5f470a112340df91f620f30ffa56710e7ad39e3666a531cf52e1012d34b80897

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d510bc74d4cb9e32514df50ef8577c_JaffaCakes118.html
Size

30KB
MD5

77d510bc74d4cb9e32514df50ef8577c
SHA1

04d172ddf67b928d4a54bb2e2cc20a95fb8cb726
SHA256

5f470a112340df91f620f30ffa56710e7ad39e3666a531cf52e1012d34b80897
SHA512

56da820ace62ab54a7376a20d1908725455ec86c9870e9cb414aa8a24867576bd2bc52307987d685f9c1516a7ed60edd641391d5b4ee6f76f2d1818787b43ab1
SSDEEP

192:uWrAb5n+xXnQjxn5Q/JnQiecNn2wZnQOkEntvjnQTbnhnQBMCoArDn253gbiYxYK:1UQ/YwJi3Q9xYpyQ3ZbDSOg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11D43141-1BDD-11EF-A68A-46FC6C3D459E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422944045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3060	2372	iexplore.exe	28
PID 2372 wrote to memory of 3060	2372	iexplore.exe	28
PID 2372 wrote to memory of 3060	2372	iexplore.exe	28
PID 2372 wrote to memory of 3060	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77d510bc74d4cb9e32514df50ef8577c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
759840dec15513e2253f88b10288c7c0

SHA1
98808ae440a3e791bfd04a6f6ec0796edab58242

SHA256
02eccd69135d749d69a9d9fe0f813cf3e9181482718540d6d9379b5477324ae6

SHA512
27a0f92bb680668130b828f6f594b669e06da3dc0c783d013854d27d0fab77ba8b538c69eb61fe4090c87a7466206d2d3d8c17f4536dc79978801ae1e51c73a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb1c69c51e42ed24230f00d2a3f6ef8

SHA1
e68fb3e73057e8b5ba839c39a98b247b9496ce1b

SHA256
af3b481808f3e6d127079064d9ad0ede8bf0ae55f6ff64931387160f4d8af4df

SHA512
a52363015db8389aca9fd3d4438d389f1676db7fc3eb47ce7068002d874f70919fbee0e1cdf40c68d750002b06600c0717bb28eb0112c0cef1f1ccf74bbb669c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3dfb9fda8f9101ca06ff38823a36505

SHA1
9da7b04fe68d1a93fe854204eb17d65fbea85e17

SHA256
c9eef34f8a8104350620f417e3a6a7d1a2864036a1d11b27c51c8bec19932ad7

SHA512
845996ae63f1afe697065d82f025f53f736abe7461b06f65f74a8356c5c3d57fd000ebfc9a9eeb535c4ceb2356c4eb748a848914bfcc46359f6a45da46450c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0acf7581b8be86a34d23f010725d90f9

SHA1
9db2f5b7b3ca3781391437e70934cc71380aacf0

SHA256
a7273edee0f254b17fd8b6b3b35e36f91b03a52129f4c4825ed9d706a91f5bf3

SHA512
e3dc1f3a68d9424c75f5b38689107c098be3df8e815148db092b70aa7fd78de4d0780fe2e349074919107716e33c194b745da7de8e765e869907a768cbe74bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee2cf366ff8adebfd048d4763c023080

SHA1
9683c756cde681fd8ffa9ee61f5d27a290601dc1

SHA256
49cad3d10bcb44d9bce52471e2d6d958e1f51b317db76dc53d146b0393c71d1a

SHA512
391df5874c408f5c779448bc6d569901d99dbf493891ba628a6cfd281b29745836ed61c5f6255777291f693b018137a0520da23397243072a0cefe1ddd4737f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b32213b1b8768b041bd61cde3ab147d6

SHA1
64b1136ea5c10fd90be5050dec08fdca30d3ee11

SHA256
bba8b63a8979afdd9e48d2b69ed648743e449792520d11dd826c786e038dc188

SHA512
83131b72b52c16c3a15d5fbaa069555306350c7b3c8f978c53aeb5efb387025febcb2b54173152f77c84cb93d6c3f187275bda903fabbe26abe317d86ea7e86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b49d3656ea9924ede6bff1251d4f1d9

SHA1
883a972c1f6082e38d511aa6ebd30f9b7f12f5bd

SHA256
05045bdb562945e4e6f98deef3fe45cf80966a75872b11dd8d683a6c58d0acb6

SHA512
74730b912a97fbbd6b5374f78dbf6636c7c34da3100f393fafd00002ce27cc2548c0115735f61f9ede238ef797ca3c94db35090f5a048b76d96268a7db719544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b761d9a23d5b0cefcf1a151e8660dd2

SHA1
5e4ab3ba40cb26d3f877826b3e852d19018d2c62

SHA256
6fb3eb4227570a02f93490be0e4ea1d135ece0e6e545c2b80c30c7fcb8b1bdd5

SHA512
f19a981d9694565451738cc3c56b064375acd95e7640c5f509d4152929d7dc72c73e1cdd4b99a721296d2db34885c3b338ec3510e2cb97292622307a7e3a99fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3618b44fcb38c06618d44635119e232a

SHA1
5e152b983049865667c2212d7f674774af674a5b

SHA256
094464ab29ab8ef1f8753c5b469c92e9040703e069d16ea4e47f69e4fdec50ae

SHA512
37a1a72716e506a47a38d4b885ce892696ddddd0554e7ca52383a47d88e5adbee758a43365c83a1e44ad87e3b74912a3d84c049427a46b9e611a9fb710fb1b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e3d83007630b8519080eed72a0c012c

SHA1
e4a46a13d00d4ca99d8bd592d07c2a6bb04f383d

SHA256
3dfe1e4c56dd142341683db7d6ea7ff7f5ae4618af434c735958d19120ae65f9

SHA512
9d0de95bbbc706ab8176078866dc2d6eabd8284a515fb098809de3b8dd7377912a3cd0a4e1af2170aab6f22ac9d9fccf9d4abf9035c6efcf5b607e22892cbcf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6f8ea4f39046c32a5b70347a8467eecd

SHA1
9a646eec0b42a134f4915a8c2da5f32162e3d5c1

SHA256
2ac9f0f24d60980d31b1ef2e3061bf3585f7c76d21a4fc68db10acc66b81c4c7

SHA512
8af374594a08f3ac53383cb9a77c0c6078f5db741847d55df316622d3cb58e437dfc869efee45e1daac7cefb7d568bda2f248aab0044f9dd13b5ccf679790e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1089.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit