1e02f1445aac4255ee22f9318dd384d517f8655d5b3938c43caa581668a3c6ed

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a999082e04e9390184aa4ec0daeb260_JaffaCakes118.html
Size

23KB
MD5

7a999082e04e9390184aa4ec0daeb260
SHA1

68b7877c432541f7ce509184b0e06a3a14f5251b
SHA256

1e02f1445aac4255ee22f9318dd384d517f8655d5b3938c43caa581668a3c6ed
SHA512

7fa723858cf197a71f9a35d6c504ba7bf2bc0b9847ccf3fac29f25ab6d734651c204cf6153a449700b01dd4d25bf1a1e953884ea4c2dba4bda99d41b710b993b
SSDEEP

192:uW3wb5nTmnQjxn5Q/qnQieBNn3nQOkEntiwnQTbn5nQDCnQtdwMBhqnYnQ7tnIY8:mQ/NLya

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB062BF1-1C70-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423007438"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28
PID 2940 wrote to memory of 3036	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a999082e04e9390184aa4ec0daeb260_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e334a43d61980c232fd37a9d20a2416e

SHA1
1f1c6597c389f7ebcd24450d947b0038f0604a57

SHA256
eb1899759664e02b1b2510bfac3e4deaf84052c8bb6b42bd203d12af3e85463f

SHA512
4ecd5d3d43e9bf930048d06be3407376c4b9f13369db4993dd4971dd66dec27afb708c1650be991b49fd7c81efb06b0b1feda3af0e3504e4850b9f31923d5c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
846663dd6541741fc0b4e58a3f66efa9

SHA1
3c557bdd864876100bcbb93c3422385f916765c6

SHA256
0a2df745eeeeed989115dedfa032fa8ad45595fa31e831a1ea605fa6d3fc12d9

SHA512
663dc2fc20041f058e53f46aaec541de14b3965687bb3007b7de17f78fb1e38bf8925a3074fdadb937768bf545a030e1f0f1da88bf119278dd03e02b7d4a0bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53dcd6d746ad79f21d7903c55fd86eaf

SHA1
93982ff9c95e39880a1e5148f2c24bbf6353abd3

SHA256
0c3e14c2fb3c3781e4deb9586aa53f544a512eb1c551ff7e0ea6a65c6db39430

SHA512
c27da1fa3ece3262d9515f5f109164c73225e547eaa5cce1e071e1fae2100c317c7af9dbbb76283233405559b6c7224ead186e94f7b4bbdfa94ba3c687b9790f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e0555613da88108e20d8561cd98052

SHA1
b8885dd4ecf5b8224ab5044785a3b6d6513d69ff

SHA256
026390afbefd0f76b6c4ba36ff5ba697b46d7ff0ff0a089f06423ceaa92ee359

SHA512
1cb7e6110c7d65cea5eb1428cced351fc8efedd86e391ff1c4d887617b49ee7017bc7fd03c0e088f2ca5c531bab3e22c9157c459440adc45740f72e04aecb643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b983e52a3248f2a3684d0c2ca32579b

SHA1
6add01237bab82865e7995bb1de679e7dcf02803

SHA256
c92e4c5a7ef33a069c15fc6ab439803fe6d1c2da0599bb2e7f86fb43babe0a0c

SHA512
9437c2a1a0782dc6e41668b1ed8f49e373bda21e6ff816bd3f87daec22275cdceb6895f2e0bb6960b6d24e07f50bba84c706e85a2598488ed99d9a2a8cbbe1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38578f193f09e7e3f68baa1784490a14

SHA1
2aa405d7cec5ac20b5a4b75f0bedc19a7b504490

SHA256
8ed01addc4b38b6648f923cd2f5931e42662ea592d3f05bf8febfcc79f207851

SHA512
2336c41cd55952d6c171d6b3968d87b970b9fe83851f7481131d88071ab545a2b10bd8b2bdcdd6258f2d3ae6eb52069528b36e3092f4f2836b98a50cc2906826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6333c755eca86289119c4a15f395355e

SHA1
c1ee09568ac4ad01dbed7b2fabd7991bc88a3657

SHA256
f16b8ed0a9a2e651dc4dad9a2087e7db884ac1919733b3058f76d0bffab79c3e

SHA512
42e1a9c147e0a7b1d1be2e37a24284b5b3f81aac5fdbc2bbfc5c497b60ada7bedba281b0cd9f6b41f15e91f3396e2cbabf3413cff46d6ab075138068c1d97a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b550418e8d6aa8bbabad7bfe8fbc4fc3

SHA1
eebc6f5a3f76dee78d59109dc215c74a1b3a20ff

SHA256
ba7959cc409fb572d9af98d8da812955a630b234d438fc97c510bfc44aa2526a

SHA512
f5dd58b007ed00f38a75ec78d78dc7f83adb6cc3d86350ce95f683f126fa4795f59178a22758fbdcb07ad0115d5237fad4180bd13333deaf57dd8a088b5db5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10835d726fd2126ac46890d347ede48c

SHA1
dfa580529351197603c571eed3ff5f943d3c4e0d

SHA256
b5773c7ad146800913ded9c75ecfbfb4751b6d943b9fc9e949ded5642c79bc02

SHA512
734de958ad4122ca866d2365b43046b54798f9ecde46c0bdd3d434149df0fa43755f740ee7da6e96fcac9daf5332638b18a9bd62e830fd35c9a328edbdc3ed76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1931.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit