2f67b736071811bf882e619763477aec2cb2e7f937802f03fe011a2b9f8d744d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ac677425953b0e211fc3af9418062c3_JaffaCakes118.html
Size

35KB
MD5

7ac677425953b0e211fc3af9418062c3
SHA1

15011db33e91b671bd7d135e4eb50a48874d5f72
SHA256

2f67b736071811bf882e619763477aec2cb2e7f937802f03fe011a2b9f8d744d
SHA512

f271ffdb217316c70b81934ef7946aefb0412bac04db59bff171d1032ef433de459cae3aceb38f3aac5b5af31b952ec18f6d521dfb15598fa9365a32e7b036ab
SSDEEP

192:RMXoNUNgb5nw7nQjLntQ/EnQie6nsnQOkrnt+hnQTbnAnQUhsFwVWwVZwVrwVYwM:OXo+BkQ/JByIy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{941C64A1-1C79-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423011265"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1388	1368	iexplore.exe	28
PID 1368 wrote to memory of 1388	1368	iexplore.exe	28
PID 1368 wrote to memory of 1388	1368	iexplore.exe	28
PID 1368 wrote to memory of 1388	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ac677425953b0e211fc3af9418062c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
15b3aa2c01626a0ee0a938bff185fe79

SHA1
daf1a00c790314f30ce42792f61813c37da767ed

SHA256
064c2112407740e9d647bb2c0dfdab4f467ad63918189108c65fbc043c60ebac

SHA512
e9ae63ce52ed124fcd80259cf90fbf528e95d59f1b6f771e266801d07eb2fb359af12ecd5523a49f1622c5695181547887850503233b9de9dbdd1a9572969c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d9181797029e82fb20f37f956a91964

SHA1
44dedc0c72ac3ee533726097618d6ccf9934768b

SHA256
b06ae66f7c29ed6aa5eb0801f35604dbb17b1dda3bf0c6f1d1a373f4048dcf77

SHA512
d8052f5cb89d2c7b064e9df256c1cdf898aefb6d2675fa2e2e6b66370dff59e37ccd12dec7656eda48cbb61cbc2a53c9cad61f134d1da0040955b0236c4a2269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78164a150e294d6ae636ea9b70b36c88

SHA1
3f463e1cf0aa8bdcc96c617dbe7dfdb7ae8969e9

SHA256
b882439f7b60a3fe7c7e49fa41b27df56c604240ff33ebd5ff2ec8729761b8e8

SHA512
3adcfb532eed8e5e5d478bf8c1fce1e84848f4930e1d3dc0b206bfadbdefd0285f8e9e84f00fdef093ad255bc711ae722b524e1cc6ba0eac494a772a4bf64361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d34247b9be3a5810f0d8a6ba9dc083

SHA1
77e0bb46864a68caf22c7da2c8d98df054382081

SHA256
f7bf13895b74269fb6e5b8ca2035974a94a29986d2061ba9c6ad4ce38d07e488

SHA512
a3d54e151357bdb0d317118174a152164d6173a9257c9a95e29000bc95277718937124b4485da27ffe7a968cbf16b97f05293d1d61ccf39ee6f729a2ed0fbc64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bee06db3efa1b6b9f5974b02f9028a40

SHA1
24901d802027c296719b7ca030d990843fb6225c

SHA256
84310ca145bc3db24e4340f29a0f1d625b71fca4506b454d44b115b449fea463

SHA512
92b966b9634a83823a0660b1cef01847f3908b2cb872289d551dba1726dcc872cae79feaa035f215a0ea366faac696e08f1f47e664514d7bf68c3ed5843cba9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e078a746efc79b6156a3a32d0e2fb6

SHA1
3d7616c63d87c4a894df96a496109c3eca5e6f83

SHA256
33b4419544996d054c0dbbc1ad12c1626e16d252e2b2e7bc67047f4ac1947efb

SHA512
e5e6cb635bfb0f3916c6aa03303f1a9b15bd6ca2370f9b50811d1368aaa70f8ae42d4c9623de81da42b9c3ef17055754128b603d52a5c08e83cc2778c6c02ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d613467c50f1ef4682816b64d5fbae7f

SHA1
84aec2626e5d3b99f819ac6b1fbee0fd9a4bebce

SHA256
67419fe48bbcd846235430d9e18c497068e443a761a66a8729d32c56d696b906

SHA512
7b70ea1fadf09efc97e6ff4e6b068c3e69470cbed03a02b167c052b57741845eb3e1cff47b6889254f6052d59c663b46f126a6587d1b7fbb00f0516b0509b0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
068112d76a3d6c6dec0b0948e1fffbd5

SHA1
8aec553263bcf64bc1fb0f182e72e1c3c7d9d652

SHA256
24cfdc8095c39e8ad11c020b49cf3b63c781d08ed95d2e6836fc7299925f561e

SHA512
f267dbef2999601be57a805f959f74d4bf830aca1c970eb4ddf8a39d524bfe4c2470dcd4300b381b1a553b425f7f57cb7d354e3227605e2919c377046bc3d136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7b8fb24327c147c31a8e5ab0995a19

SHA1
0ea1a031abe0511d0eaa1451935a6dd6416a5769

SHA256
c68ad53a2feaea6536be330fcd793c818d0da59433aaf51f4646448bb200ec95

SHA512
c3f8e2a55d430b2b7fc51ab50dfa982b3edcfe7d0d100f8d60daa3b67e03ddd3338c3ebd1e568d895f35a923fc79f8f5b229101cfdfd078a0ae831723c01fb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4afc0ac58c5fef126e4dd19df2ad30c5

SHA1
4bea7dea8bf89b1cd3ea213c558ae56822a70f29

SHA256
34722f590b6e0232e6ab89adc11b1a61594f707450cb8ceacfee85b7da651340

SHA512
bb31f4412cfaf2c5736d45ae9ee5a0ba6a015f16d5b8f0dd42fca0bf71c4c71a884e08251efd1e5d550a2b7233a756eab35d0ae7c02a372858cfd99e0f7569dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b1e9a1d8cb41dfb6e5d1aab583560003

SHA1
8e603c1a1a9a99be7c632722017edba0b1cd0481

SHA256
912117f745d343091163cc79a68b9ea3e2a6374925df696795268fb0e3bc3b47

SHA512
10c14aee5128d92ba46642896044f83400de0f709ef0fc2feb356b797b52eb7fe1b0fb21e62bb12b52c2ae9dc7149ebdef8043789e549a8d0b05c1ee3f36d0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit