc131d7c182a04b0d756610be324658ec9e5b651051f2f5ec064ce804d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc438e04541d15f23df4261ffc17631

SHA1
7e0bbdd1f2ba2173ffa72816f8e5fb1a3d14757a

SHA256
8b09358e2adee99469a8931e94e58108d4397ebe0b80bb420a2fc2b541922e9b

SHA512
4f627e9aa20aee8a0bde6a291084106e8235ea2dc4b595e2722c5261c2d75017cad3bc3af87a185276d87a684a2783590b786f678684ce3584fc0d1a49bd5e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0deef9154a0002c94afd0fb8877978a

SHA1
694c215a36c3227325fcd8a490e65a2ea8af382d

SHA256
f98207041746dfbbc75b784002e0211150906ce1cd462e2918c8af7fa11c9430

SHA512
56433e99b6eda760ed3ba23fde36a86996f2db7c9d3117c8a29f57066a332b46e80dd7c889f667edd31a6a2726bacd73946213d001575592fdb4162e2f330d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1112.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit