8fff081483cb37b7403a29a9bc03da431d84ec577b4bd32da18cde4db40953fb

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c38130bab6a7aa8077e842f5fe659fe_JaffaCakes118.html
Size

41KB
MD5

7c38130bab6a7aa8077e842f5fe659fe
SHA1

054f5009037387072a6fa59186ddba3fe770c566
SHA256

8fff081483cb37b7403a29a9bc03da431d84ec577b4bd32da18cde4db40953fb
SHA512

7f26ab75ea9558110bd80caef4e3ee5ba55c502a6fd5535bc7020c79f7c20c8b06262c8a4c6a06c60c28687607349fe64c502a91a99a497ccec99b3e88710acb
SSDEEP

192:uwPnb5n03KVnQjxn5Q/ynQieJNnnnQOkEntiInQTbnBnQmSFx9yiaSoPE/QrzxPz:WQ/YCxAi/cQ0O4AfuhjQPgJ0FmKEgDU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DA4B931-1CC6-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423044217"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28
PID 2916 wrote to memory of 2496	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c38130bab6a7aa8077e842f5fe659fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
474856268588c6daa93945d61b0c4105

SHA1
9980e6b47acace52ffa637d001fae6e26457e1b5

SHA256
989be1e6524093db5411fedf997fb85d39e3ddc5ae145cf84f7182ff9b0f854c

SHA512
89fb568f8afd6d3287b30e70f8637f5691f5b1eece4d524c9aa39b12cb46d843088a11e334744a58cfacb3659b92d2b0535b25c9b8e05ca54b909f1ba9d0e82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
928a67bb141db2797ef168e1d8e52cdc

SHA1
af127d29fa4bde4f25f87446e9f823aa6138a28f

SHA256
f583699a0d32729541f66101afe6c5a6b94b0c2fc83f7f5536ad45bec0256249

SHA512
5f4bc6f203ab74521b7827aef990c2bbc1ebd688ba791b20f0ed668bba21f279ddbc5e59c1a8493c942c5f8b63723b7055bd55690909eb9d72281d7de685ad5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fd808b27f20d5ef00cf9c966f4e4ded4

SHA1
80071a70efb70cb56ae45e8c62bcb851ed64e84f

SHA256
cb9b76ce27ae8b37980ef6aedf9abd903dfcd009106341491cef8b6cf6f95d2c

SHA512
c1cd9343e5f5f5b33ee506d73a4cfde9cc3a6be65c5430b5fdb52e7c24e66bac88a3073ac19abc2fea70807ea6794fd334a61910e476bf61983de1fc7373b249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
76d15644c9b020278b0291a4309a34ca

SHA1
e91c5f61d75d1236b09c90ae3eb9b83c4fd9a145

SHA256
a555879cdf2db3227bc9f1e3b79855eca358ff88fff136fb8fd13588f5f10299

SHA512
2183cf6aec57423379581cee33c8898e9a26cd9a00cc4dacd918162750e72f53abb4500d7988cc848ea5b699680af0182062e16f7c48683a9f849e92836b8f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
309f3352ba597bb328e69aaa6637c06b

SHA1
9327daf3574832060fcbd0222526c70ebbe92291

SHA256
32fcf2cd73804dd511b20c211ee735e40c47bb2de6714c8db8aef39b4f58f352

SHA512
77fb42497802cb7647e2359f2f38ef2eb49e1369b17cf88d1c8816411c932f60fde1ff19af93afaa892fbb874e437b8092f9a279fb5f28be5158fbbe17ef8565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
21e47d97d8f3c2afcb0f2b8a8b1bf945

SHA1
3a427df59926f16bc888f3dea837578953cabeb6

SHA256
279e0a3c89ac81cec524598fc20a3a6562696056b353e4c6bde7e34586b4b92e

SHA512
e7d45edded2beb03515b93369d830f04c9221e94b618c1dedf9d21cc9577498f14d6e24a3c61e23b1ac32f0b8233e9640b3e363462c32dc31774126619921e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a56e91799ee097cc353155297f5eba1e

SHA1
b5defdb32f4441ce16bd239a82491a72e85d6ae3

SHA256
2332295ec8d9bed5676d7be912b9485c84720e41dfce39ac89d211727db64f4f

SHA512
e45d2501fec09e5dbfbb703c43ea04773d1d7d4d52b93dbfbb1f96e75cd721caa22873b4ab4dac264180c9b897d70203eac9111d9d364f4cf3502319eecd952b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bf069f5700c2571e9a5c0f9bc463f3a0

SHA1
c1d714482a82c5d0c96b9b26f996e1dd74125b0c

SHA256
39c2e1f13633235a1109be253ca0d7603bf78180368414c73f6a3ac9186b2795

SHA512
86796cf81298e6509c2d7960e5bb44d459ad48fa9ff9d9ca0064e398a3edc9b3507e1432c65678150ba8f627cd716fe8946ce7dd80bf4b5859eed2e423656c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
df6400cd4df1dda6c5e70585b647d5a3

SHA1
3417ac9ebef201a0a36961d29ffc9b92a71ff232

SHA256
9afcb2627a93e41b6a9e0743512751d16ccb736dba9a7f9eab61e7802c4ff189

SHA512
3b0bef39703c447b8b9a461a290eb9095a867d1896a25622298bab4892d25e93366b87797884420ac86194e9045633b419bddd97a636a23c5fd7ab74703d3a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D83.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D98.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit