f4dfc112d5c86e35411f0517fc35f880dbb1a86cf25574797a02687bb37d1654

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ccf05659a3d553127adea3582157b04_JaffaCakes118.html
Size

24KB
MD5

7ccf05659a3d553127adea3582157b04
SHA1

65b316eb2e5aa5c70ed1941419cf44395277ac3d
SHA256

f4dfc112d5c86e35411f0517fc35f880dbb1a86cf25574797a02687bb37d1654
SHA512

9780b6e5eb8cac97ba4db7c869b063e1148a8a5ccc56a14ff822284aec488fa85e75181a7b42a3d82ed23cc72ede8919514d8541a684fd5a1aefdf02858fc645
SSDEEP

192:uwjRb5n3inQjxn5Q/mnQieNNnSnQOkEntycnQTbnNnQgGLnLnQt9qMBtqnYnQ7tx:DQ/7GCb0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{151481C1-1CE6-11EF-8178-52C7B7C5B073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423057867"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2652	2784	iexplore.exe	28
PID 2784 wrote to memory of 2652	2784	iexplore.exe	28
PID 2784 wrote to memory of 2652	2784	iexplore.exe	28
PID 2784 wrote to memory of 2652	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ccf05659a3d553127adea3582157b04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b26eefa1db018a879685ca7a68f16e

SHA1
0644d156295d9eee164a239343dd6cfacc39bb3a

SHA256
d2328cd9d162333870337b497363f78bd646aee27fcd2655192215449f8d8d58

SHA512
b2fbe0ce8e1d311214b9f0c6fe9b936af9223945b908b7c650faaf087558b579f08ac05e486e9fdd2b0045319a098f32b8908ca7388ca920a25ceaf465a94bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8ad3b3da5f1a3472cdd8950bbfcd56

SHA1
37d2fd94c8a565952d03a7d84b9b2e3ce1ba0048

SHA256
3ac9d3a65f12b8653c8ebb6ee936b3c7f0cb6fe4c731fcfb3925e606f7745e81

SHA512
1ed23c60ba4365ee22d10adfaaaa8e2853cda3f126cd2d9298cb3fe6455f1164e294a767a9374b3cf9eb3a4b97cd7c1ebf4270347b35d3a9631e64369366cbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fae6f2b8f67546f2f3a7d28ab55dcf8

SHA1
f11c442871c5aab0060092e600b33d2a34c4ec88

SHA256
954fa92d5fd9f2773869bce1433850f3160c93c43ea0009ce9a4fff37f3bf212

SHA512
0ffc4c17ee0707e351a5d32b9eb6d5b63e34b3f58bd7d03f4d3eecb7dffaffb4feaaf1d9f013bae59b0862edcfc97fd2c34124c12a68882d439f430fbd3c948d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
434cf77de61509d137e160c9ca5ce798

SHA1
75275c75eead5ed4ea555ede8058cca7f2764df4

SHA256
58cc6d18bbc1381788770baafe7b8fc6dc011eb23afaf71132421ad36e73db8a

SHA512
7f5eda530167d8f402755a53bd9cc08c4a726a3b519144fa725da4d8fb07bf886139ead783f1a97c207c3c22732c6617cf2c9a7c67b3206ca72f786d38007b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ab63331801915f1c0b1377dae6ebe9

SHA1
771a1bc2577d1d030e35f546e4e9ff6f049c0385

SHA256
75519baa4ee3557af171aa9e5e08b57127d3fba45eb3b57dcfad2a3cf60e130f

SHA512
c6c56de532cc3fef6d24769322fc9a1c97a855abd6fa5978aab300cd0df45fed13113102daa2a8b42b72f384a1995ee4898660ec4c40826349d4a3eb18d04af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e1ab9a1a7174711a77137da1d6260b

SHA1
e25e7fa2ab412feaf15749475473af00a4f28d4c

SHA256
075726e40cdc042e6a6f85324ccaecd1a4224546db589bdfdd4f1a9e76a1e294

SHA512
483686b8b8b8267ca950d57928be03136b79721c8ac005409e0c6691cac6d677947bc127721faec217e765054287b5d448f10ba74dbedde61d0fc98ad022452d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ace9e2488c4114eed9476117d37328

SHA1
ae2a5a45f6d14c9634c43d36d7f1b88a06e7ffe6

SHA256
a7afd1375f5c89a8a00e033a5211618cdf9b89635ba95b44d4876be0a98e3b54

SHA512
c222eecc7811a4735d9a72753297a0a9efe7c9211f381a4e470a1fc90ae0ce0ada12d3f47301c9f843e4780d7bafebd710b89155ae2b8f7f9a911b624d824e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0233dc1aabb88b25aecb289aec324a11

SHA1
7ab2ea7684478275f874b4bca7ff2caeb4590ccb

SHA256
e1e5c9c87e6e25737f2af445d8f3aecfa877b0018469c8cdfab4785563d72671

SHA512
89b3d42e83f9ee6aab24423d55b7d821e23e4fb0a519de19d57f93fcd1e4d88612bc2575d3b18950e0d784608144f6f87df83a068d85d806cf7582f6b947385a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75747671a8726dd026dd7002365c9ca4

SHA1
859e403c0dca471f209d14292218eeb4e61e7c81

SHA256
b2d0394078ce11997d08cea6bda735495f884bb5e304bf73e32c3763c641fd42

SHA512
52fa0fc3f52ac9e83b5792e0e775d994cb07ef36bf907bc17c50419bdff5436059c81eddb7f964fb0b7022f053739645600297649d2e39666010b96042c566f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB96.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC78.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit