9d100ff5c1b59d5d3b888385a7bc62f31e3ca050003bee0a96148710b0c97b6d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d8e47deebbedf606a34ac2f0c498a83_JaffaCakes118.html
Size

26KB
MD5

7d8e47deebbedf606a34ac2f0c498a83
SHA1

f00d9a551b56e54844317dd405eeebe8ecfad9e9
SHA256

9d100ff5c1b59d5d3b888385a7bc62f31e3ca050003bee0a96148710b0c97b6d
SHA512

653271f425526310df4c84180f3dc4bd4c9e0376852d542fea1e1ad5f9f55bca2341b21224abe01155099236361575db69af1a6e955e12b81284ed825b04d9c6
SSDEEP

192:uqKn3Ub5n62nQjxn5Q/JnQie8Nn5nQOkEntTTnQTbnBnQ2CJVevo7NtjFo+NzQ4i:nkQ/Mygc4e25

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31337E31-1D0C-11EF-BAF4-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423074235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2564	2868	iexplore.exe	28
PID 2868 wrote to memory of 2564	2868	iexplore.exe	28
PID 2868 wrote to memory of 2564	2868	iexplore.exe	28
PID 2868 wrote to memory of 2564	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d8e47deebbedf606a34ac2f0c498a83_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6210ab10c4b67db03487e08579b69c9

SHA1
f8db60a770ac6da0fe63a867eae6c0cbeef74d10

SHA256
2b22c68425d2a9580bd632a0cb19eafd3ee001e57fdb1b276e1308b87c2cf13b

SHA512
dcae5d0f0917374b3f0d37b1af45520e4548cd3eaf969c7bb052da754f28961a655584bd50428629f385cd3b0985a4135ffc7965a4fbcd1ebc4f774b0c2e0e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ecffc0023addf1bc0e47335edf16ef2

SHA1
6f3730b39351d9bee55696bd81bc2444038b65ca

SHA256
eb9ee1806755897aacb13b493cced68f3ef71ca65ea6f241c618baea64553515

SHA512
1b6bfe44976ce86cee0a5a6627d85e76c07f91d866fcf477fa0260c0ded2ec108804810c44de724c0b51e0d2f0ee938659a7c6c5b4116e12c968fb6cd25d31cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d2e1e096f0a9ade934e2a1de016c4b

SHA1
d62ac9bc6aa05a9eff08e2bd3325a8a299894e36

SHA256
28022ba15f0001a2616f238addd232c056b5999505a5214d1cdc8be796acb460

SHA512
b4ce1e98685e614fe66246bbb4d5844d35daa2cf6012f685d196a2b0305acf87362d2fafef69f0ac65fb5865f45efc9cb85a0a466e3251f2307b15e76c7ffb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e723a96e2579a4d85f68ccba04db20f7

SHA1
c1f43bc17bf8033ad5823125fdb0a51b0f16986b

SHA256
7ab90adfd9c19d195c6eccd05ecc1f295f2add5046176783cec7631b6009f029

SHA512
da5ea477edbf68db73e8b1013a9cf050b6bd765b47a4b2db384f11e80349c1a3cee339200d9107746a2aefd0e47104ce8b98c11ba1691545f421c1d8e73a3089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0367f9a3314527ee702c0c8351be2c

SHA1
7ee90cf546971867b04a4dba31b563d732628411

SHA256
00cd004f95d3bab56bd14e87683ad2da4b60f41e89ab41f1a7ed69bf8e2a3721

SHA512
14dd860110e8c65cb71698ac38961d125a7f13264e91a4241107ae6b4eafcf2f7a0066b9a00e8f91f6048e869073763a8e1df97bbfc409ae5cc6ec38770c2953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
add4719f4c796511e1819ba06014a520

SHA1
c4f940c8aad519722cdc239f2057309a902eae8a

SHA256
7872082a662e34df038abc9c99b02e8d096faaf3ec198a83a1cff9955b82cf90

SHA512
1ef024e43dea872e353eb4197145b9f53f868c81afe8de7c7f54e2c4b7fdaeeefca08b43ce3055fe0bec15af3391838387b119a900474158d1e30d1e405ba0a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed28019558ac68939e5548ace739acde

SHA1
163e91f997d0e1e435a313069a65c967d880396a

SHA256
4791cf648e5625c631ed5e465833a035886e12ce371333ad4635ea31872d723c

SHA512
000e15322856e1a9bf130a8b44f2db13ff827a9f580da54c9e343f385e374f857a40f10e4269fc15e2b739fc4b76ef43be1945beeb1c2c8ed69faf5a4a7d57e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee49bcf855fcf1bb814f98676389ead

SHA1
1364ea3d6d6c35c2f5df2c0b6d565ed92aa60df1

SHA256
3d03e2ebb2f337c11af4a6d2a45df0c6bcd06c12dd5c76f645f037213e7d6d77

SHA512
3c344a4df70576e42cccf03f47f591a98af7195160df69854185e9b84e3eaffaef3a23a723100187564b12fbd34a4cef4e4de9413282fc25bd1f3948079b8f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ccb3e56b6051686187919fbd935123

SHA1
c68358c24bd2ac49a20a7794217a813086ef61f9

SHA256
50c22af1a6af59ef8bba20d7b977d185ee8b95943061a4c323f8972141aadd06

SHA512
0f0d940a979c7bf78c57bdd8cdf76e24ba896fa65e8cc5abe5b0422ee5b62d732605b53e2fe918712e38502f329aa0d01e9ef17e82e4c7d77abe6e52b462e17a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab251D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25EC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2610.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit