73ce08cd57a501f7b978fc9cfcce2680787e04c4d5e3ab687aa87ac17c1e45ba

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

752512eb95f08040e3f20cf64fab6463_JaffaCakes118.html
Size

138KB
MD5

752512eb95f08040e3f20cf64fab6463
SHA1

5a8206cb47e4fe3e987d2f073fe48dacd51daeab
SHA256

73ce08cd57a501f7b978fc9cfcce2680787e04c4d5e3ab687aa87ac17c1e45ba
SHA512

fcfeb3269115ece19abd0e1279f02077b172892674cd3955e6a65d11262ef17388019a3eab71ed7d30618dd04701014065f1b56a13c2ea41ccf82288a6f1fc81
SSDEEP

3072:SxQjHytf5A9YXA4eyR/5FVuwsrdCEr6kfPyXmT:S6jHEbKrGksS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82866DD1-1B48-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422880239"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\752512eb95f08040e3f20cf64fab6463_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2cdeddf9178adc889ac5c332006f7a

SHA1
c058799e829d1e62a704c5bbf8d2bd5360c63dc4

SHA256
2eddad369172011e5e075c6b66380d576b81aa21986d05fec616fbd9f5e3e28b

SHA512
c6385b72fd9651a842c5f34fb30e8fe6284486637abc2ba5c383daf037cfa1fbfb67a997ec1c33927a7a684c0c09aa74211df5e256ce50d094b5ee06546e7cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1debed689df4866f8aea9920dc0ab4e9

SHA1
a5bf9386a7fa07c6e5dfc646f5dff5db86bc51b9

SHA256
9ef459ef8cc740c0d1500df973caa3b59c2f871f6deabc8c68c107c2f555175d

SHA512
dae6ba1382ab7a3de8997663c4882a4cf51657658ac0243dfc98c4b1f83187f792a83473ab151dab40cedb001a782f226202fd0150a035bc9be0665ea72c205b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90c8d5bfa78a2c516f6ad8b68476b518

SHA1
5fb047a3c41eaa2c0f017e6d34f422f0b7f79c91

SHA256
d86c1238585517a98b778185fbd9d74b0007f7079f6414881ef9b6cebe26ab06

SHA512
ec1460123d190cc87432a620616946ccc89e7f970934a876ebffaa57efc51738ac4bdf4081a24dba1003856c61d6d290394b593ba6d477774964805cf53b79e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce9e5cd72a6915a7ce3bad66c33b25e7

SHA1
25c63568c1073bd40a110d15db008f2f47c6eeb5

SHA256
fa280e1a247e3ceda189c471d272f7f0a73c8c31590ee38e9b6718fed9af2c83

SHA512
31fdd376e125d7468ad5e0a4270b6d0cc0b382ae0ca939548bb19a1822a7b878d38f4787366aaab7b5392ac843ae393b3f16c15af9526b62ff0e45b3ad2467c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3cd94a535205aadc8d29ae3973e22e3

SHA1
d15440c0e3cf697ed8c55875275edd9440fdf4dd

SHA256
8841fd244a6e090e7176e261077295f8347145669819ee912599363b59950a09

SHA512
61110a0d39f456c5a2aac61032152ecc91a400c03c0e82e2d7160e020078b3fba02ad9c864da0cbdb516a396e0bd067199d1e38a56312c081eafe854461a648a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b1b9d8facae9da920d957c880c5facb

SHA1
ae5bbd9fae5b381586833285c4c5762b54712a9a

SHA256
f3b592d4cd00fcbee7dae8e04f9fcb6e89ffb360cb730e25540b5e3d58f3aca2

SHA512
30cb4623a5fb5ef386b3929790d6d3a2d43207bcd4818ea81d143dafd4e98ed11612d0d817bb4b9238b9d8b5302301e81a5a583bdfc6b3f2a6eb9c409cf11f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b69316e45db0d02374ae7414ce961a0

SHA1
8129d290fa2d7063ef5b69b881c4c17c3653694e

SHA256
bd0b2eebd497d3730d8c47da871f742221a0c9661335042e4e40f5b5987e1deb

SHA512
1e5b76ad73f24db509b0ce1a7293fe10a0ecd157412f7edde64a131be325cd46355e14d3cf4ba316dc5cae75dc26ccb5c0308e1cb5b4c0071f4bafc14d983fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e3c9103ff6e7beb22c8b7898eea5384

SHA1
9d245d5fafe2f61b48331c2d162f16dba2be09be

SHA256
fbb8268b5124091e7c6dfe461501e39ee535a17b800a05560e8ddbcce2d12cb7

SHA512
d8039dc6226601239423b73026ca9e2a2928eb52ec465edb3708cab3bc3592d92705a96344b2b399dc44db2ed5b8031506e0e9b084da88923d2df9e3d3156d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97b33d3e12021f7545c893a3adac6f30

SHA1
c0d0636c6a50b24bc5e98652b918579f6f3a45f7

SHA256
eb481864944e8b10cd33421add89fe46b4790cd2aedf5c8ce796665f0022ee5d

SHA512
b0a018e74cb41db80a97e5552bb044a93a1acc53031110882dd36e65f0274859a3dfff1444cadc38e191af43c3fcefc9308b58d2a475001d2d1de2dcc1b4f58c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
628c542f6af492f17013a53e27dd592d

SHA1
36a282c5f417228c47ed3450bd9fcc213424ea56

SHA256
269312311c187bdfcca7404abcef7725d913a8d119b65c36d8151defa2624014

SHA512
00095b3ea754a2d9b79d11dbd6d6623a81fcf098d5bd85792268029a85f9a17c0bf12a0322c662d284e04accc4269adbfbf34ac1fd5c656940051f90ef0c4ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251e7e7c604f9360e3459b9c9ac4bdc6

SHA1
00956559dbe782e2e8f7936a5a3cf248454d30f7

SHA256
dd69674be46c222327f42605d1159516c7570bccda897ed0c5d51a927e138a20

SHA512
55db615ff3236ef284b6cec04ece510d9b20c7b2971269449882edda4b4e30ef708e519585ba77556034fa38cf8b7731c2a4f8b2d215c6a5f6e5872de37e0b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\ab77b6ea7f3fbf79[1].js

Filesize
478B

MD5
5dd27f8f2b042194c3cdabd62fd80110

SHA1
c035036a939799d4c29b9c0f7229ae1953d03109

SHA256
928131ab2183d971cdbfe2ed1329200212d0021db70574a35c89ae169c0f6e0a

SHA512
95c7b2dba57dd75e6120794c0ff14750258d8ca3c86e6efcf04790d347bda18e246e14d5fd8ce645e46e268f978132407bafa93ca97fa003103b59c6135334ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\11.0.1[1].js

Filesize
106B

MD5
fdffada99a6e326385c9d6d22006b6c8

SHA1
f69101fdeeb5282659ebffa17ec82e89a0cd09f9

SHA256
c58c444af409b74761d5cb4a86fde4b48ee2d4701252b439834f01868c8cb955

SHA512
a7190172ebb6023d27a69629801b9b71cba77f7f4889aecb129ea8b8e84fef7bd1cc21ca3ee2fe327bd4d97f30bee5ed40927f2a54d45a13c66edca653a60f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1483.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit