edb00f30e5d947c7cd6ea3aad7a563e5ec0c6c61d5f558f4a3bf0002c57a363c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75490a417d4144f950a67ad014444a1f_JaffaCakes118.html
Size

23KB
MD5

75490a417d4144f950a67ad014444a1f
SHA1

07cf8f87d098bed275a952318219a1e1621d1fad
SHA256

edb00f30e5d947c7cd6ea3aad7a563e5ec0c6c61d5f558f4a3bf0002c57a363c
SHA512

c540e431833df88fe94a9de087c5604c0eb2c074d083393c29933ac8da6dfa644b7d309cfd10ea3afe5657f8c3dcebe3b82c9ebc7a7c73c1f2c32361f1c7c617
SSDEEP

192:uW7NMPxtb5nLKnQjxn5Q/KnQieZNnunQOkEntW4nQTbn1nQ/CnQt9wMB5qnYnQ7S:aQ/6Hf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99CBF931-1B50-11EF-878B-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422883714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1064	2020	iexplore.exe	28
PID 2020 wrote to memory of 1064	2020	iexplore.exe	28
PID 2020 wrote to memory of 1064	2020	iexplore.exe	28
PID 2020 wrote to memory of 1064	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75490a417d4144f950a67ad014444a1f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b59ad6f92d8d6e0106d785e7985d1f

SHA1
e043ca1cd28714e0607491798b97fa66b7aa863a

SHA256
0824e9ba43a631202e2d22e4df67c8694c03bfddd185c17b87104500d1366168

SHA512
a9c3d5a8babc7ccc06836ed9d31762e8159a65cd3b2a7f7c4bf0b8659800edcf87ae021cf8642a3fc8e329248cd3d607fa1d6371b565b30aa80fa43849229e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d312052c8891db7d0ed1d429bee062

SHA1
b5089eff33df716b727f4b4212348f367e8c893d

SHA256
5370a1e4925519fcdd236c2ff040f9119eeb7bc2251b18468d6f22704533348a

SHA512
c87cb3324e5d992334d2c30de2b6dabe24c542b07dcf35e1dfb82eef9586b521385fd5b16ef08b7a1f4f0b21e479d324406279e0e5b0d1b84cc941aaac535023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a69dd2fc90c94f883cade035fe886e

SHA1
0aedb45e62314dc653f65a159db4911362530d7f

SHA256
e5ca041406d915479d2d8082b1e5b521429b653c25ef844e6c0fc40805d13428

SHA512
87ed7df85267571411dd853698a849b2aa26c34167e3d21034f7a04b08c02037f8bc36e8ddd23a3f5b8af038f62581b321dc0699ab85c51a19b03f051dfdc66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03daf1a9d2602526326c453f45fed3d2

SHA1
46dc26d1afabfece384d9e26d0e3a316298a7536

SHA256
0799b05185e8875d89ea39a01d31229a1f73b4beb4796e8244f332b2e255de4b

SHA512
4cbce01d14712664d512deb157d89ff515b91ed90146b9ec5b9ea7557680ab1d2578a0b42587aa32a198df4bdb1f916097084e4bf9dcf19a6d546c6bf24012d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2029a0d2040d07f5142819ceef6bf3f5

SHA1
261d65863d411cb6f16babae84181b901b59c1e8

SHA256
eb6f29562213ad89dbf44fdfb74e6c20bbc32763827df55f859ece1ea6b96474

SHA512
b7a4607da6806dfbcbbf89700f80a03ca7528f930f35165f5590687dd1faaede11002c3781f3e317f0d423a854baeb62a09566e3ace37602d005e6ed7abf2653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a46913c8ec24fe84c872052fe0462a78

SHA1
a247b7df55bb1da877db54a08d179e11983fa4eb

SHA256
77fa6dd6c8d3ed8d1d402035890c1ffdfeb749a4eec1c9238a3690f3e4f907b6

SHA512
699f636b3da6c1a98d305b0a2195e120e322492d5b40088fa39522cddfba09960330e9804d13f8442102ee3e85f2b094af5b1734f06d4755e24553799fa167b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
125e7fb90c9a2e781514595bfc1ff2a8

SHA1
416f1189853e2269f8f563f1455c0857156578ac

SHA256
eccfb0b180e1d95935a88a422c9d6a42395c799a3fe1c6626b64bde121354862

SHA512
5d7be09bf3b3b5cfa9c91bfe245bb0861cc7da75658be1ca69c5926bc48dbaea32e0f1163f9f43727cb20f9aa964ad37d2f002d3c5c7e54ed2e1050b848d871d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbd08654898504b0ab006ae8d9c62c42

SHA1
36aa7f586dcaa6870e5d643023be2cde01303b89

SHA256
4ce5137e655db11372ada9cfb9fef3226e00972fd84b5316a7a8615ee6d303f8

SHA512
bdeaff290a6a714564f3311e26f6db2b2a5d10695b181ce424d04b0dacc5a6b4305d96b1ad0ea2f0b68ba545a8b822b84e18dbeafa764b777de548cd6e3110ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4455d6ba636a35c659b2c6e14ee43716

SHA1
07a7b7981f67b399bc614120b7a03ab3bb5da8d9

SHA256
17ec197cc60745cdc60c4268b379660e2d25ab6f573a7c41d066e87da68bf840

SHA512
ab8d0f5e9f066914a4c15caa082ee21893e57411cc4cda137daaa81714aa681fd8ed56bee680aad9dc0db498dbf04ec5f2dedf340234e3cd3617317a7e2246cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2760.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2851.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit