3107634d4e2e78f3b518ce641a0d27223d344289b25badd2b13dfdd6da91b92d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7513bc9bfacf154fd11419eecdf8f0a7_JaffaCakes118.html
Size

23KB
MD5

7513bc9bfacf154fd11419eecdf8f0a7
SHA1

04f880b7cb930325d47196a2173f2a9d775847ba
SHA256

3107634d4e2e78f3b518ce641a0d27223d344289b25badd2b13dfdd6da91b92d
SHA512

d4ea09022098edfa312326d38cf58f1812adfc25c242689dd73d9be2f231967d4b2a7b215bedb7cf9b3a6f3b594b3f14566571211eecbdd9f7a09e15a3a1f7c2
SSDEEP

192:uW3Ib5nPQenQjxn5Q/XnQieONnRnQOkEntNlnQTbnhnQECnQtMwMBuqnYnQ7tn7Y:gYQ/FR+QU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF48AD41-1B44-11EF-82E1-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422878623"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3068	2304	iexplore.exe	28
PID 2304 wrote to memory of 3068	2304	iexplore.exe	28
PID 2304 wrote to memory of 3068	2304	iexplore.exe	28
PID 2304 wrote to memory of 3068	2304	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7513bc9bfacf154fd11419eecdf8f0a7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92ce0bc98c62d0ba14bb095275d3e6da

SHA1
73159b1a7006e6e71e171d664b169e6d068c5a32

SHA256
bdfd122a44af78cdd78cbc3381f184c5995d0bd5f2a56bbeeee08d4f5d82da03

SHA512
95696c5542ea5aba2ab96478019f1bef4ce27722655da2f6f61f19eda6684ab03a9c4e3ef9ae3fa7cda8ace76788281b997259d63d83f85b081e8a31bdbc64f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a49003c499e3c24237010fc8c26fc13

SHA1
be4a84bd144597b0e28fb88fbd7fdb8fc096aaba

SHA256
5c1ed8c3ca663338fa8292a953890db9b0586ab9949ed425109b59630bec0cf3

SHA512
88296f9169a2902bd000b31ed154e9d3a274aa395434d41261c618fb3ec254101d081e7c528b7ac9b148a799fdae3c73ee6c2f8ceed90c3ec47620acdab0e04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8bf0094efdd941497924545bd3cc9a

SHA1
045895fb836ff37caf39bd67c283d6eaafd074da

SHA256
5b2a51388a6ebc0186b5651185336d719d72de7daba3d038e46877e1724ac944

SHA512
97e166398e9d54496711758786b32bd99ad93ce1277d02aeadc06fed2af121e4327db62f10dd69ffce1da8e30c9efb841de03d10a23b07453795651e1f2b5128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ed500272c2090d05bf0532ddbbfa2a

SHA1
76f60cb7e99c15ed8ae30be27a8071cca4a5db6d

SHA256
3980709f2800f7f49194bdcc1bd8dd143ecd26fabeaa4a9c7c7a0e3eb013dfdb

SHA512
c8575ab4cf1861594e7a632d65e88070d2b95184ea7f1d3e19f88d0c3098ea32cc989e39b880168e3d05e1f22157113445d20aac260e5b0842d3741757e23b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4badb0804b9ed2e76f4fbb995cf9e4e

SHA1
2a6e70f74bd69bee70b3ebf1cafd6cab66975d79

SHA256
39dcf835bc272f99f73e983a4be22289b0c3b1f935815adb5f2fabc80e6722b2

SHA512
521c2ba6e2fd02f3813ff24f31d92cc7ed028b7d0efeb82f8d34152511ef2b10c50fe8153cba9157e07adfed81932f15cba45df74d5e2b4549a2c7d90e623990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc68b449d73e071684ccc9df53349c1

SHA1
7db104295a32dbe65859f54c74b2e47f50544f99

SHA256
e694f302cadebca065908112b5bc287a524ebaca95b22544be574fa62f13da06

SHA512
4b8461924f11c418e63d0f97419d82c4f8c58d3e04e30affc3849ab5be1cdda679f38b1320b1dfaa67990000466ba2cc61f7fdeaf8ac08c3ea23d1834fdd4f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c997188cb5aff78f59ff3d245df4fb6

SHA1
72f7ae3ae353c1dada3a8d9d5d491704225b8f4b

SHA256
b51976a93fcf5e5661dcf7b4fc02f9ccc668ffc4005dd5404f3453c4101c488a

SHA512
a86643c42dc653cd7127262b3d972a625f0dde3d9149adb4a0fdab35f655fd4168169fdc3a4c4540dcca437b7e605664fa0be4a81f1ab04549755a36b7786475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974cb032ad8a52f05d4e3cde484830fb

SHA1
9ecd0e750ed92853329a67ceb78907f23183cbff

SHA256
96626f88aefb2bbe4eba76b8b066063c6d3446da84c00ee57d82a49bd43af994

SHA512
7c878beb90c9298c08dc3b7b626d4709ac1de452f4435e7e452f098d3674f5c72b4bfad53c9f35c5e9ec43dcbbc29d86d89c1ce14a8e6c9b2af5d0201f75ecca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83270773e3260aabb285bb9c142bf6dc

SHA1
d8754b6021f56c6b2396bc1725b4fc9a8d8fb538

SHA256
db352e382afe45277553720aee8ce4137fb50b16df9ebb186ecdf14a90c5915b

SHA512
2882848c9caf660ff95699b1ab1ca38a843affbefcb3c4d8fd76eaf2ce422bcc4665020410d34809569abc1f911a018f2a91eb446e11b201c62a2d3cb237f750

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab104C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar105F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit