4fceb5eeefc9883bbf0180b192249d839b188f5b5e6f566f1e728acb5cfef019

Analysis

max time kernel
128s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79bee42e7f224693d0e95eb86e552680_JaffaCakes118.html
Size

213KB
MD5

79bee42e7f224693d0e95eb86e552680
SHA1

f87d74f072f01a58a8bb0b3c0acc98529e531c1b
SHA256

4fceb5eeefc9883bbf0180b192249d839b188f5b5e6f566f1e728acb5cfef019
SHA512

547b6744b6e4ff2882e62a3c3478e7d798db18958a158efaebb3733d7f7ad605ea3db56b3f482e71e22cd00fefc9a7c34982fae9e15e826546938045a26a3253
SSDEEP

3072:SfKCTEh/ZcX7yfkMY+BES09JXAnyrZalI+YQ:SfaUesMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{712688F1-1C46-11EF-8857-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422989302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2964	2888	iexplore.exe	28
PID 2888 wrote to memory of 2964	2888	iexplore.exe	28
PID 2888 wrote to memory of 2964	2888	iexplore.exe	28
PID 2888 wrote to memory of 2964	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79bee42e7f224693d0e95eb86e552680_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a18867f1226ee0957526ba2114077a5d

SHA1
73c9129cc7b54b37725d3352111cd87b30e102cf

SHA256
1a41421f5a3e7614d68a54e749aad90ef0fe1023e881a3814cd9717bb4df7f1b

SHA512
8f69d2df4acc6fe6ccbad0ee04d13b65540fca272b19f1cc2c3b758d6510f67e037aa7885bb89484b40af770c77a40b0d4c6213766bc397b481c76dbb612e9f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66cc94ac385a0a0999456268d6488fec

SHA1
bce4186c4a202d70baa84a3248794784c0430fca

SHA256
e0c58edd5a8bb1f760ba62e64547dd185769aa4484d6ba8f59cf26f7afa26f36

SHA512
de78449c977d2c02a13eab078bde6af053eb52cb2e95330b223b784846a3a7f6fd344e6173bfaaddadc3df9cd89f2797d0a0dd81b0995ef86f11d115b219a350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14e7d7665140c80233a1b99f79da4ff9

SHA1
f13ba9aeb4215ad05597808aca26f1cee54edcde

SHA256
45d5bd66d65d20f037588724b94607af354e82b1d04b9b1acaaa6e3cf04fe2d6

SHA512
be34d8e0b8c3920d42aeed3c8f5d34cdfd17c2593b3781682b23be55f30795815286c235e8ceeecfeb078659fce349c5e5fa7c5e06789dcf05e68fcf3db6896d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f8fc2bef0b7c9bcb349a9ba8af7ab8

SHA1
908faa828535bc8b226b4f6668c1f1a6e7d2560c

SHA256
76d04d16ac2d7a586b74f4dd01fd52b1ad73b427eaa597c4b039026adad6f242

SHA512
dc34c286a58d939e430d2ba85856421a862af4189038b7cbffccf8c82ac4ef2e691b63b64f48107ea220d0b2dfa94fe8be414e86ec0b4afb7398727adbb6ad4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b84a8ee92c7a2e5db8496f401f01d301

SHA1
12a75fb5db27ca8ea67194d8c6a2e153e61e35e2

SHA256
04f621560f342eecde7fc2cc3e9e6640373cb691680c1b545d2a766201a29df8

SHA512
7f9df3246efa3a2027bf5b688bc66d8581d0dbc56b9b43090a3cc2146251e44ce04741b77937f1cf97f0be6eb6736d4669afbae86a106e516bfdbcbd695ed73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
559c59fed87e10907bd9f7a47280390a

SHA1
13882764a83ebf2a59ac207ac948c3337e796e30

SHA256
926398c483baf7311c4845103eb798504501a8f4117c970c1bb7898014213d65

SHA512
5d26b77f8faa8178ab1eadb48d7396620f9850b47da83a4370192ecb3203a230d0f49e90c461a03e2dc3a08d64ae8d3a3c3b9fd700fefdde7eeef41338c3c2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c10c091a1f869581cd6329025e377d4d

SHA1
8bc21c78f5dc5392dfa5d31e1585dca5297e8763

SHA256
c8f9cbd9d83a37652aa7574d2d02c1dfa624b7b374a8980b951859e4802fe908

SHA512
48af80422807ad9e4ead6bbcd1a3c79015ac2b1d1415caead88d122d356fd56b369caa89b0b3b6a9f03b90ec65c066e81274d725213849c21aa279312ee83b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7967d2a57b72fdd88a99bcb3ec3e4ebd

SHA1
137e168fc8c7008b600bb67f4581b2f9ac85472a

SHA256
91c8b4789e8730d2d9e96bbdda4ed669175a44d8f332e19e062fcf2395a0fce2

SHA512
f444f52cee7f3e0de0cd691e3ac74ceedda262d0c5c456f246f21d4556cfe5294bb2808757e45e6c18fbb72f725cbf517cfadec7e60b4d9c71afe224e8455dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f16a2f0af868fc1d1580d27f311d767f

SHA1
3a35d2cfa3c2af2559ccaf2daa6df79059e11468

SHA256
2e8a2a11a6da7da47d72ebc5dd477694a96d7b56ec95c5e571e5e3a036561c6d

SHA512
d1c7e6abd9de09622f7f4201579a5c81b18f0379eac729816199f9b4fedf1e69233e530aad09f1777cb0ba190578eb183decf149c9f8f41e4bf1c19f9e924df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96c42cac94339405532f1a2ff67ffbcb

SHA1
003ed065b921ff8fbf2cba8d4a59e31c88d35cbb

SHA256
895d11603a96d27a59fb1052e3cebfbbd9ebc332d222bede42d448ff9bcf5eff

SHA512
bd877b204c2462af9c4df4be32e1ece5628a69ac2a379043645a9a5d38666d4b7bda72af5b3346866acec592ea61d0883ff2e75cd297ddebc2c6f08818e23244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8362b809b25f69cdfb8ef1f8364c1420

SHA1
a2e76c409dd2e8a0c091afbf89c0c759e99971bb

SHA256
5456b39fb85d51f2b946eedbb045a0ce1c5da9a04edaf220ce0e3861f3e5dba8

SHA512
412c2326394533213cb0ac2c0374f437443721542256426b0cef0fffb92c19fedb4a6b3e7120697dc8f00fdb15b8000aff09a118c3a94504e4626fdfd063cea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit