f0185dc1f62064b89e6d20471d657582af0bd278d7d579bf1922e0404a4da7f3

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74defe169e58b80916b3a60f4b52dc8c_JaffaCakes118.html
Size

23KB
MD5

74defe169e58b80916b3a60f4b52dc8c
SHA1

364b6ab627ba869de7981ab3bc683cce36a5d280
SHA256

f0185dc1f62064b89e6d20471d657582af0bd278d7d579bf1922e0404a4da7f3
SHA512

464d07004ca24e2e8c73ccc33d21e1605767efd17db4fadbf9a949855d74f2e5aafda8f8b531a307c29454e4db7283126cf8df503b016dd9158de63789030748
SSDEEP

192:uw7pb5nnKnQjxn5Q/+nQiedNnGnQOkEnt+gnQTbnbpnQ8GLnLnQt9qMB9qnYnQ7J:rQ/DPGyb+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1298EAC1-1B39-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422873610"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28
PID 1760 wrote to memory of 2972	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74defe169e58b80916b3a60f4b52dc8c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6335bc69aa6d379bfe537e739559385d

SHA1
9e350ece4c84be8bbbc77e782b53c751debdec4a

SHA256
b8dcfe467060623e702982926e9f952aa7efc284befe2b441746674f24dd7425

SHA512
2743b0cdefe5f1318be132380a138699cba76d1a091a046cee32595bc469dcf56dad4dcbf0ca865aeb07234905b62cbe3adfa9333f754b4c2de46dd2a297ac47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ca10261912e6c52565bf78a2de98363

SHA1
38e74dd301217fe4b1113c25990268f707f7d053

SHA256
e9b8cd6c78727e22b4c6109e81ad56336e984164820c84b86162cd7c8c1c68d8

SHA512
86476a30ca65f5a80de5e49dd83ec51461916fe1fdc718b9fa8d233ef45700403dda331439bc685d1ba11ce2fed6bc63252480903f31cfe18ea8d92314e9d0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81b99874d61511bbdd1d659702080eb7

SHA1
4203ac169fb3ca89d29d3b9a8b4fc77e3433dea0

SHA256
fd891a3918d556cef3a192de8b8256b0bf9ef90931e69779d856f3676de538f1

SHA512
fd888c711b6e354352dd4ade47f45db0f7c66214e917e5cf5ebe6d3fb978adde25a3b89dbe47629365455aa479ca2fabf959a7186b3226064e1440bc6fb83d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51cf59edc58d4c191aa78ed816e067ad

SHA1
8c392f443cd48a6bb8ca6adbe8157d39469dc330

SHA256
e621f0697b7da0241ee32fa89804a16e35dd82e4d21a23d31f92f569a4ef2a3f

SHA512
adda137d7ccd8ab89268aaa80357edf98d6120c168562a3ccd00ff231ab697a0e29ee918e19a4443b375ee3c85cce05df7f6760f6e32dcb3a77973907426e167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a97bdcf30841b028057c63b986c5c902

SHA1
4bc6a76212d6185748935c6750c5b00952cf21a8

SHA256
9f153e9b418dfcad2f3469933ab2f9a01f1b4efb219e7c840de726e3ab06c07e

SHA512
54a600c2f3adc62bb00b2bb0969f1aa11bc9c4c91920d8cf64f72e48ed73aefba5aaf4f4d15dad2fef267e15e4dc1f06f626dbafca67486a720276ed1aa466f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f9ceda8ff701965b1f870f76a41dd92

SHA1
acfb24cd7127de9d8e44f3825ef8ac41c32d0287

SHA256
dee0863da69b424343e93e4c1cceec490de72711935f80d6d7bc84c729409f60

SHA512
5dfd2c5bfd8d1612b66202513857c43e7b680b29bc4841528e6fda3a164509bbe76f1d3ac96088c2283ac21c883c89b3a51cb795473c2877502d41375f14feb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
277967e02813466c8ab9022def7b1d4a

SHA1
c63903e64f791b348956d5906a0e57386c81e229

SHA256
ce9d2cbe5070f4ba98db3218b672cf46e839971f7fad7cd29099d46489dccb5f

SHA512
adb9d07ed53b75ab6aaa56f4945f52529cbe4fbefc6e7bed33bf33c6fdb7c56e12fb05bc4c9c600bd2c42402dd596e17522dfe401a6b900ae385f4627f28d228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cff3b44e513b1eec4c4cd265c4a2037

SHA1
204c3fba8475d8d18bc4c586ecc18c02b6266c0c

SHA256
3e5432c45e7531c917e84ef99db2493a5df8deca7075d86ab83877c914297905

SHA512
445675f059bbc18b5d0c2fdf0cd8d722eb04a40221d342b7c5f529d1347b934eb0768ce709311cfe074176cd0706c8caa53a412e500a84f0536a70ce4a52303c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0429d7ab825d47a77537b5c7c3e91dde

SHA1
e0fc7474c8be7fece9ec1e8569d30e046dec1495

SHA256
efc9c3b0e470d12f78e42326c8e7a2f2a230997141e228c7bb05956e4fb38a6b

SHA512
8721471e50375792305a75cbc0f1f74dbd49c2c18e43830dd11e76c3ca585a025281277115881f4fae783e330caadd575f6e1c51c24be790a2679b8d08c5dc0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8804.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8916.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit