66419880941e89588abb1f01ed55149828421383d8f1ba2de458d45c9aadc1f1

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7af49b4520a6baab1aa243934f2c5406_JaffaCakes118.html
Size

2KB
MD5

7af49b4520a6baab1aa243934f2c5406
SHA1

80b236995c9c9128ba0f8d0ee65099bf7aaa127b
SHA256

66419880941e89588abb1f01ed55149828421383d8f1ba2de458d45c9aadc1f1
SHA512

684a45b96d6b126bf34113a5fc5f81617edf5a51988c309afb74a7b493c5c96ff2c8cd85e33ed4388a1463b6060ec94da3e389462d3d98686e63780d32d2f5c3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A810EB31-1C82-11EF-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423015164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1392	iexplore.exe
1392	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2172	1392	iexplore.exe	28
PID 1392 wrote to memory of 2172	1392	iexplore.exe	28
PID 1392 wrote to memory of 2172	1392	iexplore.exe	28
PID 1392 wrote to memory of 2172	1392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7af49b4520a6baab1aa243934f2c5406_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bc218105ced3777d2f3593207a8ac6d3

SHA1
57c4e90df28b2bd63de93aab64eb3553d8e97068

SHA256
c58fdea6dc256631999597fb91c0044972352ee1631c4d8ced5982a625275a0f

SHA512
2ce1f810421d0ec78639fd74ee0df3f8aa686d47487dcaf9345d7c8bd1e98123215248c435b81dba6055dedfad60c928ddca2f5f7c01f05963a280c0fa724e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03fdb054c249d5e58b84e571a6b818f

SHA1
087e1b0f9b99050fc5502623f3eba689a471642c

SHA256
6272a1b8cb2769f6ddcebc249ac56088e05c3924f6522f16fec3ebda2a9a740f

SHA512
c9261960feda39dd93eb565dbdafccd6824969ec77f8db02dc6c8236dd93110aea412c18efab8a81548c47b4e4dee4124ba6602c9d9a5685607a63f0a6941ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957461d09f24f85634044d901a595670

SHA1
6feaf365433b0868a70947e4975484fbd8423707

SHA256
ca83eb82970ed5a8fcbdbc84eff9b63b17e08666c00a767e7174d121a5338851

SHA512
f4751673c8479f9b7b35a49a329ef37e0791a9032a70a3e84724a1870079b871ad783f812f1b3c7c5ad4a9b7d577d068dc7e9bc9c30c25b694fec90bbebb47f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7a636c2c1fc207ea87ec32167ffc97

SHA1
bd2b0eda22c1ffe77c621cdae9e57d4be32c1c70

SHA256
748711b1b79794afad785201d3d940319a992fe4a693d94dfbfd0bea37d0b79f

SHA512
6fd884b485927744001c71dcbb7d3a5b6bebd36b74ae762cec98f842ab2483c2ca76d0134b1b49b5ca25b7285fb1f9aad4cc6fc4663a62f9be6092ce6391402d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b24a287b747c4cb09231981de767e0c

SHA1
a1ccec2de655959fe10c909a34b9fbb91a2ea0e3

SHA256
8b7444573824d648d71f31e6008a17acbe4fc73f00f1bc0712fd8dabdbd8229f

SHA512
22fe45b60431323152cf69e8415fd32e76a1b51aec08c40a1d4d534d57b6ee5cc4e1f38a21f8ccabb3fc845ea5f525f397fa4f2a7bf0e6f71f078e97e09eb224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d6b4b4440b139a6f6b94e966d5cf1d

SHA1
550ef182d424d2c274f5246994250a3604b9b3ad

SHA256
0344be7def9d16d6b40da34ca117b03f8dec4436b0948087eb0aa6d64de7b373

SHA512
772efc84137742b7ef9ed162a6982a9a6148f648805117f98db75c375dfb146d1d959a0a09bb67bdf540148e6f188efa79893f58b077f3725f2ca1da91f2e9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81f13edcfa1c1a3ab09fbf4957fb3c9

SHA1
aae3362c43fd65cd5fc4bb337c7e89d675ed3c80

SHA256
0ff2d619dc476bda29a22919ca820fa8c785718412fdad07c8bd03b63197a198

SHA512
c028d5e6217f4c9db58eef61244933b3ea590641caaf0f79481f40d811f526e5b702d2fbb052761837f72ad15be5cc2c1a1ac747061de70f18a09d41e941556a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70ddd3b93e6519d744cc6dfa1372728

SHA1
f373af8ff21bd857c353537a2acbb2ef4567a2e9

SHA256
d697bcc74d450a56c70009268cd2f33c865e12e462734642bee78b1c23190d40

SHA512
903382b727e89e5358d4548b050b6baee03e1e694ded922499dc8e976fc2e30064bdf75c8b64c1311979111dc35e558ca576c7f02b784a93829dceeb3863271f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39aad813d34b89ec9fa1ec10d04fe432

SHA1
31b0b702f0db59cc684f55982cf45e77cc43b67e

SHA256
c0b9ab9a7a098ae090c0c8aa287a383ef05943b37051b33c92add2ea3dc461f6

SHA512
21a7792460651b20381c1970b564db395b22ee9e73847a26193779f27b40627d956ca98783a4a11c8bf61b5678ee0d20b553ff690fd347202616f9eb97bd17f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f14c8bb0d12a5ab5238ac9810364db22

SHA1
d3b9a4ebd7c44535ec5126baa927bdc2e33df448

SHA256
fb2be0f43d1fc610028614e18a14f9c3329f298d8aef2828ec66f5d4c48c3d1a

SHA512
e862fef4c20c069051287c3008cce66d0a7cebb882bfdbef504330f10c538aebcbfcb815d14c7dba14ae9fed861b1a844c999165443fc61b8d58530bfa5456ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b5d823eba0ec67f83aa2686a5f1384f1

SHA1
8c9cefe370945acbacc0d9604f6795b9132616d6

SHA256
4aa755eb69989aa728075344d8361d7ea1f70de6e74d749a037fa98dff5825f9

SHA512
7f2d1c4634da293d86d934722762dd41200a3083b4303106cb3ef4e62ae19ec64b95a1070e4bc98e69987138888888c7e222899fb21693a16e4a4485feac5af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1089.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit