6c39426d4e0eeee571160de8fc1c4db92cfeb6adf2c3850dff1963e277b298da

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html
Size

36KB
MD5

7a1f54c81487cd916e9e5ec7c56f7d63
SHA1

8dd2ccb3809267df16d762e160d947d83f0b6a93
SHA256

6c39426d4e0eeee571160de8fc1c4db92cfeb6adf2c3850dff1963e277b298da
SHA512

fc24a6f3466ede3110348e08befb86fd7879e0f103664d97b1b5dd342e7674cc9a44e8333a4e911e6543d42317d9d33d41cf94729cf01580fbe9ea16ed8e8de6
SSDEEP

768:eA3raIQjuHC/MAdQmdT0nkozamEtfPuG+lunc:eA3raIQjui/xdjdT0nkozamEtfPuG+l1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{839EC941-1C58-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422997064"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28
PID 1812 wrote to memory of 2300	1812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a1f54c81487cd916e9e5ec7c56f7d63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da997af2116fe8fa9e028a7df9a91335

SHA1
808f781b4be6d37e766bbb574388b5f7777ac6e0

SHA256
805b2aae4910f003ad187e404417364ed6a4f9d95bcaff9472b2b4192deb40dc

SHA512
e80c92aae2c8019a83e60a8b7b565dd5e6a3f4ed4322de779227f2e7684e3823684f3ce66e1afb3723765223ce550680265c46a65989341d6b66de50b54f3561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78fafa7f303ae85bd802ffa0853f43bd

SHA1
8a700f0045dec2ee6c9237c28dced20228c2e89f

SHA256
1c909eb9d5435c53b7c52801f1cd1e702a5f4d6e57b66925366848bf6a572152

SHA512
8937f975d037604c40c7604e84b093df23298a1aa0106d2d81f3fa56bd736b9e0d68c9740f3b84e4ef56265e96dc604167d93aa37e50534c8b120ff0ab2fce81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe46c82e8bbb21c3ad64058f67f0ad6

SHA1
74454b31d25a0faa76aa4908d3b673a3a01bef29

SHA256
251676bef96a454b4f3368fa2a4c20c1d8b061bc8bf834ceab56ab7a4ad02f4f

SHA512
43fffa5e51795cc90fc82950d07f04dfa39190de874c255a8e4c5709a587310ced82f959b56645c0c6c21333feec885033ed7ff1cfd7f56d3cfc835b5b02a80e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03c36ad372349e76c71181edc0b3e85e

SHA1
900c835466b9d40848b9db80721437ee42740141

SHA256
4e4b68ecc211d758347ff48bb300f6311a4ad3affe2c8a101efd51d237fa17b6

SHA512
b098151ef6f5ac4bf7d4d51351f50afdcd72c9597b95455fe62e29f3944abd893a006cb8e87a50af74b0661ac5e08d9b7e94da853c5631868197025f988e7fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00800316b0c2cff23c2212e489f00ace

SHA1
f8252e29ce4f4a089fd2d5c2f46e5731846b3bd0

SHA256
40e2dffd53e0ac7f6adda4cbf2cf50dff0ab5e318456391f960431c44c49bf02

SHA512
c6bc12e0cb45ff698becda566b62dd067a352358c3d4ee34fbaa5962831ec6ff79efd361ed602a348b60b86bd796dc9de8ca85297a32f0baaccca8f57948231e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa8fe83dfa1ee49a30383a0696cd4281

SHA1
5191adae9161881e36853d24a3083287aa19b6b0

SHA256
5c73e72359db6ef8a9f6bcbe9248edbf338d09a0f4ffc55ea057abbd4745dc87

SHA512
211ab12961d0ba8a586f652779a65b7d02454932f25d68ffda04e61e32e59c927ec86746da4f4d4b6ef607ce2ae72207f3003b26561f356557fce20b0148b385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5920d36951e4d90700ec2e4e00f4cf22

SHA1
e8555fdb7deac761d45c28c452a977aaf1af1dd0

SHA256
3995bdc9ab8297755f3451e2b8726e66639e137ba9e581e763e9ff2057e8adeb

SHA512
338ac7c8e93173d38dbae3452b036d0a0af3fa5cb442caa11103d1788b03f185e3f540a79560ed4195bfa1e1097b1a8e603cf44bf3b3e15c5aa062bf674f6ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d353da0fe8b5db865b9103f13408bad5

SHA1
9a29b06efcc38b91385c5ef54365d2268d9a5f0a

SHA256
51b9a8c36391ff8f0ee2983c24b58db8b0fb81aaeaa8327342502787dd0b4a6d

SHA512
4e0b72bbecbf07380e8812efc35fb383a7ee9d4c247628dde1b0d95075985234f88d26407a0ec274ee8aa82f4909e3686ad9708aa8bdb0fb3fdf787c30fee4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28516c7f2aff6c05edf9bde5a9fb5593

SHA1
a1ecc3baddadfda6296e9355569ad42f0a32acf4

SHA256
59bcf9d7b2b6a80c9febd7011c20cdc99c1b0665a53d02196f223f6a402f9eca

SHA512
63982053c133d95785280cc51fab8fdb15e498dff0bec707bf4993f5fcdf9da52f2d8260baa824603c3e67dfc30b35aa9489db90a390cb629c1e02d3e46f080a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1086.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1158.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit