52470761f13f1d847f30c84897a26e0fde5090a98a5676a169013ae381c6a42c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a45b9c88f655eb40822d093767bb510_JaffaCakes118.html
Size

41KB
MD5

7a45b9c88f655eb40822d093767bb510
SHA1

1ac7181fac55d2c7a29de5ebb638c23d7c376bb0
SHA256

52470761f13f1d847f30c84897a26e0fde5090a98a5676a169013ae381c6a42c
SHA512

b49dc60d8ba0fbb440ed9768cc551f854b03e0ad38e969a464f350aa25f29faac442737ffa8d8b9cda47b7ccb6ba875e2c1f83e314e6f7ce6dbdc9dedca079a4
SSDEEP

192:uw33b5n95nQjxn5Q/snQiePNn2NGnQOkEntU6nQTbn5nQmSDx7QpP0EQ1ljPTjQV:yQ/ANTkxJ18o3inoCtP1wgkGDx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423000398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46E22A81-1C60-11EF-ACD5-DECBF2EBC4E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
992	iexplore.exe
992	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28
PID 992 wrote to memory of 2604	992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a45b9c88f655eb40822d093767bb510_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650f7df81db3563950e4c5395ae62a61

SHA1
1e4e0f6fb8fc98ef61027ca98d36e335414bbf2c

SHA256
89ff7e45e4460c038cb877513fb313679bc338793ad26be34efae6fb6d7d8684

SHA512
f376db9fac1a740ccc1a0b05c340758df27a79cbadba775f12b9658967f9cf4db326934716a4e8cc98aa7406898086f35fb0ba2ffccd25dc2c8f616c1d34e054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29f81acab0237188c3ab3ac9d8c3554

SHA1
fe38f8158a262b34de6b0e5e9c0eeaf0f1522686

SHA256
fb0950604d483e992c8f06bae03018b8a7b60f641799f79788894b862a3b61f1

SHA512
120224bbfecb5f10245217a2f9c8879dea2f583355291b0ad2face1282e1d77a3e4898c58abea83b19db957c17548da9b5ac648bef1000898d819fcc50e24758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5431432e29918f4e295057c89ae89b43

SHA1
16f120dba8f8b71e853ee482344e91757be3a7d0

SHA256
a770273bf0f5d0075c6054bf3835ed0853351fa944b8d04d69e80eed130eaaaf

SHA512
fc8095ae54d4dcbe0f7e4a8038cef21b6676c160919c32f604de8f26ccbebbd7f3128c246fb89998b045bee03f4f5aca4b7e8d4d185e882f89b0b450814ecf87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd8d14bad7eac2737f3464ae71eebb74

SHA1
6356564737f836b270da54f8ff7de53ad89b9a1b

SHA256
44d840d46c198ecf5f4b344c2ad9087c08800c6f1f8528c05ffeab0509bacbbb

SHA512
824a869c8040ad116cd7809ae30af81a64ac7830766311d86a45149d66471e87efb9861ac341f052768fb2101ef5bf4f17d1862469ff15eb53f617d1bc9caa02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4eea59a9ec62f8c51b3b79d38109cd1

SHA1
2e33402cb4455d6d4dc00f1650c1ab7eea763f4d

SHA256
59fa79db184ece0cfeb897c618429e9cf3933fbf7aa6dd01c2abb5c81dd63b60

SHA512
f5bd22bdb3821c4280b105e8641ec04e53e4527b08257feaf555c564a6b39ba7be04e635a78099ddf89d3fb0ed09d8f52c19f4a1163d9055629665a0ca03c8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7585fb451114f203d82d3046e41d2d0

SHA1
0e4c4f5a185327b4d8c22b4d383b73c24176585e

SHA256
9d772a46a9d3e6b78bf25209b3dfd6e1b881b9f04b5f206e6486c10b6a75161c

SHA512
8655fca2d3e803b0d401bb0799ce4ac292d023aeac0c7452ea7703e2def0e6717fdbaf25bf42656bdc5dc9f2a53d0e12c8ff37211d19cff876b93a1611284aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292512f09e22d06fe8880652bc91169c

SHA1
cea8ad69bd09d6da249a25ef478c76595889e822

SHA256
f3904f14968f81b81fbc8e7c4c703740d95afb74df2eeb59fbabe2da285396a1

SHA512
967bdb9bcd215d2b3d2308d4f6d8d6da13839f5f69a416cc95768e0083ed98fb34414d5f799eb969fe63ba7ae0ffc5f71b286042b93505321b48aa6fab704c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a463d029684ea3bac26a1b88a71472f

SHA1
acb9c5c06c94fcbf7d350fb8f78a2e7b1f140e09

SHA256
555ffdd2ad409cc5432530784a311ede7d259cd600c1d5b9ff337b65a41811cd

SHA512
b0e0278f083b47b1b609f0b0511343fefdb7fb83506e5abf13fb58d55babfe3a9676fc598822b80f973789f19a7883bfafab874b1a3449198d38ec0fe1c5a9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
410e328e4b66eebc45bd89115db22f88

SHA1
7b2bb3e659051237943a65fec10372f8b1724c1f

SHA256
c74a6dcc0009f663d4aef6d816a0f7fe46a92d0e609663e231eeb01eac769d7c

SHA512
844cf8c41b480331de267ee022a9eca91e88e13a65006f597ece1fae843dff9c155ea945c53eb294d98050fc975ec3d2d2280a547121b34bdb5fb21bec99d4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1630.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit