b7e945d27c113c8ff6e141ae8ffc0e8363f3453b09a0d722e3339427495947be

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e9e75889af7bf2a509263909ca211c_JaffaCakes118.html
Size

23KB
MD5

78e9e75889af7bf2a509263909ca211c
SHA1

c74d7b756e2b4e1cc505ade5bf79cf234aed8229
SHA256

b7e945d27c113c8ff6e141ae8ffc0e8363f3453b09a0d722e3339427495947be
SHA512

4fa4b12c869e2a9bac43a955778f4db7d756e4208222f87b694b8bb431fd7d718ba416cd1b78de6da13daceba8c793068082148c2907cca7943cf0525ed470c0
SSDEEP

192:uwHnb5nRanQjxn5Q/lanQieXNnGnQOkEntz8GnQTbn1nQeGLnLnQtLqMB3qnYnQc:LQ/lYqG09qZvM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422969210"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9651BC1-1C17-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2812	2984	iexplore.exe	28
PID 2984 wrote to memory of 2812	2984	iexplore.exe	28
PID 2984 wrote to memory of 2812	2984	iexplore.exe	28
PID 2984 wrote to memory of 2812	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78e9e75889af7bf2a509263909ca211c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56561fe3ef4fda2f09aeecd122d614ae

SHA1
b5cd5bf550b931f5a863751c3c61b05cc0641597

SHA256
8048a222f903c513ca07ac5ae33834cc29c6c94668caf724096599b6770975d4

SHA512
27a755122d212cc79dc2369a5946847a16518c5d2c60b332118321fea3bf6bd04623b03d1a9a995f5ec8b3d27e5865fe1e83b400e69a16e2950b16f694a668cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc7a5432f72c8c58b555b615414a32b

SHA1
ce8d0840e3087aaab61e65571b649fc15a7d6fd0

SHA256
181806a32aaf4ab06452fb825e7b1fa26ddcf79bef39e47cc5ee9fb80396f333

SHA512
7bc6d4f1a676aab665d1fb67c465b70e6fa0bb1e18a4cd242f38321f2d57e877da1468d7f133467edee3ccdb066d5f68127ea66ceec3cabe2145902c6a3f0511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a87c85bedc95c6769aa80b45fb853c

SHA1
09165a19c67aa09e33b0abd8b7ace7ec72c545f9

SHA256
1ba737575e221dfd639ed0afc9edb3302f091a2f33f480394acf9abeaf332497

SHA512
26a927bfb0c54b8f005377f9916d0590cb9b2ed69529438228724403212bb44f5b9dc5fd049205ddbff78e459036953767847b4bfbef5cac910de473bb1990f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5693a3c9057a0f08ca98df0c6189fd30

SHA1
b6eb95b7d495d69ba1e26321ad276f080bf21064

SHA256
40a72c62c14f41e72c94696e2d8a978a551428f3fda1a50ad258fda148ee8f3e

SHA512
5df69208fab0d27245df9016e1e870026806aa3d2293f15f575ddfa05b5321c9c9df63142e102a920b79bbf60831030a2ba6f75846aa14baba654477966216fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e6de6fb7af363dd786b8a8ee720115

SHA1
a701da11b954a4bff6dee65dde1051862b4d0717

SHA256
8f1b85bbe6327eb1950499364f69d83e421ab5640998d35450cdc6126955f622

SHA512
9fb88ac891d9dfcf8c2af294c15340a70d249633bd7b7cda143e8fd92645fac13bb8f377797491c20e0d027c2ceee5240be4be42489de450563422bc98091b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc1e501a7ce36b9d9c4e558f678ca50

SHA1
040a93843640eb11542ac1cb47747ec0112aa401

SHA256
1105672869c3ff2761089470f2fa0b460b48e455e6752ff9dd841eabc99dcdfc

SHA512
9fae44729263e094d8271b9de154399154b08756738f97c12a869820eaca2c4e74b24afa92f543551b461d46bb675e704e97bd5f8d1108b4058c6e1ebb0fa40b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c67d7e3311377ffe9041480cc260eb

SHA1
e716b57bce8bb102937f3d2ac9ae3a58d31abf2e

SHA256
f23faa5ed4076b9f9f587b38de3edac80b394fb0424d8a88b25fa0d679d05e7c

SHA512
08c4320914cb45d745d2d582c026f336b9ef19f9d6bd290b1c59fc6dc21639493b69975c7558022fd9cd5c10e9cb44d9202b7966c06c711ab58557fb315e1da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58142c1085060ebde27f00e7e55215e5

SHA1
23da84fb098dded86dcbf285778b1d48e4026507

SHA256
70dbd608edaeeda51785c7e800530e491c9721c23ae4ce43387707a3fbedb575

SHA512
42b2d262f6fee0bb016cb4bfbc0f1452640f6e4799db4f454e87297e458117567f64033917e55d2502e8bc47b9406c055663b5a5d7c1f0e0c8079746b11500df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f002b3f3caf792bdd80ba4d60f7414b6

SHA1
4f55044f427678df9fa63a805ce59c2ff0b5f721

SHA256
4a8c560bf2d95b5e3fc23c849b362d27f081b815b3d4154ffad5c2334df6cdc6

SHA512
c3e7fb1235b739ca1cd015c297db0057e663385f512083250c3e739162113d428c61ce848d4f76c1886f7af792fba12ad5c34a2e92f665402810aa7223065806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C68.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CB9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit