d02009d1224d4f414ee290e316d00481118e073ac981fd56d9a6b18f3b88acd8

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ac35d2033dbe3af644f44dac09180bc_JaffaCakes118.html
Size

218KB
MD5

7ac35d2033dbe3af644f44dac09180bc
SHA1

bab4dcf05b2c1485e9eb04656f81c73adbb54564
SHA256

d02009d1224d4f414ee290e316d00481118e073ac981fd56d9a6b18f3b88acd8
SHA512

eabae4027e52835eaf1d5217f56bdbca81a7edea97a9bbf0e79ba0099494797688a9aa2eb549800ce4615b9ad58596b3face772d81b10adab14e63685eeadfe5
SSDEEP

3072:SkwWFh4w5iAAQyfkMY+BES09JXAnyrZalI+YQ:SkwC4wIDNsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47397881-1C79-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000491c9c7fb0915ee3ff36c7917d9ffad1b1ddc3258f821aedf242d81cdde8aa1b000000000e80000000020000200000009d92bf0f05d293f1ddb215de231b25b679153ed446ab68de7573e0cf369dac0120000000f7a8bd8410c868495ef8bcdcaa390cc0184ceb57318f7b70740cbc8a604fa3bf400000003317a9578ad87324945cdca343b9b0ed59e5219cfc41553fd7253ecbed7119d0887da89564626ef1f6686c0feda2e755417e2d350451fff8b9a34e7fbf2c602b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7089945e86b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423011136"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005e1d0f3158c45c30421aec372fe603e9666df4b59cd92ffc14f1728eb66d9c19000000000e8000000002000020000000c69029f5da8229ce3e98c5a594ecc7c13ba12cec42bb88940c1f33526f948f74900000003981e14349c31245b6367d00434c9ab91ac98b97268b3978cfd76f0c923545d4f3805121c94c93ff8632628552e8ff21010949ed7f71352e0e065e22011c4b1a2a0f8d89df6aeceeb0f3b990e4e613a39ebb64abfbd03d930db7f1e92ac9efb1735e847417ec523608859d631edf58586ec6494059ef562eff7900d01b6d528c1eba288026c31afba85131a39960a474400000004dedb5f97f92b4d067e71577380a974597c88af60a12590cc104b08df67c48594a31cafbe358050c5df1d030009306361759537e59e9cef18c81d38657a0ae10	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ac35d2033dbe3af644f44dac09180bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2564822f75cea3fd7c35b1ad200d42

SHA1
eb7321902389a2dc0a0e3ce57ddcf6d28772b154

SHA256
a20bfd37f7a14ff70fbfe47926030de56b42c07efa437682c2afe778d43f91e3

SHA512
15c62748038a3cf03587bcad6fc24dc101aa1ed1341dbb2d675ec6f59a765f5da9cccdf01f358e29ccd2e9d6e136e156c8ddd95336ce305df3b8afddcec50c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc610a86eeda21284d88bc66d46dd30d

SHA1
e2b2e8e19421ff377bf8b7599fa33621de4223be

SHA256
fb137dfd0d6c308e3cdd0350e3f9b747b56fd1a625cf4af81139845eca1d9ef8

SHA512
61dbcc26651401ba78bd3797f91353b12e77d995c3fd2c938cd5bd8d9bdd64909acf6f5ece5feccb6c3de95f6ba05b4710407f2aeab2ac6e6299e5a6917275be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc5dc41a5e866029e60afc432c769d7

SHA1
f0f3d3382cb24e33500026c281b59d0ddfd3a356

SHA256
2c38b2dcee6df7c20cf6f2bbfea09d941ba29ffa61f53d815e6d1a6c8f797d13

SHA512
5011cd3051e726e59e2315ff128e58e1bcc799ae33f8c1b9706de65769beb880bf38025a0a04e8f6f42414484cb829452fc5fc679a735ae8bdc8b5e80bcd61ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d15459e56e4c06c1463d7fc6cb68ee2

SHA1
1828f106c3b32ad1a00e46cbf4aff88fa4bd7301

SHA256
610176e2fac252293481a1af5e4eeec273e0e9dc3eb04b55388cdb470ea063d5

SHA512
5a3f4aea1ffdebb4e58a0a785d0fee58f7dba2b9d5e4af419a574c52f1cd3a171a8358e15a47151a38ccbbbc40c2e623a920ccc9f0466ea269611186f238d260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555911441f92a4c2b1abd1b29abb91ac

SHA1
092e6a3b13d720fee9cb06d1b6d2fbd04eb72b2b

SHA256
9a7ce6c7ccdf545304777d82cfb8a08a04363793bba21d495721ce8f285f133a

SHA512
0233cb2b1baeacb3288dfe88f2e4e768a313672db9d7e8bca98ebbb095648cbe436cf8883cb767740e1ca36e4df189c38fac5c8a6f7d0294c43057b6c50cbc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d7d291e5f683410506360354024fca1

SHA1
c01759c1ef8ab5954a4e5360473014207670c7dd

SHA256
b921dc7362192f5a5dd9ec20e18f579a6b43852dcdfc7c340006b83097f0bbe1

SHA512
2c980c11410bec5f0221f7b8c2769133a215ca7106088aac83365966597696a49c1b1294f360c7494be4be7b6e2ef344ddeba5307541d63c6411d0edff782273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c57f262a6cb77721d7820c9eecba53a6

SHA1
4656ab7cfa1c6eee370659500074c0c941f356f0

SHA256
0cfe3de8ec982c32560d179133ddab9042a4f84c23b4d6ce78e9cce08e68aebb

SHA512
73a7fc8beeff772f3364110395d82f7fc7596e0df92c694f9ce6e2887d370169de31328b2281f32b298b55af85ef966c7afa65defa5f72fa8d4c34329969b130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d27eec58019ccdaca0ca7f5bb80822c2

SHA1
ec54e9af8da2f0fb5fff38d0b98c0079b70e2861

SHA256
0b029b1fbc5b92890e3663da7686c3949e00b6112b16eea758ae3d3308eaee19

SHA512
d2c6668db2b767214ecf8e7956fb573280695292a788475dab49eed51d8c3585509f089bc853771c695c1142dede2cc6a705683418122fad39b5933d6fcfea04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0199ee9fe8f0b81f4ac6c5d8ebad5bdf

SHA1
18a56134c833876c7aefb00b7e5deeb5df4726cf

SHA256
c04663f05fb30dc20af1c3bacf90b5b826b1b2ea504e8e8dbcdf5e84a5587c17

SHA512
4167600c463ad91f44666a0e83efd90b53e1cdb33f10cbc06b986d8b0eeb576fa74cf151a1c10bd47ba26ccc26787a48228308427566de05d17dbbc820a73b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12D7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1328.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit