9716820da03cc44c7b56daf247f878e80a57300b128a28590d413e64dc83e14e

Analysis

max time kernel
151s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ce2f821853e1d1df845abc7842087c8_JaffaCakes118.html
Size

20KB
MD5

7ce2f821853e1d1df845abc7842087c8
SHA1

5abbd1db378beeea9ad519775f361593f36142fd
SHA256

9716820da03cc44c7b56daf247f878e80a57300b128a28590d413e64dc83e14e
SHA512

2157843bd599f4ca442b8d753eef48ae5b2305737852178c82a9a78d5211201463429b7e156b9da05ebeb291cef2afeec3ddfe3f18c44996db71cd034a743287
SSDEEP

192:uWjQb5nJGnQjxn5Q/FnQieoNn2UVnQOkEntrHnQTbnxnQOCnQtqwMBIqnYnQ5hNZ:mQ/gUL6Sf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A561D91-1CEE-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423061420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2744	2312	iexplore.exe	28
PID 2312 wrote to memory of 2744	2312	iexplore.exe	28
PID 2312 wrote to memory of 2744	2312	iexplore.exe	28
PID 2312 wrote to memory of 2744	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ce2f821853e1d1df845abc7842087c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b8a2588d656cd7ad838a7156587f5026

SHA1
c92c566602148ac992936551ca4713ba55bd320a

SHA256
963e759a6b8a6a24f046331fa038ebd6c68e38bba76d04d23f19a461c04a50eb

SHA512
7f5cfa27fc35bae42c467ff49123cc7692eab99ca624932d6a3b0f141dbfe8f2224e976f445c866ee342c3dd4cd5db82a6b722362f9d9441f4d588f82c838642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f48e7b960e894d6d857c5bad3fc3dfeb

SHA1
9ae4367eaf601bab6bc3a59ff90c531ddd1eaee7

SHA256
79fd5ea23501848272aea84ed24701c7aceb72a99ad4cd0335cab37a74aa4511

SHA512
81e96d1564fecf833933160265f4bc0c2b4bd9ffbaa42120bd00b71dac9b88c5cb897c7cf7d7dd3334c5a4fb63693d7fb75122cf7a217502890447d6d0b7092e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b0a6474aff62bf0636183112528a298c

SHA1
76fd859c508bf2a527196bbdbc6b5c7657a7c1e5

SHA256
1155f99fa452159d62df2c56ccaef94642a0799cc63af3ed93bbe9e26557ad34

SHA512
e9d555a91290351b0a1d531d26f18c6d340f933ed7a39c4a4972ad09c111bfc4645386ec2ff5d485906f437a74ce11a3bfec94e729ac67000275b503f74e0e8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1aecd95a40adb8cbd5284f11f7fc1f51

SHA1
239acefa54529b3cc9d0f93bb936dd29adabdf93

SHA256
0a609f7f40433caf0bb2896f5e71ebc6dd17492206cdf2331d9de8941327fa55

SHA512
dfd81c39fedcc1160c48ffa09467c6db2b792eae8a5cfa84a9050745ad58149514b6b2e0eeea4fe17e3e16c4afa49e0e141bdbbd59210b5a979a7214cba59eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b87ac7ac8e843f05c32e6eff67c2aff2

SHA1
2c25e13780cb2332b67c7bb598d448236ff6acf0

SHA256
003e0074f44a6b864e3e82fe3242d3328a8206a433e415f6cdffc93ee00fd9ff

SHA512
a73d62c667e068ee4d3140cf7acdeffa1462be6320f44d4648786beecef6d2b2fab2c03fbf922fb0a1185951a5bbc63196525020ee0c0deead17295c2c3eec2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c893ee087b217db70c108484eac6404c

SHA1
ca2a841a364ac0945cf37359f5ddae8d3cf3ff9c

SHA256
5c1fd5be48ee10c57e34b9f75c7a6673891be351931c0021f40c5dce98954328

SHA512
dde7a69605534d598129d5ed19f311a9489f6deba49f1b191964c498e0a60dd2ee488299b52f384320f1382912151a94223869ad311dc370322b0c1ae6c614aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
262a29ace7720498c58738359bfd2145

SHA1
3ab66cd37b6fa32b9aefd3ec25bf9d94209860d0

SHA256
8f698be5950f9b10527b62a3290e3bae778d39beefadcc7e95d1f176e0235960

SHA512
ea5991eaaec062a09715be94f2f1069c1db97b59d1c1d0742502ba0d5943bb75ebe68251bf3f13f484852e0fb9b9d7d87991007c9674f89556655ed96fabeb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1f9871988042b2ab96434b10b8ceb29e

SHA1
74a320ca8551003dbeb27513562c6e2b16468ce8

SHA256
c24554072d7385d31635a3504c49a5133e6a7d1bcc714fa4ae6982593984b134

SHA512
ed6a29562ac374d5d38f1e718ad4ea921be184b7461c51ef57a61335da6dd0db5681d15a046543aa5822e9b1d976826e0775179fd52aaf5f7ca50c297989a324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9b9b8ba2e2d2d868b05db6ae17024135

SHA1
196f445ca6444db142924d36885038ea09d5bb68

SHA256
a01e2f5940d16e2cc627abbb8edee09414ba1b9483e76452b95f63e475a13473

SHA512
00a2ea844cc7a02264917f649bdfd8a9164a8459817c48261031be8741b418e2c723fac23fceed7afa2fb42f973ba4a49edd81831b8f20053bced24d87374dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E5D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F6D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit