67ff01362e06f8649c2c47acf16526ed1e32826ad45654fdab0e69cd2bfc6903

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7953db7efc5ad4be1f966b4a9f8c754c_JaffaCakes118.html
Size

23KB
MD5

7953db7efc5ad4be1f966b4a9f8c754c
SHA1

f098cbe50633eaf440cc15b0313fc6e9439f6f43
SHA256

67ff01362e06f8649c2c47acf16526ed1e32826ad45654fdab0e69cd2bfc6903
SHA512

c46cdbaf104980ef2c41ea833367a763f57ea1e4cf39ddc3fccdb8be0fefe2d0c221ef66b7b69197dcbb0ce67e07b76b63decc14b5a25ba9c3611a2a860c981b
SSDEEP

192:uWPMb5n2pg+nQjxn5Q/EnQieXNnXnQOkEntQmnQTbnlnQxCnQtHwMB3qnYnQ7tnL:aQ/Z2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0280CF11-1C31-11EF-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422980097"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7953db7efc5ad4be1f966b4a9f8c754c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9acb90f4b0c4c0902bc99525924789e6

SHA1
e1a3afed1c7f6605b98d6919f512986bac8fe7a8

SHA256
484f486895950128b4d3ae678ad9697bdec53d6d5c13259ae1f9617234a7c4a3

SHA512
5d043f1194649863538afa3ae5a2612584ea1e410cf144e783f23e2c8ad49217a9670b432752a0b8b008ca9c90a2a26eac369d18e4ae5875f492b6441c86c0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e4d2ce5d953f9c0d639e4b56d1d9ef

SHA1
868c9338949781db141e02567be9f4974d4ffe1c

SHA256
c4aa7eebe5152a10715d93530e2c9ebf01b080940eb92f18fb13e21e302aff2a

SHA512
6477d0877170e8aaabd22f1b584163266826fc8e2ac999984014e7772e3d8f5006cbd65c4f8ce9d9f135a1dfb768f79a3d6ffa9ab56e800c4360a5cddff0eb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46934f49ddf7a5cd2143bae5ec68517a

SHA1
7d3034d5d30633feaad472cb585bf5d8384cd501

SHA256
015116af78f2060e296c62a0bb6d2efe1a68bfb7a0cea5badec38af989d2cc0a

SHA512
cbda1136f008543c1788de57f333bab081bcba7a68b2b22abaef3edc2366d5bd3e451d9a001f181f6db57573a94f84c69894ef1b165df0f148e11b756c964dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f8a70d6dbec09132015d63ac4043df

SHA1
968046d35accda6fee3d4ac6537e8e67d7b29b71

SHA256
980cda7c12516bfd98618269e3e4a4595815e9ea1bebddeb4a76004c98b60d5e

SHA512
f0939179d38ff6c569513eeae7686c5c7cb1bc0c90a0b949f0a3c5b30bb1115b7296ea851bb3c3dc0659b198398322f191dff165a338aaeb11fa7054509c8692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f711b5dc5202f006a14b662a8e195e91

SHA1
b9d96b5058e1b42b869dd71073cbbf2bebd574e3

SHA256
0bcbd409ccab0357cfda3bff769362139d82152fb00d2f82dd289fb07832198e

SHA512
7868ce18eb5eb6b34278dd7dec9df93ef3d6b637b5317536794f23dd23b2a0a754e111b1129f385782ab17210bbf9202a7e79abea0babe97dfb53b2ae687f9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75609763f5c5c7f2d5ab2b6c4c9202dd

SHA1
ff96421eb885e12fb45ce95001a35ea16506a827

SHA256
9ad486623bd03f084218ea3a0c35d06f8778e6666ecd766f5f78be9959171947

SHA512
777c54a019932c1d65eb801c5242d06985bb8b06fcb13aec0d0fcab6c7b7aa95000bca17ac837334101f364aea1754efacd0949f7ac007ee98614b0838dfe6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a763435122ed6bfcb1de39dfb50e176

SHA1
ca4b28c62ccdd06f4277dc13a342e16ea181f0f2

SHA256
6bc13b661491c7228e32f41643aa50a0e1efe0597e51f000ad2fd9f124bf201a

SHA512
128fa845c399455d5474e251e1231d153d3a0ef02fd0b0506bd7267d49fd04a8b5650ef6f4fe70d5d3cd4e05a4ae48c4b47d03757f1fdde60f5388a6dd5b6c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c558276a9f36328a37423b438fd7024d

SHA1
d7c9ad5e0d60f9323bea5c091f0361e703dec73f

SHA256
5eee4f5816f155ef7a785e6e00ca1b1562755e41d3c0d1442d25c2b3fa27f58d

SHA512
e4714383d02f8d28d97faced789249987d29e8f5c1fbfbd13781cd5da96985381e9bca194d19f49bb50965053e02f9f5e67121df2f522e8f1eeea70924fe1816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39983e3aeb105c6432bc9f6452475f0

SHA1
8fd5ea914428754d7a6e9d4cf5b5ffcfcc9618a8

SHA256
741b4e6d72d66dc9a31e8b89cf9aec5e2176329dca02e2b10e17c9a5befd74c4

SHA512
007f0f43f66127e69382d142fe86c2b82affafe4fd06235af2b6ff284697f8d382d27f4934290222acb78bebf8ee9524b82035f686c9d6125896e1e31736df8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cad4d3b73dd387f948320404c31120a

SHA1
bb8fe948d6b87a22a81791414df53de8e74ad8be

SHA256
bfca546b05affeabbde14a6c24334d940a5d6e872b7bb5622ab110b388e35996

SHA512
a772f4c566347368c68042ad43947949cfc286031c48b08aa02205190846026a908c89a623d3364b6e3222caa0fe38238ea6d4379537766f713e643b358b2fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6e6fd7fc8dbb77c0a4b64a0c0ab4be60

SHA1
a1790da6a9765c354c91da2c27d7e75fd5d5709a

SHA256
347e80e5cf8d7444d744f3abca2597bf5ff25d02675bdaa4ad1099cfcfa14277

SHA512
6acddc9dcb7b9104ea85e5d828277f6c26f1a70371bcaf59b5803e1d3795709b7931c72842536926f7bbfdaf915706d1e31688064c84e04f63fda1a167e68e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar959.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit