813fb0b8cb28426eb1fca3d8146a4771bad6e9812fcab830471b97226a5aab44

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7790c1251b75bdc35be54e8131473d27_JaffaCakes118.html
Size

23KB
MD5

7790c1251b75bdc35be54e8131473d27
SHA1

f013099bb4f9cf8515f696b404e9f93f5be3aeaf
SHA256

813fb0b8cb28426eb1fca3d8146a4771bad6e9812fcab830471b97226a5aab44
SHA512

c535f33d35d3c7991571c7e0f4e3a9638943427f23ee40eeff80586fcec44f594292c6fe82b11b7af25a026f4f9eac468273401517fa711713bc44ad1f410ba8
SSDEEP

192:uwX0b5nFSnQjxn5Q/gnQierNn2J6nQOkEnt8SnQTbnFnQ6v06J4RnQNjMBLqnYnr:sQ/gJlv06kp3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F9DC9E1-1BCE-11EF-922B-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422937736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3064	2220	iexplore.exe	28
PID 2220 wrote to memory of 3064	2220	iexplore.exe	28
PID 2220 wrote to memory of 3064	2220	iexplore.exe	28
PID 2220 wrote to memory of 3064	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7790c1251b75bdc35be54e8131473d27_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c80d0d8f120197fd3cd8d4549db42fc

SHA1
de543623642873576bf39530afef0be5ae0378e3

SHA256
83713dc9edca2015232dac08694e93c759bf6750eae84cf4d997233b89d590c7

SHA512
3dc8ac8cd67a85d8820592b8526abcb283bb7fbb2f8d36cbddb4757af636c8e80a57ae3aa1da77dd384cd9bd6b006eea8f3b5d8860f7da516eb099f80edb724c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a73232001c25a6842f724ac3bd5af354

SHA1
c811983f0b816d795cef0e0dfc0ca085bf87007d

SHA256
5140987682bc0d8d86e1d25cd7f7c48a4df8fc84dd06041837a3749cc016f8d9

SHA512
8b0e999a5d2951eb923915a5dd4ecc0c17eee59cd553baaf2a1a81d4fb31fd9faf967d835b02ce78b458031a6f4a67d313a571da83a31181397ad1b379a3df20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b0e006f204127038667568e0c7025a

SHA1
c022cafde60f926666f154609b4ba3a71bbac2fc

SHA256
b87af7a6bd25519058dd97e40855908c1db5639d9cb5eeb903d58e3905ef11f5

SHA512
97248e383289d509aa70d63de9af35f86d08c0a0cc2c95d7f2e6f3eea1f1e0b6023c1d6815bc88d69d512b870b58b8e269bb0f11d7ded1548f7bf18cad8c1a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
067bbdcb4114ecdf65dbe0faae176322

SHA1
41a52b6b8e29f7d601b8a6814c891ea610f330be

SHA256
71db27df0e206f8c3fb8b073649d2b8f5dd4eb451dcc4690b19b9190a64a6bba

SHA512
9a02b382903f66341542961dc2955bd13f581ac1399a8c5ed3d189c7de1aa6cff1c637e0c76559d439b02f6b8427aed6d847adb71c384e6b1f18b374d15d96b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfce7cd6f3c3817829a6f78bd9755af0

SHA1
175173e9873d0c2935252a43be1d5c5bdb7ef6aa

SHA256
15daf0aeeb60db5e7151c54dbeb2f25aafc637f6f8995fab912427998fc6e4a3

SHA512
38f6a4cfc40e70089408ef273bf7e8a13f196016fb40485ac5a959863e297e6df41c5d3f68737a5d33507f8db49c295ace1a2303f2784c67f5671fac8d58e7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
225aab5ca20f96a2ecfede688f6a230c

SHA1
5fbd4918a0358d2772a7894f0c38ff385925ca62

SHA256
0d25bf821953ef7bf3fd2c3537ea2a6d2aaf46695441d736251d1e1ea436cf70

SHA512
884c4a9feefacd9117e06f747e86a15698d5dde228b93b2e4425a57925da8b6fe20045d52447d1717f6738040baa023429b2deffa23b0cff1811cce9875b9260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea309c0a97a9799dad7db5291ab6d6e

SHA1
e980cbf61a99ecb6e88895a7b513ff0ef0b1f055

SHA256
d8531797e3e927234a5ad06bd2400c7770c691075e040a42f9c1a9691ae953de

SHA512
eb6374fee2c07eefd6946cc5346f9d209442f544f51e1f91cbe134ea120e1df42feecdaa89d92b109700250ace791e77af1fca4b2170708df03b50fae37d8351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25421c175f4af617fc9d111678c1245f

SHA1
06e9898750f14d5a9ffad1ab6dc0f2850bf27da2

SHA256
d8e86006f1615fdc9ea795c8b10edd2856ecf6f5d2cf47dcd090ed266eaf9b53

SHA512
72cf29e5066d58e1924ba842cd0d1fc9177684e1ddf1cd2803e67cc961b777fa0b86ef70ca6b144b51c8622aff20666e89464c4e95e620922bcccf19a61e22dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14284e9fa69c9c4bafcae7be23aad6b2

SHA1
0652b2e828a0227f9978b830e8799dc199a23c9e

SHA256
c8ac3674394a6585e974ea41574321f7d45cd5301272071d418a14df1bac31a6

SHA512
89e52ef592083408a17ddfcce03ed6411b3b28a55712e69c1020302677fee9224675d73403abdf320bd44c8e5acb8b673a536179041d9453a3df8b5bbac862ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab158.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar612.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit