36e6f2a0bf69728df6de51b30464502165458adda6b5f704503694207f65c8e3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bfa2267123d0a7d053f594a856be1f5_JaffaCakes118.html
Size

26KB
MD5

7bfa2267123d0a7d053f594a856be1f5
SHA1

7eb09bf60b28e8e981767c8323b216770b69f390
SHA256

36e6f2a0bf69728df6de51b30464502165458adda6b5f704503694207f65c8e3
SHA512

fcbf71b54b71c05fd38fe43900352610f22ddf566dec9bcf58b0af74d13e31177643fba20412c69c716cbebbc3a3f0023333d942b89875a322f033234fd37717
SSDEEP

192:uqkLLGb5nQqnQjxn5Q/nnQiemNn2iLnQOkEntBFnQTbn9nQ8CJVevo7NthFo+Nzo:niQ/YiyygcSUUv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423038649"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56401B01-1CB9-11EF-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2920	2700	iexplore.exe	28
PID 2700 wrote to memory of 2920	2700	iexplore.exe	28
PID 2700 wrote to memory of 2920	2700	iexplore.exe	28
PID 2700 wrote to memory of 2920	2700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bfa2267123d0a7d053f594a856be1f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c96841eef659a9a95ff767f76aef5b5d

SHA1
2dcc9640c61c07da2392667e5450c99a2b85e20b

SHA256
194b9751614ddf62b0a549e5550e6d8fae1fbf142bb812504006bcd065132140

SHA512
b70c508a383d31e1e3e049c56d1518271b2d4e3f6363c62e48aaef5f2b2f45c066c2cc27ea374e53c2cf8a254ae574fc84a0b89ca713eac097679233ee4e61d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aff8cd1c7dc32657378aaeb6e86d4429

SHA1
c7b158bd6ac0df0fe1388ae297b222f936010abc

SHA256
6c6d8186f1929a515cc5b310aa194036883d73a0a59080599b2a973dc220c18a

SHA512
30508062e5c4b2da7f2ee886fafdf5bf4588090e0f3e158f66c77e31ffd783db01d7b69d17b37d34eb8c7777f85e9c38f8e25ad812bf37d273df72d4435f9800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db947cec35f6b9f49062ec21628ef694

SHA1
3f06521710765d2ef25b358ac4be9c116101247e

SHA256
a9581a54400740e09f3d325778b7001898b3b33d973d7ee52ce2bbe664c5dcc2

SHA512
f76b22d224efd939950f3e05bb1227682ffc52a0cffdf8bca72935ccb085dd96976be2f5b38818f1c3f540bbccd6a5c1d2754c6c26e50b90a1f88382ccdaf441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d136de60c87db94af42bae6cc7f78beb

SHA1
09926e0df0f986c1848a059d2c9a0374600f77da

SHA256
59cee536f23a16be747e4bf0be2bea10c0c579e8e568129256c152950299f2b2

SHA512
626876f94d6754ebee75ff367238017fbe10706c2d5d063607006a07aaed2b388cc54c50f8a2420e6d93200ae9db9173963151e054666433f76550116a6f0223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d31fb80186554bd17ec28a20f264bb

SHA1
b32e8d02c7655071e91d4588a27b12b1ac36825c

SHA256
2fb65e8b6b12efcbd5353083cb604d99fbc765b347ada36329d2539bb60d4b55

SHA512
6c6c21bc21797f0fe41c5543a4b2dc786ed4aa5e3be1b64d0ac825aeb01c33b6a3334a8813125d0a9637bb0faa128110c4bfb10c8ec96d512375468ef2a2dc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f21253768b292f6bc6c5014b4d095a3

SHA1
34d0f6fbc8080cf6a6924fbbd397da555a4301e4

SHA256
4001e0701f687805da3c78ae5b8f1ff07acf75ff5313624c9d7d8b5649db4909

SHA512
e641b388da062c2edb27c1e619b09c25135a781ed0403ce25bf4ca4988469e401939cd0291fa222112f2a671ce39f78918e75d9eec44d52b540f8ad225d05522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8d5e5e50d32f1b4fa797bc25c6d083

SHA1
162adc6a30d9784a17421ab9f8ea579219a0e2d2

SHA256
4c80becaea00b4768ef9a6bcec63eecf518c1bd593e2630d2f9edac8b2279af8

SHA512
c8ac6f07457df22de276e864d09b2475f3e86e64a577becece3ec7e4cd799958ba0af2a6f393b9ff8829e3748693335458d0696148c692e1a15fbdfe1811067b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532b30e7b8a6435e6d0200429886fa65

SHA1
d0c05cd27e60c59302ed67ecb321bde9a4518e46

SHA256
1d690e3858352652051258311d41412ac3ef4f90e0c9a602ce2b14e9e8528193

SHA512
c66cf8c1ed39fea98de30d757a67397b6855985a7856e32c58eadf4dcc6cd3121c4e5d87926c581fb09cdc0d14a36f6458a6e90c6bc405d68b68804853446ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6215186b578527dc9fd38296e9fd9915

SHA1
00d30564eb9328b5f22c75cf2dafe95697925deb

SHA256
10f5b2ef5eb446468713f40bc2f67b96144bf4e1fc73bb4a3b2daebd1164e687

SHA512
7dec4662d02f720b87d7f3486ead65d88a048dffa222731cf4bebfc141d67efac503a7c7ed70888073fd5be920a57aaaf5e0776ff607126143ebec16e0c30041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9CC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit