1ba871267eec60e67d0085d081be5a8571445963d5b3c28e5c3a1970f03f9fef

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74bfac268ff8d092ea26dfb85b04d142_JaffaCakes118.html
Size

23KB
MD5

74bfac268ff8d092ea26dfb85b04d142
SHA1

cbe4cb666c365321393a87443b67e41015ada257
SHA256

1ba871267eec60e67d0085d081be5a8571445963d5b3c28e5c3a1970f03f9fef
SHA512

0365a0c291ee58be3877ce8f2a35ef007328518c611a4babf47f07c1630ddcfc7bad9fb8a14bff2c540809287785e81d63f82df74630167dd74eee6001785e2a
SSDEEP

192:uWfYb5nIWnQjxn5Q/lRnQieuNn1nQOkEntf91nQTbnpnQsCnQt8wMBOqnYnQ7tnk:1Q/l5dokq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC3F8521-1B31-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422870538"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74bfac268ff8d092ea26dfb85b04d142_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a707a5ae6ab69b46981f44f7fad62190

SHA1
d4010c5def4be17a4cefe4ce63019fc57e5b2fcd

SHA256
fc45c25486b045e3ffe23b6265021620c101877ac83da172b130f8fa6cd1266b

SHA512
6a53e22ddd6adf40aa68205977d81684126c36118d4b3c8d0c1dfe0a1a1f55f773342d3b61f4aaab42a92e4c58dcd891c82bed0a4740c453c6d754deb4a4de68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f6a84d51b4b4ab59596c6813a614b6

SHA1
72c4be01d5f6aa0800c241f01ba49bea81ac6d6f

SHA256
14588ef50dfe6c69befc4d74fe0c67731dc8e97f9adc0e55f4c48d02e09678ef

SHA512
76521a0a8c6aeb6ea47213c955f0dc79176d952476f4f6968824b16ddb5dfc554001ac9cbc04c1bb2037f428f38ba2ed9ba8826323ae0b4545c5785890584b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f4174deafa12870708fa4a559540118

SHA1
87489f1a318cf147abe862facabca7ab173d38cf

SHA256
ad26eb0dd103140961f7d8fcdc0c90a06ed72b22267481d17cbbee98c619da44

SHA512
f8ea7094938aad4c17c029d282f8c0bbcb4de299cf66f24213b612625b1fb1f14d7ddfc237bb626d38a68b9b0172bc1a336d5f8ec00b4cdbdf484b491c4bb875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2573d03e889a392873678ccea86be75b

SHA1
a1fbd278f8167eda0506afcac593561434700076

SHA256
fae3d58104e7ba25db7814c05be4ebd0da1bd877b2866479eba768b9dd358f27

SHA512
0d612cf59685e0e7276e23f724674fbb95e5101adf7d57af4540ff6b54af2aa4c641ca0a3d8c7b4969873ec596ae1c2c62b2d9469fed6cce0efa34e3574c2615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbceeec0335a437f43df46365c1205ea

SHA1
ac450d0c16e05f1b13c36a7d7ed143897829f7e1

SHA256
d6d6b4f45715d6dd62162213eb390992cfeafb823dea5731f4888f9c60a4a882

SHA512
760b038b5b1d09e869114749fac41aadaea398a32f8d9d566ca6deff74f36759cdf680536ec5323dcacd69981f4ba0b39de6e4c3401e9df282d2eb9e296b01ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daddc6036a291e0d7547e4ddfd9170eb

SHA1
53e38cfd90dd788817c38b61dcb58600077c78b5

SHA256
969e1ae382ceecacd44a4bcd34dee74c4282615c46607fe108ff0656fc4bc3b1

SHA512
be8a46de23b67cafeb438974d65baace57ad2ae0acb53dc8d7c2eaec62fb9fa0d845ddd23b98d193460940e49e22167b8f009f3f8a83069485b4d84845bbfc1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f67d59cd311164dc5447e7ede9606b03

SHA1
79f7418bbf6c474c6341e4ba7bf9a4368f6ac7d2

SHA256
7fcbe90aa398711443d322561ab3366ffeb49b17532e57c1b583810dfd28e341

SHA512
8ed57262f2ae05ff20f3b15c32a8c71bd185de4d3cc87dd577b31986b1140dab1c9073c6f540cd31029bd464e5a91d733b1170aded4bf9c6c1727f4aee6648ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba5201d1cd813dee3b64e78093bc976

SHA1
5140ceed47760fde562fa0997aa49ecd91d38e8f

SHA256
8c2c8b460981b11ec2267461d44cbe2e433fb955b7e8f54a6f2f5360a883a485

SHA512
8d5a9145f39b333dd72ea39674ddbd6c32b482b46c2624cda249dc74775281bf1b587dba4357d20170c66a28b0bf10deeca7bc3982679cf647b56df9f61a2f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b36827de3946afccc9f17bd15b42a70

SHA1
8b3ad68eb2a6c01404d8f56f4eb5eabaaf8e7fb7

SHA256
b2deea1e01e5ec25c3b580e22590343bc6c4440158823277d891ec55700bc5dd

SHA512
33d86e23e99bee5e2db7f06c16c8743d898d023a65002d40117ce1b09232b64feb803ffb400285359c201b2b61789350e1243ea288f637c78389866a1011bc67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6eefc5a4d32e9c0f476233db61b5f96

SHA1
f5e73a7b47932cbf2c6f9163516dc259ceca2793

SHA256
86c7ae9952cc36536dcd1c5631f59762029815b728ca1b4a71bba0183b7dd4f1

SHA512
5b2b8aae860ceebd149b6fed9603da2cccc35a66963cf5b72fb37249a7bd3ce0e0767e585eb9d22c79333ae1c9fc46c4b3fa6324f0f9bb3375a5ad762d7f9ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b489e8edcfb34444b1f2e844bc5f4e6

SHA1
3d9147fc3650a5b7ce6bc91d76378b8300788f50

SHA256
0015f49ac3b9a318e0a24be1fc45b88d76cc08495fd7bc4c564bb99a6b9daea4

SHA512
4f488eca4650edb59d60f4cc5ba179d3460672e6069270b6bbad7d375d8f7f396622b43b90e1cbab29039493e79978c9bf5334423b8c5b1008627bd41f3b60b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15E6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit