df5f6168976737aedf1a14a6568f00b2dc69894dce4123ae9a7165f422982257

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d36b543cfdaf43074b2a9fa18a59043_JaffaCakes118.html
Size

142KB
MD5

7d36b543cfdaf43074b2a9fa18a59043
SHA1

19b1fba539eea0771e431d8d959eda68ec5164aa
SHA256

df5f6168976737aedf1a14a6568f00b2dc69894dce4123ae9a7165f422982257
SHA512

8ce36c013225d097d4fb7357cc601c5babd8400eceebeb423a2b69121b30d1d090d655c966d10a75d423a77856e09cf106fd09192d3bdf246c37758fc218fcaf
SSDEEP

3072:SODKIRx7dyfkMY+BES09JXAnyrZalI+YQ:SOFRx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D793581-1CFA-11EF-B85E-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423066633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
112	iexplore.exe
112	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 3008	112	iexplore.exe	28
PID 112 wrote to memory of 3008	112	iexplore.exe	28
PID 112 wrote to memory of 3008	112	iexplore.exe	28
PID 112 wrote to memory of 3008	112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d36b543cfdaf43074b2a9fa18a59043_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cde564c9375d6550c399c4e797197aa8

SHA1
0870adb427e3c69b334b5820c95e571fa36f8ae7

SHA256
1b64edabbe59dd0f1debf9b18508e1a692f850579292b1eca0606247619e2a5f

SHA512
91c6dd7d97e4e04733399d50c9e8e912140c9ca004f2e8a9541fe9a0aff13718d870b7c0ed2b50842b1c38ec0d17db99e17ca63707302c3da2419a97986a6da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5187e1b27f9d40ac637d15d41ae9f2

SHA1
cbcca8663dd1fc5f0d1ec49e28c79cd14e1cc7fb

SHA256
a1d26a1757c0dd7bb1b018bcff80a9f4e5b0928e775658a05653e02363f4500d

SHA512
498e39ffff7cec1b95dfaeef7c06a5574be00f7286783c244b7770bf36152afc9dcf0b3805a9442209c4a310a4b963257ea9157e73480f2838ed13aebd2db62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0dbc799e5a75cfe87f2aba635ca874

SHA1
e01b5aa2ba5724d2b7effc3620451cb5dd24890f

SHA256
06eda757620f88da693f3edfd2fd959df83d116460c04c4f01e069cb2f97fc42

SHA512
e73fac112291c182da9340dafe136838f47aad8e93d55f4e3d773e7f885f3fb0aae7c2487529d268216473fef539ae0a6dd77bcf067530a56dba935f1a64277f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f659d705a2a5f539ec3f612b35d543

SHA1
26cc1b4b7c737e3b4b08fd08d11c564c14b6446f

SHA256
08714772cfdab706370f70dfcf1f23ca08fa5f35b27fb80c100c899870ac7b2b

SHA512
76a28efb4855312784651ec27167b6a0f00a3644c8b246e44f1b967eddc1835b21e652f00843871537ae77986013816e690a4b8a82b28e3faa7968240bd9e721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eac079216f3f05f04832985e2b1b1578

SHA1
c0998fe664f8b9dc5df1be1215a2b093d647caa7

SHA256
2c8081f4cb166405a4525c6a20ea7b74cbbfc83a462f592e3c70171d7dbdaf33

SHA512
18a133d91b2b410e6666750709bf6e961754f9f7e9244e8fe2f7186bbca9d8a8446e66ae0a5795cdb6ae2a91dff02888eb088b9e786d5b9f6adfe99b57443438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3821f297495960eca1d385b1857a647

SHA1
dfa5176c7061255cca271f5072dddba087e40de8

SHA256
3d54ad90a29a5f9307f57bb9e11664cd79d6b5bd59a25fad52cea867deb24248

SHA512
431a0f05440cfb774ce922c0160eebc569b60910021d8f789f75b9a105599515d3ba2464787fa67446bad34d74e1cbfb2ce9dc3c6c8aee46d3f2e17b3506612b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9cc9e61d2e557cb5892733d7149c140

SHA1
bd8dc4162a7d79bb863144c33cf18b0fb8e3a9ad

SHA256
e217dd4a8412c16976be3aed511d6877f3e3f1bebc6a88cb8a01133e2ca322e1

SHA512
57fab72ef29e6040cf0b147a23bf3977c5e31b19c4d95c389730943b1ebda6be45a831bed981c94784063ac076c7765934688af16bf1d8b042152203ac39c358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc343a4543ffe009ab444bc465656833

SHA1
99f15b2ce68bc2d05f2a4597971a86243378089a

SHA256
68cc55da4084f7f2dfb874e35fda6cfde07af5f94534b30e481e3e66abb731ba

SHA512
a9f152b6afab15c262f5f3fbc6ff26958f80d885c5a41b0242850f92147f1bc80898de985a5569ddb60d1ed7520587de547d2b19a8ef6bcbbfd407cb8b8639cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2454.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2507.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit