041322c06d0ac7f37a6fc846fb6e33e2a9d174dfd0460a98bea3e8502f1d176f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aa0098b75fee3b93fdcdd55e6135ca0_JaffaCakes118.html
Size

34KB
MD5

7aa0098b75fee3b93fdcdd55e6135ca0
SHA1

4422311b2c214df973b9c8efd861cf85871e0d87
SHA256

041322c06d0ac7f37a6fc846fb6e33e2a9d174dfd0460a98bea3e8502f1d176f
SHA512

a3e5f0f3171c6c10b5a4be9c98edd47dfe09ee9f47eb0fd4f1bbf226e8d8eb7aba5be3daba22cb7c23076065386218c77a8e4a57fdafe3048dd7beef528c4b71
SSDEEP

192:uWXzb5nGJYXnQjxn5Q/gnQieLNncnQOkEntg+nQTbn5nQhXClAOw26k5195+Z6mn:qQ/GmYw12JhGTRTpzpO7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423007867"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAC24FB1-1C71-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28
PID 1960 wrote to memory of 2980	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7aa0098b75fee3b93fdcdd55e6135ca0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
629b49667f8d6bb6435a89ec2de56759

SHA1
e9a54638b1e685d2e04c1ff5b2d6883edcd7c252

SHA256
f195a61447a2d177286b3463b5d98b2fc0e85509f34696652fdd2ad7da38db5a

SHA512
a432ec97426a8164e9d984a7257c72b0da19a7a24f1407fdc6ad4f94a23a1641780030e6d59a1103213aa6feb7d773a6014c117c0a563c03fcd228a7f4cf0a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9866e1325dbbf572a3426a8b100c553

SHA1
889d1cfdfb3e3764cfad0cf72c02cc6ab236a5c4

SHA256
3cf789c476f831f4546348c1676bcacba6bcca16f15698e01f644776725bbd68

SHA512
cd43251104a2266b7514d30d059865e0ecb8b9126c7cf4951480fecc4548b88122476ef1721f6fe136b533506d65e06ba456720b08ab0b215a6706144ab367a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81518c6cc2b2363eff6d31f872c322a5

SHA1
eb4a888c6180415ac3a16cbdde137a65c522054b

SHA256
2a6a066cedd27fa5db0d390c3e22a93c88f6b06f71e09926860f9a7a8088d1a6

SHA512
cd9b2182606eba65e82b27ef93216d22b527bb5b9e9e177aaa31c3317033666c497fb0e0d3a001e2e411fc98d9796dba976bd9b7340aa7456a93492944cb7433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb6706f178f805263e2b9ccee22987da

SHA1
eed27c8455ed700d43e4452fa1a92711cc9e1047

SHA256
5ae37a09884e560a296ef74a5d1cae60edcc5c4de4627c2aaadaf51d650f1944

SHA512
43cc88803fd81f9e35dc5587e6ddfab76f3260e7e1d3f0ef28cd5fd0f1a1ad9a61a43c73437542a926b5ada0f593751bb42dd7b388845fa06d503acdbd977375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60287a97e6d56fab604f83565d902b2e

SHA1
78062d2fe309dd46a0e8a8fa5e3ee8a09d969f12

SHA256
bdf170792e2c6ca208fb7ed89c760386cb6ecb0e9ae0c53fe189ef175cd43266

SHA512
780f75c3dfeae9e1adb70eb06658052e2726f3f6a92785d154bf536ce5fadfad8cd2abc90f8ebe97cadd1cbd2da1c4a5fd7d00b0dab65cb056fdaf82f997342a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b797945ae38ad2b9bbbea01ef8749e

SHA1
418a579c349d03a32460834a5946d52ec23e20dc

SHA256
216cefe844d4544a7e84c12f372f8ec3918876b50a82b2bf56dc97eaa3fec15a

SHA512
e1b682f820bd2080c8980421aca0f8f100de8759394fe2c5cfb447abe8468f7177dbe26c34130b83abde2e762e75f4ff90738b4946fd01fe5c9b6fb92140a67c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9c47b53b495963ef83339c4c3beb33f

SHA1
d3878e1205871497b38ce19d5ee87e6e49c4350a

SHA256
09b98620880b47ad24c52df327511f743ebc53b52099cb8ce534028b5bae0f04

SHA512
250653f8c94ee7b97534f9a55ce61d0312dfea0f9b8924915e0e7b98c3dc20f0f0c83465cb8d1207298b98cc01be94ab3b856311cd3038f367e8535e19f74720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d414dab4a38d3843ec611d370f25108b

SHA1
25ab35f81cebfd062291708d277dcbb37019b226

SHA256
faad38b7ca81c679c5f74ac7228992d7b5da1582c9672c810ca747c289387b3c

SHA512
57b029fff6df6ebd5b0260e358509aec21153fd132a74599d72413bcade791c4a10681bd0d119c5811424170a0fd8534e4b76ea50a5ad668426d45bcdd88043f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d69c48f5c9a8a8d3dff42570871e3e

SHA1
fe597afd44f59b1f5516ddb46f9f5695cc2c6cd5

SHA256
19d9907fa19bf2621f4e67eb2bad54bf45bd0e6c2ff9f59106d0cad5fbf4c5c4

SHA512
3fd8b5cc984a6ea4a5de29b88dbfcabe4e817fb6401d0a5bc3ebe6fcfae10c15065af30daada77b686cca98d0dcfcce482b89f59248545c1d45f4d94d8b1c4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba7f73cf7a8e410d3c9bcd96f1472f3d

SHA1
91b19229ffc133ee4679a75e600d0e216785ab46

SHA256
6a1bfec05c84a1bf0d5b2ca23f2eebabb50d3238d3b45c411e821e46ad9cfab1

SHA512
a9562a9a584a84fb0da6292825daa072badb35df840dc6b07bc79192b60c7aed36d9678ffadf6af42bac6df74c9cc463158b6017f26a79feed0e7eb33058af87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
69f77a63d4b6d19e1ee6cfd84ccfffd6

SHA1
560b2f07b532d486ab651b2bf490f7417438e8b3

SHA256
902ba0a99e2944df1a5edd45fe453dfa49c42a315314d16faa204786b2d74bd8

SHA512
0aa96ec9064881f5077ecfb8cc2b78e0282c3adce6bdaa34a8074740adf3e1a8494051762219c0c4c7e06b3d4e360f13c2659ad49ed05774faeb054696bce4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar237.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit