4bf1d9de6d6c5a399bbbb16b642162a1fe3354223fd364638396677d86c46551

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7986aaef5fcf32db62b6a1973f465437_JaffaCakes118.html
Size

28KB
MD5

7986aaef5fcf32db62b6a1973f465437
SHA1

bee1a6405c57c08c15dbf789730da700d843d8eb
SHA256

4bf1d9de6d6c5a399bbbb16b642162a1fe3354223fd364638396677d86c46551
SHA512

75c3fe476cd0f656b9151a777ad02db8b781dda9f9b254695dfdfc615ce457c143cf1f7ace1cd84138b01d8a6a48ca2ec3db59415f2bcdeb93e60386ad023ee7
SSDEEP

192:uwj4b5nRGLFynQjxn5Q/tnQiewNncnQOkEnt3LnQTbnhnQ9eGom669+qXfQl7MBy:xbQ/cnQa+quS+3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422984620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B0A4141-1C3B-11EF-818F-FAB46556C0ED} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28
PID 1768 wrote to memory of 2084	1768	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7986aaef5fcf32db62b6a1973f465437_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15add8d7c6069e12074b009b3d6b5aff

SHA1
053ed420c162788ac1cc724ed9ff4e58e007abf0

SHA256
16c8cabde35560799160229316e7ae8b1be788b089fc3c01fa58d60d4a0d8e7a

SHA512
0cd66274d9429b4b69c4eeb464789cf3f6a266d7115a2ac213e2ba52a896371bfab1a7cef4372f1acfbc01efa762024064ad52cf3973248ead01616df4056cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f097380888aaf88cfb46a71e69689a

SHA1
623e69698f1c4c302128d057eacc76a52402e0e3

SHA256
e3764bd01fd49b9c05ae182e5f5dd0b05cdc16ea491256bc8af0eb520b6dbbd3

SHA512
5596f5fa18d47109a6202d9f9f34d78818e66c4691e06ad03b68b8ca9ed82a611fc2e68a8e31fa2cef918afd3cf9ef8cbd2c8c14e34826639d5ee3ded70cc23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1599e5bf8370a8ad667aa53f3d97f6f

SHA1
854da7a25b8c4cc1b7bc2d530aaa8e3c0b0bb165

SHA256
66e1fdbe3d44c123008685b8cb4668988f20c2bea67487dc5d45f9526aa4c453

SHA512
cb8e9e5fd0fa72dcb4361f564043ac13d7fa97af79aced3a10e58f17ee68dceaa7a4113495ee6b85221f78e72321e15c4e017c8e9e300133b4e6fb22d1e7289d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5948497535f75511205535936f62a40

SHA1
e24ee282b08d70ca02dda5399e7de4d022f22807

SHA256
fb5e5221c3778858d3c1b3c337200ef35953536b18ede7e6fb7ea354b362817e

SHA512
a01c875aeace627ca149c66cfe8aa725e96099be89130a1ed89c9a33ba964160e11911232d5589fc31cfafa88c4652c5d5f76e7ed230d644397a2beb20ac703e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5d9a47fa399fa3288f2035d62561348

SHA1
ecb67e6b3a38538698fbbaf4f93a10daf6b1321d

SHA256
cd4a83887d551ef8c6f120eda55f9a999678836459a1e65af16c748ddfa93d28

SHA512
606586a660273100f3d69cd38c6b0de41678de5908e6863a74ed2ccef1d475243c90ff1b3bf5e63109a2dfc4463acce95299c56b150754d5ec7333d4a1e5cd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adec0c5b914c3309929fc109b9378429

SHA1
b10d0cdab829acf1d183b7078b923bc88e4598d8

SHA256
1602b402f2509ef53037e78d91ffa03cc7369a0f8ee97db762dce6b991f1606d

SHA512
205907c6e9272088e459a429f73c4b0fb5335d23f524980249f0d5dcf54bc5058e8e167c90da6dad0cad6c2f373de7fde3a9207964db50e310f53f645a6d521f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd60525e5620fd0ae557215d15b7d7f9

SHA1
23a20ae9cdfb579333df5fe01daced8587b0099d

SHA256
1beee52dbe472940ee435eb7fd5d3c308c5c4f51c05d6b5ba051c15b258696df

SHA512
ba560e55e25cd706d0cbd84636f36b6e9de9f6a4301044ffe0f8a47ffe8beb1f84b1869cb43f4b94eef65ecce266bfdc2bb2521f54dd94d1b0561c8a8c2554ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267e9edf9514ce942d25f6cefa69fea7

SHA1
4ab90f36550cd741831969957ffce9937b02c865

SHA256
fd687df30a483e16936c5c20491de813f21af8f3b167dd03017ff2a43dc6452b

SHA512
dc55cd297eb72e84c5fc4b98ae4415b426763569f4f0de36bb39b95326fd7437cbcd1bcbf49ebeb7ff1c75fa8c920a57d431030b0afed6704436126dc1f28679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c49ae35cfba71b160cd03be17055e13

SHA1
25fc6fb8779be5f95eae5a62f63ef2c96cdf414e

SHA256
2da419cd125e8a28378dc1dbe7b8ee63a3353f87a5defacb86f1a458c931d327

SHA512
577ae128d5ff69466f152df84b9e50d4a8ad0eae09b133f6057338b0056e78d7170026dc2563fd2ad003f97f2fd5bbdacf1d72298c488190734121b98c19eafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab170C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit