36013884c2e4af700246cb44507102d807a8dd98d0601eef590d3a94a1ebada0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a7cf4c5d67c552df57b98e709eb6721_JaffaCakes118.html
Size

23KB
MD5

7a7cf4c5d67c552df57b98e709eb6721
SHA1

125d23178950ec8273949bf5fcf5ad873a464be0
SHA256

36013884c2e4af700246cb44507102d807a8dd98d0601eef590d3a94a1ebada0
SHA512

7916584284042ae26f897aba05252754f7694d596d67095e4e7d6eb5513e32fec921cd45663a362beab52ac336ad8d76147b00c3ab0188de134e07a7aad26581
SSDEEP

192:uWHwb5ntQNnQjxn5Q/GvnQieXNnqnQOkEntwDKnQTbnRnQtCnQt3wMB3qnYnQ7tu:4Q/Cx/V

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423004892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE174591-1C6A-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a7cf4c5d67c552df57b98e709eb6721_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5ba28beb6631a453ddf677352e2e5a2

SHA1
cc4f2d36e0b0f98ae22fdc8c508ed055e6e11778

SHA256
466b3afc95ccd0b51042a4ba57d23920dcdb23146b9fbd4e06066fbd39a5aa42

SHA512
7cee04788f9dec045e5aa7295b979f05a7cf9730df326ccf6d2173fdcf9fdb49afc53a32545af90b6f6449e12942bbc4d58e10b79b8ca9595fd6cfd984896208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9240084d660d5e542dd4438bf0965739

SHA1
8aad703eae07e96739b9084454ad4656d3698edb

SHA256
07a31fd1d305045183313e687db24a382e0f75405f1f016fad4341ed03867b57

SHA512
18482bca38519e0626fa38f8c368123340edf2fbc360fcdebf919d993f1b9f2b7e7a3c61e0e5b0a3d43f42092e3ff59adfffcabc9a1080c0f5e6d19161083bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c869603d04b2dc6062291b721225707

SHA1
2bbf02738cce33a4f79d5ab9f3ad3d728614f6c0

SHA256
3f8a5369c921bbd90e93489601e189fb692c74531f694858da9fec7553dbb854

SHA512
bc86a92804457bbdd5172169b34fb71915900b50b09be7bab72f3bdad6ada5535cd4c92f774e5097155bb7f69f9ef3db6c14b1d005413d7e0603f2262a057414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59e37ebe9f60d321f5cc67d252c3892b

SHA1
26dd4df7a5a5bceadd1e45d7c4886a865c22866a

SHA256
2ada4027832bc0d39e71de5251f42d4aaa183fee81d300c46f135351f6bad710

SHA512
5b17b9fc52b1357d380756a947b33c53ff8aa6b1b4a73f976291593ca5cc79faa999de4cd9b688a9445ee2ed585bdc3eb9ff32ac7144e65da632dad084f1d333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49c4f4e7f336cfe1a34de4ab6a27288e

SHA1
b13d52646c1b84b4c523a0c88ad8805d6fb43f23

SHA256
22b52ce3f30f5f7414ac9e32716cea9da423140d5dcbcabac3ef571fd8f36027

SHA512
e3e06423941afeab05ebedf67b719279de63249429f33bf8e095a1cf41463412a9c20128e029c004ca87fe16bc0ca1967b833e53c86fff7288455fe3511d802a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d80cb2f6532d483cddfbba5c1cb2c6

SHA1
f3d8f11126025076332b214ca64fd5d78397f9b1

SHA256
b37d7a2382e2b106aa4832ed526bac902de8c69193be188b7863e9efb29df540

SHA512
321c7ad974aa382aa96337a972c0a9d26209b8a280b9226a9a17e141296d03d3f5f55b0f29b0026aa65485f0fc5174af63ade0cd1d16cb83448a9fa920f2687e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d0f7245afb9f651c83d10ec0041b06

SHA1
643536455ccb17ae99beba7232848882895e3f5a

SHA256
2817de6f41adb2aa09fcad8eab504be33ac9684f4469f8e33ae83560c52a8bc7

SHA512
5f886dc89d30420a3331c168ddd8770a18e6ded285bf0a5ec871ff727ef6883a697e4926b448badd94aab2212cde3dd5be459e1c3031f63dd1ba38f9aa825a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947b988c1437e5bca2ae9abdf3487f19

SHA1
d0df740146f8948f3d5ab38776bd97666a0eec84

SHA256
330010fc39dfa3c8eebabd1119f2166309d34bd59a6b69818321fa84c3891957

SHA512
6ab9308855e6cca253623a6aad6528b82a1ae1966ce051ddeb06e10d4fef378595f77686406f788aea9f75c214d7a3806e7299540a2515f5586ece9a4c058804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c32fd37638ded43f402373d14001adf

SHA1
edcde2942969d3c9ff3dedb1d9ead4298fede42b

SHA256
965020b7c3189284a415d3f0ad530c57524519829145e0316583d0a21e588bcf

SHA512
864cd427737ac7927ad04728f6ad40e10d067860cf76a429116a660776dc5e41a841a674909da2867046685708072957818702ab54000911054ddeeccaf2a389

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar60E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit