31d7ce77e2de1b150e6b1cc55c00548d4c5158e2fc332eaf92dfca31bc247dcd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a85bf7508c2a87d131cb65796418765_JaffaCakes118.html
Size

27KB
MD5

7a85bf7508c2a87d131cb65796418765
SHA1

489a951f70ed864b6d1f5dbb5dd80f3c208913b2
SHA256

31d7ce77e2de1b150e6b1cc55c00548d4c5158e2fc332eaf92dfca31bc247dcd
SHA512

31246e886c41088319ae8899b1a231bb01c163715e79ed9cc7161b558bf8484ac94a39aa172262159ee4f9cd495feea42603208b934bce1fbb85fd95b9212128
SSDEEP

384:nCDeWvVSm7nM0gi2moCRR6QSbQ/BHn/LgTVEUtIgceKo6V7yKPKZD6+70iI18:nURS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2E194C1-1C6C-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423005760"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1504	2816	iexplore.exe	28
PID 2816 wrote to memory of 1504	2816	iexplore.exe	28
PID 2816 wrote to memory of 1504	2816	iexplore.exe	28
PID 2816 wrote to memory of 1504	2816	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a85bf7508c2a87d131cb65796418765_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feca82d80a267484a1b9dc9f764e7192

SHA1
837e3be43d0db62ed6c8b03995ba341e6cb8613b

SHA256
bfc1c99885de57328cc37a4f8180737fd5df321c6cc23312a7d8e4baf62930f7

SHA512
4db2829cbe761adccf8ef943519bb94a602701e9c5bcebef80b54193e98b10350704fee399c8db310f6f051b7110220983c36f94b9ad3c38bb393fa472d469f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98cb362c96adffe624f0f757c0414b67

SHA1
cf675e7a655404e1a2169eb6a6f4322dbb8f23fc

SHA256
77b4202b5e9774b25b5aa88598987b0c7a864d838c483db9b62f247cff52c071

SHA512
e80fe677faf683e7dbbc03556ad146fbd609e5f56a60c7a0d4648e5001ffbcb0168220055dd55560f959ff1dc5bb34b9d85321ebe6dafd81024faf0d8c07e29e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d512de9aa0e917f9160092161f07783

SHA1
f37d134f312d3b225a2a76922bb016b08e98deba

SHA256
48cfa44c00f1bee0ef5c5097cb09670c8c12423f282e278e97afd0b4eaf3a30c

SHA512
a85d56eb499d9f00f1eeba180bab8b0ddef8ea89048c2320522c4244a13fbd817124b461b73aa376efa6c2f8837a81a94bf937884eba8a371b1e7944710b3084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6003eed0d2818c06a6438090ac1496

SHA1
55c2eb99cf0468fb574ff9bc106597c38a6af3d2

SHA256
74a61cda361ba89977a1056fb3e751613fca6adda074174503e2dc2090ecb369

SHA512
882cbe2014c0ebee9d36090ce48a47bbe894d617f8238340d95c638aa26890c980a86b888ad9600d85cc6f6d9e2810c27d0242f82e7c58b339924066f7c994f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9d4c06648afb5cc3e946acfbefba9c

SHA1
11ee166a2931ffe1bdec26cc4656700c9f0b5e9d

SHA256
0ab8bbd3d522d8574920454b30897c38aca84377604f98cc02426d125508ffa5

SHA512
b9f48803567ea08d59dbb1510f3bc0ff9706e42c4afd609bfa03ded4aee4942f5d56bd1ec90f0c81adf65a2a1a4b95baf279f0a0f31556064b54f50cc6135f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05db94e2b83568627718c5e62ec1a2ea

SHA1
dee3c5e22cfd6015c268b752289b7b2bda2be4e6

SHA256
41549c92cc73e6ac57cf443555ec4c29d5eb055e45bf2b32520455cd4b3c2056

SHA512
cc4afc783b83eedc3400ec37bae1b49214cbb24d22c3ea44cd5cde3e72abbb80e586d4cc3a70f218983be4e6d0fd1b56cd0245657640db70363b9d3e1b16a7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0392aeb32767f717dcc06014e0cad042

SHA1
865e28cec2dde78350959aefb0adc40171e1680b

SHA256
53c764822719f6667aec9f3cdc9278e70a67b843c6cb8daf6924daba1435c887

SHA512
bf83709d67f1ea0221960e9650979639aae565e66e82b4cae8784b85e9e292360014002d6d82bd15882981b8c8a5b92fa1a6ac3211224594ff47f1e601fa3673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59f04097089100a79459df46a0d9446f

SHA1
d1408c09599b9701cb5867c878f861f3730fdab2

SHA256
e3b47ad160c0ebc4cd28f9d60703ae21ade54d881a2c381aff74c0f0c4994008

SHA512
752b427699fb733ae8d7eaf3b5e9688daed0d1d62685cdb07b5251564acee5958d3588360a60f5aa04a9abb5673902681a3d130eac09defef5fd25e74e8033cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d6c75f8dd7129cfca7a0875c9cfac1

SHA1
4baf45a8746641e778b99b01e7d5bbeaa3385217

SHA256
679504e19f89a044f45ab3ffb9ea8b68b6f0e7d82d23c8fff0761532e5b3190a

SHA512
3eb5502fe7e02af5ef19de1dce05e715e2e9173c1a56b5ffd259f76afd691d0eb956fd54a6b90a2e2bfcb91a16b76c8bcfe20e6d411015f18648488bae5e8db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1102.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11E5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit