165f4a3ce70cbbbf1ea95794134491a557bc53704fda7664dbe0238bd4d37d97

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ad0318841a84bdf9a171230410ca15c_JaffaCakes118.html
Size

19KB
MD5

7ad0318841a84bdf9a171230410ca15c
SHA1

9ee87ed1158bf532d9b262e05af06518f79a1995
SHA256

165f4a3ce70cbbbf1ea95794134491a557bc53704fda7664dbe0238bd4d37d97
SHA512

c595bfe54116a0b4b935e44629fc0be34f3f03cfb8afe5a7fbc0f0b519514272ea63981cfd27df103f04952b9854780ccd3f3810be20312aa637c2072fdfb0fd
SSDEEP

192:uwX/b5n6ZnQjxn5Q/5nQie0NnsnQOkEntTrnQTbnBnQmSgHMBUqnYnQ5xNnlnQV3:PQ/RqmqK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423012086"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E12EF61-1C7B-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2816	1088	iexplore.exe	28
PID 1088 wrote to memory of 2816	1088	iexplore.exe	28
PID 1088 wrote to memory of 2816	1088	iexplore.exe	28
PID 1088 wrote to memory of 2816	1088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ad0318841a84bdf9a171230410ca15c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbf88b6448e918f26bcb9dc2c2050ce

SHA1
dac5f1f5794bd652e771ab3d9e4a45cca21894c6

SHA256
af4c0c9e05f47e1b3c14356e931e2dc380df13f12e2d020f6be9c5ebbe212d6c

SHA512
c0c3804a7b88e5392989c5569b6ee751fd9884017119e6a6f36def897982760b1e2c93cf89f07a2fd46dfbd0c18df7acfaf24dc4f1ccc522d1eb01cfa8ff2ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55cba19e0bff451cfbda3f0047e2ad0

SHA1
31efa3b407a2d567f4115c5c5c4d720178009165

SHA256
c4e41455a2d951e50bf39c8c71828401d900500128ae91d2aba6ac64ef7750f1

SHA512
9db1ac37ef608ded5ade84ecfda995da9368e90c40c1b3a55f87a90da4f753fe732160c16a84d235a7797779e87fb6779b2b1eb6714c0c566e3fd6f3801bfb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca3a2004fba35da7cf3d5ed0eb3044f7

SHA1
4643adf7f98d8d3d455635e53c9161d059423193

SHA256
36addeee0991a671b9965c12d10a142e89c9b699df5ada0f1bfd0024ab050e04

SHA512
1566a74eda3530f2ad9979154c5752ffed388e42b594854380b559f0ebaa053114a4591e3ed616a50066aa8ed56f1ec4498405319f723bea6ba6c8a7cc872357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf72968dd85209b87f6ff5693e691b0

SHA1
f9be1a2d783f9d095fb51f1839a6a832f365dbbd

SHA256
11d6ba833161314ba04f2aa02bb1740ed9ad429b35c6997fe900efdf869677e2

SHA512
46485f8c38befa3b03d7d6878fa71476bbb63f07eced4ed06359d2ca7cf4394a01bbf71e9971c25993278757304ecf2f049791a426dbaf4cb73003731b70593f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b2b9d12f903dd00cb6f8480ea1c4be6

SHA1
95d2d3c4058a26808e6597781f3e745384764ae3

SHA256
bc6ff24d030ef20a7a45eaad1a21a2e25c5458a57325e62f4f84bfaedc8d5afa

SHA512
77f586ee1a0e8d7a6e360b213632d209521e108b8567188ba444ad0b4a2a6d26a9fc0c24adb65d2067652431d5f56168906d7f22b97374bcdff98d2a465e4ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6bb381a745e55f1fe7c7ca3bcc2d6c7

SHA1
9d165e6323a0999401168ce5e731e1d5d0e333d7

SHA256
c08129ddf0db7d3a38a102dd12f9c92745608e69f6887f5f011c023c6d2f5e1a

SHA512
86b39f765bc7dfd5487df90ae34e1a0097d0c11c8a9c84dd72b27d566a47948c3b957871c05182d4b72e632f89b397e77a7339d8ba83c286ccce5c59848de7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba670dc8e3e8c7985ae44e3f07fb887

SHA1
ad18ea360057f407fdacce6eef1badfdd7bd881f

SHA256
c671950faf4c0b4b7bc16079433315381910ffc749e4469e731aa2088f39b71f

SHA512
75c5eee6b5515ac34c544ea5a4522b61117cc1ce23aa6f02ec97dfd56b09fec638c61efd14afcc6400a61657c3beaf14f140bb0f6c25970d38edce579283e2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c28107b34a666540f880760c831d0ee

SHA1
9838ba2fef3dde6408c0a5e69f9a77b217f1405c

SHA256
a52900128214548c257cde6002d6b2af7e29d6a4d3dc93231578a51f9cdbdc26

SHA512
68ee0198cbc620c0ba0dafa2e3fc1b3a2dbb37ed281c85270d79c18ae8adbec54a5435efa1eaddf2eaebb75512fca8cdda52ce011a59c151734102fc697dadea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19a46325d3668616858d18d60168e8b

SHA1
a815b15ed5a13cc0bafb8d5d290055ca5c3335f1

SHA256
d798e04a70051a814c2104622ef560c18629f8cbad85d7840b9b689cca2d564b

SHA512
49dedd2b6484698a74372e7c8350a514bf3efa80273ed8f6067169f4b23b67d015a19095738b2106a78a4fba44c5982d33582f8b06eefa8060909ac9debad02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1038.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10A9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit