4016c08edd51eaa3295d2bdc1b61114eb6c2b6691e43b2047de60c7a35c0db5b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7656780f1a80a4d0a907669d2a491b05_JaffaCakes118.html
Size

23KB
MD5

7656780f1a80a4d0a907669d2a491b05
SHA1

8abd40ed8923f4cb57f532fb47f7f6552954ca94
SHA256

4016c08edd51eaa3295d2bdc1b61114eb6c2b6691e43b2047de60c7a35c0db5b
SHA512

5b00794511993d44e13f090ca3f63df64b1076457d27c2626c7a3c606a3913ca0752df157ac580051c15e321dc3132f07ab0c2e5bc792d58f0f2e9918155bdb8
SSDEEP

192:uwf1b5nwOnQjxn5Q/XnQieWNncnQOkEnt9VnQTbnxnQKdjMvMB2qnYnQ7tnqYInX:AQ//vA7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F169081-1B8A-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422908419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1896	iexplore.exe
1896	iexplore.exe
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1864	1896	iexplore.exe	28
PID 1896 wrote to memory of 1864	1896	iexplore.exe	28
PID 1896 wrote to memory of 1864	1896	iexplore.exe	28
PID 1896 wrote to memory of 1864	1896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7656780f1a80a4d0a907669d2a491b05_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3e89fbb60bebdf8e1faf7d4d90c59da

SHA1
c8a36048963de2c3e92f77c25d6e4e9355136d6a

SHA256
b047f97aff8bc2cf84da053a2a3745591f4d5933341d642ff0d3e57269b0a274

SHA512
40ba6f8d00f812bd062485e4f53d8ad7fac71844f2d222ac96f08bc5165a76c5fbba63c575c2d592435fc05e8d4a9b1de741c9a407bd2fbc0650992104fe5791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56802801993486efa5b7b769479b125e

SHA1
effab72ff001a3195abc66420e7720118e070db1

SHA256
9262c62563a28c5b6057785f26db6ac07639581cb0a55d4e6f48963c234fe3ac

SHA512
fea0676e8ec87cc318646e9cd9980965673e3da1fa8cf2dba5830721faa9f537788fd8535aa07f71ff0e824537a59ea731506e1b63b1fb74938f98cc4a10c570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d894e50a42bc08a180fe775f3499bdbf

SHA1
52b051ffb1c6683f44a0ec53c40f4cf355b9c3f0

SHA256
8eb0c61e61af7a8cdaeea58f9a2142dbab37396a7c6af0a3b234323b85c0618e

SHA512
c679b30040b82255214abf3b464571cff1fa6a77cda42e12496391d460939fd8a1ba4c99690add0569be4801d5c471a12cca4df6c571a51c3b4e07246a70cba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844a52a624c5c841a0248fd174b8aaf4

SHA1
6fa9bbfe0dd9fb01f08178dc0f0156e6cb918020

SHA256
113efd7859d3e184c43743e87d73bdf0952f1cba46533b49d6dc260034ff818b

SHA512
1a95f726f61586bf12fae459819cdc0614a6f38f7a4e682bb63be1baec99a51e91f8e355f3390b7b80fd499d52fd09f9965f92ab0a495d2e8e1137145c95af07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7935f5a1eb3673560d6b9ed8cf787a45

SHA1
9605b250635bbac998b119e6e6e60a257f8be938

SHA256
ae7b373b6cb44eed7e3836c2c7186189d65b611e464a0165e8030ebba55ba8de

SHA512
5ef1ce3275acd9a2f38afd1368e1c6a9c5cd2f5459138009c20df4d3ec987c2c7722ccf3b23debec00c3c15f24713bdb40cbad2ee4f7610c1b793128cb5b7860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3efc71b5468b617417973390621f59

SHA1
d85ef32aa36edd3396093bc5369a78927ebc2826

SHA256
2d6b922fb7c97e40a5add9ec4a4bd7c822bbadfb7ce953d25ea993cba2666cb3

SHA512
bba5f55adbe36e4fe99872f4104a5e9a1032b854b4bdb80291d0f520252a39be115f49255bb56f0de2113ded7156ce65b627dbd41457a85d13264622db051b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8be772f28f2410c0ed8342cc3f7d280f

SHA1
10cd746fb61172602a7930f1a2ddc1c78b8d5df6

SHA256
cfc4a591fde9a215d94e7a189d9c2a5a6c85c51e8889416c786112a73e026ccd

SHA512
d86b8a250a38021d8a55deb5ca216b3087bcba2ee55e5a3f6c826f6b01f27d65eb770412f8794b550fc971687a053cc9364095621c14272539cb72705509f359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
798969360efdaf8674c6a82af66b63cc

SHA1
ebc445ef2d9d7fe68cbe22d235c15d7eb312d2b6

SHA256
265e5082c16b658aed8fa08aea0f770266bffa99d4e4771c33e6054ae562736b

SHA512
68c7bcb8efd17dfe4f08770091c21ba65f85a99697138df72841333ecfcb8059607f2105a6ca3fad979570f35db1a6417a523e7116baeb33a8586edad176ff4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5dc80f9e7fc159956030e765f4105e1

SHA1
c3667bde5c845b98e8892fd43dc9c718bd680894

SHA256
1d8a641e1194226445e4c51b8a8b99696be7f5762c5a550a7ce5e3fefb8840de

SHA512
1c160866d2f806bb5d22abd220e3b24aa5d22c4483176b97d175d6e1a2ee8ab489c442e1fc8c8a1abb01ccef8b3396aa9e5afeb08693dc1a9e3c51838e7b7d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3093.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3133.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit