477e4085bf4ec35030c0dbacd8835a05b93b38e18b34146e53ef8794d897de03

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a927d6b53cbf8789f74d081d76cf0b8_JaffaCakes118.html
Size

43KB
MD5

7a927d6b53cbf8789f74d081d76cf0b8
SHA1

dd403f29b23423549d106519d5eaf780e32f3e20
SHA256

477e4085bf4ec35030c0dbacd8835a05b93b38e18b34146e53ef8794d897de03
SHA512

e443a41a1011f0d12fd400269229d498e8c3c0f922d40000b3aaee674111ee762d8e11872224e5e2ae106771972e15843905ddb5dd85de07f76b28baf48ad9f0
SSDEEP

192:uwHQb5nZmnQjxn5Q/hnQiecNnCnQOkEnt/fnQTbnhnQmSRxuJhjbCGnZHyUt5V0g:yQ/7ExA5dhaj8WVm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51ED71F1-1C6F-11EF-90CD-4A18CE615B84} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423006858"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3040	2084	iexplore.exe	28
PID 2084 wrote to memory of 3040	2084	iexplore.exe	28
PID 2084 wrote to memory of 3040	2084	iexplore.exe	28
PID 2084 wrote to memory of 3040	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a927d6b53cbf8789f74d081d76cf0b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
784d92a208eb12e13c9daf33da8437b2

SHA1
383c6a594da0a273ef3b82b10dd5e69680c8aa4c

SHA256
672348d20997a7602681fed34cb0326493ccca1b2e4f356a810078384a72e48a

SHA512
6bf4904c91b80abb4222cffcaada2cce4b7b2f033606a618f0e0a8dd16e56825ec6f63cceb21f96231bd92516f6c379288d76df27bb617f6cd260747b8eb5005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc60c365ccaabe44d010590d0e027c3

SHA1
6788061fa7004739fdfcc701592421ce01de512b

SHA256
bd809c2cc4d91d90a8047136a843e96d0229e02a9ff2081fb60d5e2c2d7ea5f2

SHA512
95502efad3030ed29259bb2cb9982bb18884e94fd52d160fa9cede3a59b437b9790c50b400cfaee5ce5aee91a339864c0493567fdcf3563d3da0a49f4b627ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b349442fdc6edb2d6381dd733066357

SHA1
b187275fe8eb6048949175598881033bb8895475

SHA256
457db17510a03b1c36e25aca699f2751c8c2b6e12693e3f062e6cc8521171af8

SHA512
a46ea91ea572d9911b129b7e99d87c6ee2c5c74279a10aff3629ed5a0beb428a36621225ca119022a8ee047ec5d0dd00f0926e44460be809d0259c95b84fc078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c5201a1286ac772931fbf487836cff

SHA1
43c7ffd84e851dd18c96d369ed71be3bf12bfa61

SHA256
49b3c3c562209655608cf71f244720df264345ecfb3583c0698a7a00ba29ac28

SHA512
1d8c4e1c654a5f623b433c5aef41183e43190134cf1d38e427283de94adc4fcc3c4bed6dc558ec2bf6f8468bfb9edf2f234e5ab96c8d176021b736e8c8e3b427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddb45de9e5479aae5a5e0b551b00411a

SHA1
40e82edd450c7a511433a4f401e3ccad4883982d

SHA256
469fe85476f0db992f54f5ac79f011fa6888611bd0b54a37ebf8e98310c3187b

SHA512
71c293880821554e6f54eb4104c4bbec39699abb47bccdceab95add39934e0bff79f6cc7f670f8d11db2b4d4087813538993213c951949caa02f968473fce5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220b5bbd508a8c3bec68b354cc8ea546

SHA1
a983fc3df5782cb0a686d094a7f73d2dbe25e554

SHA256
985dd779215572fce357b1dd278b91394b59f85e4b0ac12f22e4795d75575687

SHA512
d8235580c2500e256c5da01ad47136f68da2baf1dc4bf196efd91b247c092bb6368c976e071fd2f25623a1f3e4c53eeb5f722eafa9a639febc6e2e572eeab1bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730616b09278cb6c5dc79e3ff6db98b7

SHA1
4422d488f462fcc309a69b135d874ff91fbf529c

SHA256
24429e5cedcd2fb7716929d97cd031f2e93baa30680649a660983afa39af1bcc

SHA512
45c85ccd4ce3960cfd70d170e0790db8ac2e0031a1241d6c0166de1ba2d21804b753d0625b7821ec96ba8db9c2c05bd527457761d9d82759e9c4d9e5f9e6f2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b2b1d09693728620159049330d592b0

SHA1
b5abbeb70e9aa0305336da7eff47b897019b97ce

SHA256
03b503cd8787caa702d24fbbbfabdbd1888372a24817ea275b238c3de3085c4e

SHA512
4d5eadeb44dc96b55e3ce108b721678b1475ce1cc0b878cf76014f629ebb73822d630f90dd9aecd6cedf91edae0ac541f452f6cccaf7c6ce45d30f936dd48adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c92033a36f6d04d147776a15b6150a

SHA1
5c1273bb73816ddf9e769c61c28aa30dd7ab9b25

SHA256
2363231b86e2d6bc79d15f19c55910049a95242221aa8cb1b8064cd0aed181f2

SHA512
6bbf619e034e600544cfc4233fa43deb464bef91e2e797ed215fcafa0f38c70ead26dd674600742482e47c4b50ab2bc33164863943f27604c020145c4b9ba4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45380c39f4fec1dedace8fba7f273c8f

SHA1
0b789d6a28cbc7303e5e9bd3d9dd908cb96f1daa

SHA256
48c8ff95cd395cb1d345fdac53419accb94448847db72139aa607aba9ae17dae

SHA512
175073dcc437fcda14c682da97514809f3d28153653e508d207613f878950f4ec385d0ec5495b952cdf07bb47d6b39b766b6e9ecdd9b13aa8e14478e9fc5f4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit