d63bcd8edeb6bf6b8dc6a8485951a2ff8081277d80e03154dd8422d0bc966141

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

762aaad27bca8d9b4081f2b646c31013_JaffaCakes118.html
Size

19KB
MD5

762aaad27bca8d9b4081f2b646c31013
SHA1

6652a3a5c8c30f349ebae7989c11dcc30735cd51
SHA256

d63bcd8edeb6bf6b8dc6a8485951a2ff8081277d80e03154dd8422d0bc966141
SHA512

f81c338fe90e5cd4438ec646cbb5aa8b1f463fa79b1805e7f09b9a1f0fbd5de9d3e1aa9b726efa780a139fd8c8c872ddda8ad487d3cb0947c94791713c73d508
SSDEEP

192:uwvKb5nKdnQjxn5Q/RnQieMNncnQOkEntLbnQTbnRnQmSgHMBsqnYnQ5hNnlnQVv:IQ/Rqw13ro4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422904756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97C76121-1B81-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1504	2272	iexplore.exe	28
PID 2272 wrote to memory of 1504	2272	iexplore.exe	28
PID 2272 wrote to memory of 1504	2272	iexplore.exe	28
PID 2272 wrote to memory of 1504	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\762aaad27bca8d9b4081f2b646c31013_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5238df8d0e96b291acfc98f140399715

SHA1
69052ba825032f5305874a1f65de3eae94007af0

SHA256
fb23356ca033651c591e1a7caa1248369ad176f2714244121b4432da889ba84d

SHA512
7cae79d4df7e6c47555d9d83668f08a391188316829d0a5e592df5a54a897187149131c94fa52ca260d65fb7db134ff8c770ad172f4ab068cf4f74ea971749fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae5b24f9fc542b959139ce3b36fbce9

SHA1
12acdb6e7d5571c01a5ecfc9327cf5d228610f7d

SHA256
a7085286c324af006c88bab03f5625c09edd75bf2769453116208b8ec1342f33

SHA512
81758c2e863203088bfe544066a1695eaad2069868c7b79af2d3c9586b36aa1e7d0c627addaa200c52920f93675692f320fc1e9665ef37be2229e2f412776486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d21556d778189900f8f85210219d2f19

SHA1
6217963a02f76303c092431391ec0378105e9aeb

SHA256
cc8873d07c6d9c317dfd4d1999707487db04e6802e984bba5a7301b39a56296a

SHA512
931432014de6c15231206913b007c42487f8de4677e2352b37a8f63926c6ad11471de55d4b4bd4bf44b376362977c63b70e43af77d6db9f498661b39131b2bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224215e7094560ef26855fe5c45159a0

SHA1
485aeada83b1022c9d0adb2ef11e86988a1e6c9a

SHA256
5378eab658c6cf701cecb53135c0895f0535d1b2d141f8779bd2fd031f29c3f7

SHA512
cb02d49bf3e3122b9c4b33aa107f02cc34d5fab8c731b475e3df982829d5297dec6630067e82f8eb5c93af8aba35ff50bc333e749c2e1363da01d0fc4f5a1192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e87be95935e8965b5091791ae42b15d8

SHA1
65b152eb1c940eee72fd07930139e74c74671f7a

SHA256
bf79a72173818a86b6873c8541f2ccf755a49618623e928e06231312c5bd2e27

SHA512
68993c229551ed56e81ffb473d50a8063660804d6c80c1490fcc34af019c1dd5d3c7f5279fc07c9d2a3e826f336ed0537bf5f5a0ab14e21f7b6e9f6134014bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e131188deee0b085de1aa8b5ac7fe1ac

SHA1
95e9fdd4cf3ba16b1cb0ec480889d68af8680c75

SHA256
2eeab01badbce0985a16489f4798534e6f0414a4916a3d9a820ee1898126cef3

SHA512
12658c4071dd2fa2abc26b9e8ff8c62f7228f55cd2daffd2304ebfb64693c3fedbffe59bde4fc469ca5405513a3f8269ca01df693acc9af2b131111f1998feb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30c32db79b861a6c9d4809105b1a2941

SHA1
1cc5d39666431c42f6aed0d94b045fbedc75cc7b

SHA256
c7afe040a40df40b3c68ce4d53ca5955401e666f9c5c73cc2d216ae9407b6ae4

SHA512
fdd45c9a635427fecabd1e66e1dabd4327091495d989bc784af4bcbb102a11d45fe82504bc0d53e71436a487dae2d9654f8058dbf2b3853615837c6616dc0c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ccfcdb14e692c362a84e305487d0d3f

SHA1
59b818e240f8973bfd5a54923a84d7ebf94529f4

SHA256
81073fd54875a0ad88e031a71b971ec16bbb82b8e1033ce6be8f71ff5ae99fba

SHA512
88b8b712d81fde66c9024c27d49fb9f8ae741843046b594102b667e2d64c116f666db1f5765f95fc909d3907fc23d09b1569b3f06dc5f9feed79c7a645b20131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9887e4d317542962c8615427c335bfc4

SHA1
838424eef6d32685c9e7e86bf4aa95b4ea08420e

SHA256
f553756e61d086e3d6d75fd34839c5c70a34a3f97d323db1acc578336982a45b

SHA512
99efb68a7a5b7e2ef3e74c2dd87daa90163719af2e6e11eb98280e2260137c93e67aa1af8881897b4bee8bcb8837ca54c37368f0fdd9d7f456ff66449ea65547

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1038.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1129.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit