1599e7b194ecb3d9cf48c55f132567ac855a8b2ba9bd54c2b858fbc3646f2eed

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79daebf97dc9ac0416c70ec5d863c7c9_JaffaCakes118.html
Size

29KB
MD5

79daebf97dc9ac0416c70ec5d863c7c9
SHA1

3fc0d6f68e5919bdceddbbd311e782662a7cc74d
SHA256

1599e7b194ecb3d9cf48c55f132567ac855a8b2ba9bd54c2b858fbc3646f2eed
SHA512

de7d86540c528080432acbd46649a0a8cdc45d665e56e7b54f4c5410eb243b2bf837f2ac830624271dcccc8e6f2b65cd2ca02e2230b5be1280bee1a413fba545
SSDEEP

192:uW/bb5nXXnQjxn5Q/unQieFNnwnQOkEntSonQTbnpnQIMCbqA0H+OhgamdMZR9B5:eQ//5qz1xZ7BLP9QjfkisciOW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1C5CD31-1C4B-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422991560"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1296	3048	iexplore.exe	28
PID 3048 wrote to memory of 1296	3048	iexplore.exe	28
PID 3048 wrote to memory of 1296	3048	iexplore.exe	28
PID 3048 wrote to memory of 1296	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79daebf97dc9ac0416c70ec5d863c7c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77cc2587a3398bb3d77ff7002e376ee

SHA1
5724135bd96396a36342a6f77ea8d1bdd1d020d9

SHA256
221b85a18bf506bd79f8ba3b8125b0dc5e276e67394935ae5aa73a9ab770b49d

SHA512
a7b8771862e4a3d55d9a879d82c4e24296b6443d2afc44120026d561ba8684f011d459d5d6adc0d6fdd291eac9f0ce675841b84a42e67c0ebd726f82ab6ff7c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3effbef759dfa0bda941cbe26fb4753

SHA1
83f5f65e1aca5a957d02f0a79be393c312647943

SHA256
53cbece12dde75d6c0830502d1034c17a3227bba7e528edd1a2f37e205aafe0b

SHA512
6b3277eb7c8b9c840593ad67a44e3e171241bc17dedbec5a9db35d6a944e4b545cda86b1f202a82d71aae5b9fc4f0e611fa2ccb5a41148339dc0eaa055f3a263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95921bc1b1d216c22b345aa1881f4a77

SHA1
3d7650362c464bfebb1a0a4183fff10e548948cd

SHA256
713cdee0b7f1f82b44a916ad3983f432994c2d9627f82b4bcd237e015ac8f466

SHA512
5f1710ed35d15b6c30778905bc3dfa56d57abe5e7d5d5340a1591490d29999535ca08ce74f1837948661efd1d08d60d937d181536413377b748b1b36aa0ae69c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e101847344be459e0da7b8362f16edd

SHA1
be642a95adb854147d41bc9d17068398482a0838

SHA256
8c422bfa2ecaa96dbc8f11e617e84391da675c46ef52911789ebee11c38cce06

SHA512
00dfc86ea5f1117451c6ac46c4c946fa708ba10f4a86db2681e45342b860c97d2fa122cc84bbe9d82420170b327689b0dcaa72ca062abaa51787d0315a91b197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518b1c551bed0583692c0f783ffe64dc

SHA1
fb937c96e39533e5cd30d34cf6fa4fe6b5809044

SHA256
58e0c25d1ea18e93a61d32d119bf2be2d08eb2abec0555dc4db67dd399614cdd

SHA512
b2082e9991af2271f1c2a58b350edf5e1c34b971addce9a129afdd3a1db9b664879a992b6ac1372f3c66ad80804ecadb98518799931ab56f764ef1f9b4120e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505d6d9324230bfe7bbd751a1a1e2ecf

SHA1
07dcbdbd5e0d8a39db42f50cbfb4ec86152e86c9

SHA256
9eab149104b751c54d65b70e5afd81ed637c26edc588197c7ce04fb6afc1d892

SHA512
d63b39c14a731898d9695b938cc01f95ef328b96b8cb0337d86f02e30b5a3bd713e50042968de7e3515a07af74e5cbd9f62d6dfc84d332356d187bcccebdbce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9859e9aca6601b621c5e6d1fed77e9a

SHA1
d3330ba64b4114dd2d48e63449a34835cbefe603

SHA256
0a4cf49f2909898e68c37259889ca37251c063f03da42c139df8babfffab60ef

SHA512
2c6ce928ef4f8c0ddb79068354283dd01154499776d7d0b2fa974a78527e6c1349f92778dd9202372487cc994b4959848867c55c198a0c80623b6bc3049da7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce3d3328964384b09dfcd5ba8b2b20e

SHA1
52a1d94bbee2ad589cf54bb0c6c8f06ae9c4343a

SHA256
8ada011d3260338b496194303546a85e3b31b31058491e391b319ccbad6681a3

SHA512
81ec8956dda1cfa63925e073532b0289679a2ad23041a79646f1b0e529f946211125a015b6a0ea3220c82b479e34c7ad0899c098db794805b172e43f51e9c535

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CB0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DD0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit