249dec6514d94a19f90be6735fa0dca8ef5531f873cbd1f954e86b5e156b0619

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d255e3524fd8c31f00584bcd1c041a5_JaffaCakes118.html
Size

23KB
MD5

7d255e3524fd8c31f00584bcd1c041a5
SHA1

f73e632a281f720f3c3c442ba72f0124e9643d9f
SHA256

249dec6514d94a19f90be6735fa0dca8ef5531f873cbd1f954e86b5e156b0619
SHA512

c1fb9c30c7c96e83988ce932e270832a64fb6ab330052592f02ecbddefde61dc4d1601c66c4c3c0d70aa2c901f7a1c9c069539316bcfe739aea55bbc65fbfcc6
SSDEEP

192:uWLYb5nFWnQjxn5Q/gnQierNnknQOkEnt0GnQTbnhnQdCnQt7wMBLqnYnQ7tnIYF:QQ/sdC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423065289"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D8A5771-1CF7-11EF-BB79-CEAF39A3A1A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2092	1876	iexplore.exe	28
PID 1876 wrote to memory of 2092	1876	iexplore.exe	28
PID 1876 wrote to memory of 2092	1876	iexplore.exe	28
PID 1876 wrote to memory of 2092	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d255e3524fd8c31f00584bcd1c041a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f3fbce6093705f48d5980bb1622afb8

SHA1
be737b1b46ab57d54053a5e3fbbf72119c86a156

SHA256
ba16e1c8b70c6c7a6eeb5f6a49dcf4e31da7b12ec4f2ca8cfed48c8923bed384

SHA512
0fad2f46941ea9bd35ad9fd691383fcc969362c159a8358cfd20652210f85a0acb1c876c0efa11486c97bdf8b598225ee811887cd84e7af4738ad42a81c2d890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75674402d3602e4b6c0c66a25524ff92

SHA1
a6c46ce317e95a72aba808e47c2c650c720e3838

SHA256
ce0afa571765a224608bb449e4e0fac76ed7b61d5a331dab946b89636e0ea8cc

SHA512
8cc6d7ddec40438f74ae47c6f58ca438fe9dfebdd51cac62206b35f141ead962410e17a44f8dde9feb1e62208d1387960c75dccbf5b593d06ca215e30f25777a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d1ef5a4119450f012aaf0e5b503c36

SHA1
d20c9e8072fc2bc1c887efe00f0fca1e27037492

SHA256
779e74ebaf71f5e418cffe00a56714ce007ca71d2a3d0f81f9b445614e531b89

SHA512
82d0f9a03851b4ce409c09c8846f46bcacc9118433f779278af6f1fb6eeaeba5caacaefadff089b876a1ee6f66003bb0b01c8f9d45962ede49417672d323fdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
945f7580e46b3e4ab508b8f995a181b0

SHA1
4a1f0254d5f2e5a9338270ee63f51ae21863339e

SHA256
fea1b0e2646e23d4c1ab8b5fb8514187cb9bec3c5bec0494cf6c24841dc0bb95

SHA512
5202428023a729ae07bd30a403847d54a4f2259133850f7a7042dde380a805c2bd5ecdcade43d116c1ca62dee52d471dffb542e74055f3a203f5dbbf384cfc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f3c20d36c72f5e45dd385807e60fb4e

SHA1
f528aa458303e1662c7ff5a6392824853be620d1

SHA256
95ac2653769909f7c06daa09104cb55e8367c2b6a2bfbefdb59f9f2c2dd03947

SHA512
bb95c0b90b1358348194edc4530c2ddb6ce04d9be126d0c05362e0ac9ed2f40557b1e5aec56eba0b07b2335499b7d7f188e8afc8d4c7e96e625bc11e9af27630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33ce3e34afe74d1d9c13eaa5ae876682

SHA1
a76dc9526bf0d39b0a7ecb8ff9cef86eb9c68965

SHA256
4b72d4c21d747836b386c72f2e93e9ae384810988deb4554066049413768d4fd

SHA512
e195295cc6afffbdfdc20036f4b9125d939d52e64ae51b42da6a8b960c1a297abf15da6472dd914ad0eb9f1c0f514ab17ce4dbcc77818f7619d23803c14062a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
453d6a0a3d812dccab43426ccc18c1a3

SHA1
4977d5b74b459ff4c78fc29a8b8d2561bc62edde

SHA256
a8c0b412456bce6e29debd5586164284a3bf74cea5591e9b5967e6333ca9cc91

SHA512
c0184ca4f15fe1b94b25d1200adfef9759583a8c30c7d0c2a0ae793c645d4f1f014e81bba68c5dd0541b635e46f616ffc5d820fe94b8cb18b18ecf4cfeda8e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffedfad429b6fbdfe1e7bc7ecf162067

SHA1
b797c671596ffca610c005df6612ce5fc1069efd

SHA256
0fe2cb05d7a7163f86b973af92a413570d9eacf3436fe4e07338596b35080090

SHA512
29600dcbf0c99577522208c19e168eb9300907712aec1a499050386333accb0fd0af8289286ffce2e46d2b6f28f56396ed40f283aa844922d0bea660d9b8beb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4b00c75262679e4fea04e1e7f29548

SHA1
ac68f8377083eee7f2ea360478ad66eff2b36a5d

SHA256
eb2d5dd0d7f59041ba1885dde1c6ffa20420f60ad32cc875a2735676d9962b16

SHA512
50fbe9682602e05cf802bb51adc72d56fd04fb6d1ad275039813bbcd9f5d58673a63d20d9d00c2ebd7f2105fb4490ece93a32c2d79c4a37f19b798546c28e043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3b06186f67e9a0fb221d9cb30a92a44

SHA1
a553b78de168307cb1896f9b74a8784e614133f1

SHA256
c818eedecfd50c760bfe03f008abd48bbf97b58fcad291ae5f3bf64c48013276

SHA512
74fa44803da248cc755e5f7893d0a94fd4a02775a643abf92d011515104e9b52b425e55a3cb2aba9ce775353296021a6da9f94c1269b118fe474e8821b6a04bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D60.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit