355fb018c759a2028211cf3e6de306d0e9cd82c8795f41e6ea4e4309b60b73c5

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd343048a6e0dad3d029000e008988e_JaffaCakes118.html
Size

30KB
MD5

7dd343048a6e0dad3d029000e008988e
SHA1

904bff889d1c9568fbf843bcdf0d0d305646c76b
SHA256

355fb018c759a2028211cf3e6de306d0e9cd82c8795f41e6ea4e4309b60b73c5
SHA512

e0a9cce73f425e86f7131f564082c43fcbf72953fedd933b9c708ab0fc5dcc0385c25fa33e0b9b46ba7609c5279dd5f17842f92766866daf79a7323c06b9645a
SSDEEP

192:uWTlb5ngCnQjxn5Q/cnQie/NnHnQOkEntU+nQTbnlnQfMC6A6jft/pNdozLY4c9l:sQ/dg9ft/bKzLY4Uc6jKzDGTUvshOju

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423080196"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{123689B1-1D1A-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2636	2836	iexplore.exe	28
PID 2836 wrote to memory of 2636	2836	iexplore.exe	28
PID 2836 wrote to memory of 2636	2836	iexplore.exe	28
PID 2836 wrote to memory of 2636	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7dd343048a6e0dad3d029000e008988e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb26da58b6a294aa7925b67a430b70ec

SHA1
6fac8e3951cda05d9682419deb09bcbf04adc5d8

SHA256
4ca1d624349c94d4acd80e8dd3408f7597be0a5c525cf22adf8053663ffdb86b

SHA512
36680b3c33341791ba0c0febf2cd1708cdf8bfaa2dbbb29315095ef6f5d0117e9010878b39292763783cdaf7c5f5dcc5d503665de3c72da7289641a540561820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608c9c79f7dd154b0156f860f168fe60

SHA1
8ff73d1fa5f16c8af6c47c0d767bab9d665debce

SHA256
b7536bce3b6ebb713cd95e37fbe6ce77a4a421b7a4b5e6c4c4efc1b4ea9856b3

SHA512
317fe9c3d5fbe080583400d118e807a269750b5fc9ed524aab32cf4500d6d9631065bb8ac5b04c02a10daaf53b38820e97a3e450c09f3f64f8c2425ec1f0e43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0112bfe9c1169e5ca3fd3bd61ad98e58

SHA1
6d2fc03b8397cdb5f6894db6f8f8362a8f2ed7c5

SHA256
3f55ecafaa461d786b02b3f23755b6db462da689ac6c36b2cc88e662a6189e51

SHA512
2db0dbad0872e4997d96e2f9ec664d5853ec8bea76fd1faee5fbe491af5b9a6a7fb1f59d6430fb48e116001e11231d15e627f69cafdb5ac7ae3780371e645540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c812a0ff2db47ae666bd5835ffe8781a

SHA1
b48deff62446c7687b1c0384dcece8e4f6e1841b

SHA256
5853c05215afb1ae50b4a8af649de1abc01387b3b88576366da38f62d73a2dae

SHA512
0e889b4a9ef36823d58759504b3a55de13a5784b47edfa5f91ea79d88c780b70a7ceeeae92018d9ce97be3390dc2b66ad17cd669050d36dbd2f6e6c0b0840147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06c87e45b746c2c8ecd269023581e3bd

SHA1
960f08d214211b104f05a538812a423ac376e3f0

SHA256
cc978213b32aa00092846a0a23fe6143449aeb8b50bfe0704572745d947053d9

SHA512
6240a9a77e85d47c679cab5d3e4d1c093dad30e5751a999253b871317b3c052d5325c3548dd95419535ebc5cb02be6d031745985eb9f29511e51817a1ba58c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d402416da167a251c181f316082ffc65

SHA1
4f67e22ed464c6908fdb32825514e7984373e6e2

SHA256
9b7fb2e47c0379669ef37045798694092313ea40e4cfdd9447d30c676e717e06

SHA512
179d04a3d1846917ce5ec933009038b85e9b19d58341bd9a2e6d0f8bb9741b694bd2aeb3a9b768830de0753fb2735510337fec29719b32ea4a41f3dad71f6acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6debe9bcca07f6411948a16383d7c57

SHA1
451e689fb9a6189aa1500096c4dfd511b960ff0a

SHA256
87a9f3db988d38ac44d106d0a89904a817b1966f8524f38a44c3f7c7a9b80c48

SHA512
8afefb710bfacddc5ef83d296830c7ddde6fc722e3939e71df9fbecd2eca0001e57707df0cb29730c6b23905f0648d82fa9cd1a7c95e0da4111d544c8be4e2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77051421fc3e6ab8a594f9919e702073

SHA1
11a104aa59bcce9f1e8de93c7b29ddf2dcbb05ca

SHA256
6977c7331ac0e7f8b25521eec7801204c4e6ee2304038dad76d57f1e542e74d7

SHA512
d81fa67045f00b6e794846ea98c071fd251b96bdbfb2e378ee0f9169feeff910351bfaa516e7ff6ce5fb3569440d62ce8ce6a1f0a1d7c0bc00a6770129e5d95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37348c26b9efc0ce2fdc062ad4e993b0

SHA1
d6e4f53d76fb8b79d20fa5d35a3a33a6b3e41f5c

SHA256
c2539c280bfe05a2a66c09303dcf2b26208166f198e5dd16f472102ac69f82c0

SHA512
70c92654d76c79f33bc55583598ca78c7dfba49431e91be08ed9a606874d5ecdc7493573b84a506c4f1dcb35c061aab37231f3b381bf30f804f609021d26779c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F46.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2022.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2048.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit