a2cabc4a846917301256f99f60d3b753bc820827c674af18beb9b414fbac5c3f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d9d2d6d124f8bfa5111b60acd193edb_JaffaCakes118.html
Size

23KB
MD5

7d9d2d6d124f8bfa5111b60acd193edb
SHA1

72fa0192d88a9fbc94a09555304ce7d111252be4
SHA256

a2cabc4a846917301256f99f60d3b753bc820827c674af18beb9b414fbac5c3f
SHA512

1b50948d7d08d39a52dff488cb8d8239cc775e5a23d62d5169c4494480b86774849e8ec689a93595b5e562eecc438d2386ee317b7199ef353306d95ce323dfaa
SSDEEP

192:uWbYb5nUqnQjxn5Q/znQieSNn2ePnQOkEntlhnQTbntnQMCnQtQwMByqnYnQ7tnD:lQ/geBw43

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423075340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3C8DFE1-1D0E-11EF-9E38-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2068	2164	iexplore.exe	28
PID 2164 wrote to memory of 2068	2164	iexplore.exe	28
PID 2164 wrote to memory of 2068	2164	iexplore.exe	28
PID 2164 wrote to memory of 2068	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d9d2d6d124f8bfa5111b60acd193edb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e250f51591fecd97b75426c6586dfab3

SHA1
e7f639ecc656a1f675c75ec695dc6245586140ef

SHA256
51e9ae32c85bf0cce625346e0d381a07bc7643aa2d79a87d5902f624faf43853

SHA512
3d6063d28cc1ae3e2d8be068131a0569b693ddf89d4579e2687ca8d88a33f112cecde4044a02eb36f80e824d8e7bab1596896f05d81deed7a79d221028c063f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9742890a228b611788d46e245a98909f

SHA1
66d55b855ce31c6e8155e432802d2adeb8d44a63

SHA256
71a19f3126685addb5c40e79ac6a14b89765fad0365fe9bab2f1a87da79f38fd

SHA512
44530eb3fe2fa2e134f5066302fbbdea8ff3c9906e71f5306a455e78bc7cdd0d22ea5ed0c4734167859a4e1fb3a6ca42dfb0db2a86fc587f1ee598ddc057183e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153682aac3af55334cfab43772f6d90d

SHA1
acc2b67e177c5ddd4c6cae22040bbc2271812dba

SHA256
9667ea208e3f106ef6375d5c9f6374972dd2c400f0569008c3cd205be33d4f4f

SHA512
1dd21ca5b1ffab7366a9345e9c9310fed81c68b029e9d9eef752088df22bb0025ad32fde5a0ce116575f7b81a79f393f0cd392cdc4060b62ae01e5f6fe46d770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8c9f5c107a0d4ef2cdffea01bb82c2

SHA1
00bf3a971f73c606c1d45b8c99c5a0b4897c4cb3

SHA256
66dfe2e4c8f3d208878a45807812f5a9046c196bda6314232b69240124db4353

SHA512
1018a46b3279eaf640f7ea7e0eb43971896a44a046ef49b7e292f13631c4dfbf930cdf197e8cb5a698b5ce6bf7d8dcfcb2796f5037119d44a731a4aa36c724cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650d7906ffe3f7c41b9166de46853d72

SHA1
460a999d802c7af1f0e43917a8906b08326ebbc8

SHA256
a4b21f35127661212cb2db611c7e376963f3ad5a378d7893debd117d5e72930d

SHA512
e46d0ca72c3672691d254cb1707d4851a20116f30bc0a30eb892ee49510322a5bb835832291af86be9f9f3a13eca8453d3f4f6763340376578e8b73a3c4a4c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829e1b01963fb4b089ce82d5be629237

SHA1
02cc62756d569cf14a9bdb9a4de4b7afc94bf99b

SHA256
30d6600ca46ccdf4a81ac3813ccff6a4bcf1d75b722e273c17a1570b96aecaf3

SHA512
91f3bf437afc8f0a0f19ee54c1260dc3b3ad366ebb7849f3ac50bdb1507eff1acbd533270e77a8923b0b5e1c587022bcd969a9535770084694ebccf91036ca14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4f6b21ab7a2725a79df5d20d26fe72

SHA1
a31f120a16b5a119fdfaa887c9539ad337b1fb8a

SHA256
734bac1bd1ec7a24091caf4fb54aa0300057191cdfa83748c551430570c1f119

SHA512
2e8d62d3dc00f8db18dab55ec2f27aeb0b2f1ef7e4f277e949a15c855ff31f82cc2bebae247adeed3c583574d7ae00442eb0dba2ac553e1bd86860bd214cfaea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea810b3746049c31cedd7d1d6b17c58c

SHA1
3afd13235a99d5a5cfa47e268bc3a921fd34ccaf

SHA256
a405645cb2c86c546f6eb155e71e1ed85c589e8da573de142e48daf0e5a3419c

SHA512
a03a7be84aecf8cb20b436110b75239bd612dd84cc105701dbe2babbd0b9fadc37ad81e81264671d64206fd427fadc1821b7f6c677abcc1c3ccbc52fbef8e098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf68bf7cc7ab328819d023fdeab467f

SHA1
6978ed7b512958b6d03cf154e0d954255e29c5f4

SHA256
45971d88259967cac79c35d3a4a05410e83f2f4f1961e75c42ccdd772ffba2fc

SHA512
2c241ad8c3f18c8d471b272eb272d39e1d641370a20067c4e71bc9794b6c625a8371a789e21d19700c5b71e3faa15049a6118ece50712f6d23dc44ceebae9167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2270.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2362.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit