d06892b0e0ce31c2c9bdb44cdac3cd56f289475552fb7ce0796039a5f9f80790

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ad77b8ce0aa7c0b00757f20570a1b40_JaffaCakes118.html
Size

23KB
MD5

7ad77b8ce0aa7c0b00757f20570a1b40
SHA1

6a1cd46532e157bece1b3d1b52f48ae6e3533f32
SHA256

d06892b0e0ce31c2c9bdb44cdac3cd56f289475552fb7ce0796039a5f9f80790
SHA512

868f8107dd723b6b939ddb602dbb2e12ae3ffc440e856bd57bd02e084593cf0039df3f2123b73009adfc5e67cc9eaa3207096c3d6f8efcb9ca15d1cd9543a705
SSDEEP

192:uWzMb5n8+nQjxn5Q/fnQieWNn2ajnQOkEntdZnQTbnBnQUCnQtkwMB2qnYnQ7tno:VQ/waxgH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C418D191-1C7C-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423012633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2704	2916	iexplore.exe	28
PID 2916 wrote to memory of 2704	2916	iexplore.exe	28
PID 2916 wrote to memory of 2704	2916	iexplore.exe	28
PID 2916 wrote to memory of 2704	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ad77b8ce0aa7c0b00757f20570a1b40_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f4ee4ca3e0e2d8addb66e2129409885

SHA1
641ccd7cd54be570734a3e813c749830e6174cd0

SHA256
56e052da0d46adadde49591e94b4747229053efeda1fb004a7a94f672c66eaf2

SHA512
361fa8358dbf872dacdd998acd7186325f11ce30942523f9f7dba7fe55240ef336091fbac44ccc82e170c819adf92e88590874a6d888d370e2bc2b2fd65b06dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce71681f6f664293e74f354f7c57c4f3

SHA1
90f4f781ab6afcddd7a89755517c65ed2a32cc7d

SHA256
c3c4ad6a35887a383e5211cc8f39c2d4b8dfadb998a9b6df84ef30ce0777e57e

SHA512
e2de326b688b3c5d24a493b5c8220595acaf305c088c8236d66802dad6ad2a47ba0998ea37dd8d5d49aaea7153c3bc7e2182abf925eb33ef3ca790622dcfacbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1518818baadf72879f20802b0adac821

SHA1
768edd65877ff955602cc3915f0025e4ef070a42

SHA256
739e2774f52688782a41e2d4a887aeb487d9f21995d3e739516c5db4351670a9

SHA512
b16e70276809fad2b912898de21d7688e11ef3f05ee454ce7603a95cbc6fcf6d22589fac717d1ca07392d17cde23158fd7804c302e212b8c5befb03ac3e4d6ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f0cbe1802ee262cc2f9ab694223585

SHA1
1e256f46eeecec9ac4c2b9576903191250f09e33

SHA256
bd86eb583f6ae086b9157376def03b5e65b08c0dd9fc2b47f45b717e0c1ab75d

SHA512
f960a69096ee94efe777e52674bccd1962ec1c039abde00c496d348eee249116e6a025f7e981f0e30b988b579c32821e8c960067993dac160eda6e08316e965e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdfa72a1af35a3403545b25fc65bef2d

SHA1
11c6f10b08dc911503e3c79c98a4e8d1c5f05691

SHA256
d3fd700ab350907e6335d438518924315ca09afa0630423eb8a4f373686411d2

SHA512
ce89074ef4f45b6099e3206e7e9ab70627684bb70130bab2bbd4a987b998473db82ef05104748f4898e00a5e6e572327a296563f521e840281c7b27c67c4de23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a7f2d34dd27b9e26471ae3a983c9f8

SHA1
a139831478251c3e74d6d3b6dffc13b9c45cb2cf

SHA256
ce7b6e9e79ef27dfb20244e96bfac34b8f22b48af92a2ca8b35fe8b1f748cd2d

SHA512
5b2cc41b585a7f00b1cb104847dde31051e4a0952c1f78f5e54fca30fea92e06fc6b2418c588cf0ed107b416c3d755552647e3b67fd8a3be9aee13927d3fc617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7da24a384c0cd73dff1691dbc2f0b18c

SHA1
b03ea08931800af53042fbcfcba1a0b25d3f4d11

SHA256
a91a10919a5aa8f8ca9aafbb9cb29af6394521c88d7c4da55a63c1f8743a3b3b

SHA512
c13a2899ae60b1426cfce0dc24f4939d6d65af53e1d2be1e0280aded8979fae0b3a43f8d707df813031e03d7cf0a7b418031a60b84db1ae1517f2efa2347bbf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b6545687ca13e9f110640a73a4fac4

SHA1
c6e9880cdc956853356e0ddb360a79d021bd2adb

SHA256
88502eb0a383fa446bbc61050859da2ca5f17cfe4699b247d8b78dbb03a94f71

SHA512
412d915c2bee0dffb5d9e63f6f61bf376e9ffec514c07db522db01d05531cc2c4d62a71a06e0920f99ad158d10eb529fdb57afef21fed80eb7e0abd7cfc81f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43718e3cfcfe9457eb6cb7da6e4ef44c

SHA1
13764dc358cb3031f9593712c26c4fb8bba72a2e

SHA256
b60fe52d65a86a07a91c3a2f42719c2d654af18ff783be8bb3c0bda69d784293

SHA512
9f6741a9d8bf16cfa30075e55d9d38d55d2c8540759ed913c75d025afb69ba7d4c7d10e8134d78ecde86d7417856f06d748bd358cd529395b18e3cb54dc7c563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2156.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2215.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar222A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit