2656c2db344d9b5cf4b22c90d188df395d0b0d8285942fcd7833eb3baf9a82ae

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7de6e3f946b1537c94690e20ed5e8bb2_JaffaCakes118.html
Size

146KB
MD5

7de6e3f946b1537c94690e20ed5e8bb2
SHA1

d15418af24ea9aedcf5a5e63b46606bf05f3a890
SHA256

2656c2db344d9b5cf4b22c90d188df395d0b0d8285942fcd7833eb3baf9a82ae
SHA512

50f2aae07c493bbec59b97799f896d5aeb020eb72c208b62659b11226932b3f890d4e282d295e1cee6300b8be11c20dd064b6a032aed8ec9aa826228705f232b
SSDEEP

3072:ro00AuKHMx+OlyfkMY+BES09JXAnyrZalI+YQ:7sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423081824"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD239341-1D1D-11EF-BE4D-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2112	2120	iexplore.exe	28
PID 2120 wrote to memory of 2112	2120	iexplore.exe	28
PID 2120 wrote to memory of 2112	2120	iexplore.exe	28
PID 2120 wrote to memory of 2112	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7de6e3f946b1537c94690e20ed5e8bb2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4120b234c07de5ab8587ec11ca7cb509

SHA1
a865d8d6d0594d199a187cdd367ed2ac6ae6c863

SHA256
89b457310775379ab87ae94044489c8262c7456447ea5b0ee7b98b933c58d92a

SHA512
039dc132f5b9d82188eb9a2a8281638cb683404296630b13a6d59581022621b12aec1b2c24fcea0dd768f9dd5c985b88d6d57d747dce6e59eb2ee3e0c2ddfe12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d93571fb999832daac79128a555a5a0

SHA1
9d66d733565c6e9815ef18efe445f546e7312a89

SHA256
6bd6fd897cfe9843255335dcbca5938c99f3a9992d4252c85e4cbe46b9d1ccaa

SHA512
33e41abaf5e5d2b47dcd4d23bdebce6eb0af66c172c8feb11b54da6564b82ed43c238dd946f42ff39e61d57184b2d8491435424b3da217ff0c5eeff8c2434789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f45f5eb12040666e885493632adced

SHA1
959fa0cd2aa2e5899429533ac26e37dc0853f9df

SHA256
dd0198d28753ea63bffbd8cc0a2cd973ffc286bb6ea1208044f8815c920879f6

SHA512
b1a995549f2ff481bfecb550ad0be68d550f9ef2857e0d42d995e83a17a8949b8d353db62a7af15beee7b13f65227a150694d7e8127d582e3a1e5b295fb12aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b91e995e9219ca3b09b35f0620fd983

SHA1
3137afbc29496659040f5fd9f98cbc874a4f8860

SHA256
9f917068e4e612203ac522ea3b72c5b6ea4570d9a9b6658fe30381b17e29d635

SHA512
79968db9a81699a88594c1d4fded37994c4093e675bfb9fdb28814c6b2a59dff7c00d144dfca3fb10b055c965bf907df278ec88e56ecaabb16fa9889a2af070f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0a76409a3da6db1f1c3cb997d1dd88

SHA1
61201ab556c9d2036a320297e6563a13a5968cf0

SHA256
7fc0c292c275a502354ec596e5f4d34e45b019d33fbaca52d42fbe566dfd0562

SHA512
744c9694c9ab940b0fe7ca0dfed0666049c270cd4c2fbdc65192ac17a6afd1e983fc40894a573f2f7d06707ff8946445b3aa1470c9f9c591889ba2c442278a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96bfc01f1ffe0efb126af015777cf89f

SHA1
af3f67f02ef06c8c1cb3f708f4e102cda88890a3

SHA256
0bdbf3373e3f3c6982c8e9dcb0f840622737773e5dff2b3d7f2a84dc948ca50f

SHA512
efe29bd20253ec0452c9e3d8ceda0fbaca35eba780f2a3bcc1274e51e71ead3f246cd9c4bf4e1b03a730ff89dba4eb41c39f2645d2439899ea0de4f112e54238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636965d7ae0f3fd00fa28b855bd964f3

SHA1
ee2e40ccdacfbcd2db3ea5c856cc7221ba7ad75d

SHA256
b888d06a2603771033518bb37795271ca80e7c008ee4ad8142947cbb5aea8e7b

SHA512
56468549688d921f2acca0fb0439e9774b91c79241b2678bef51f9c5e1091ac7146da2a28f99f562fbae0cc1dbbb9f8eb563d64c91e6fb0801c64ade8ace7a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
987a2bc3b313494fd4dd2dd54de24dde

SHA1
8f6656c86d8dabcb88663055d8697986f15306b5

SHA256
4dd9ab3ffba644654abdfdd1997ba90f91d16b1156455dd4314a0e5ea229db35

SHA512
1c00d9a723546ae178744b6e055ef915e81179523c500bec8e4ef378e9516d1ed817a8b65a8739b373a283b2b385c68c2f13d698c4cead21df3fed90f24c8f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9208322b8070ff67ada8052d21bbf197

SHA1
67af2c524c52a71bfd0fdfe985a7b90f501411f1

SHA256
a6b89462bfd828d133c98764a81cb31c61bc65230aad966b37c8e5c5d2d897da

SHA512
75d82f760cb929b4502cafac0d7adf10e98dc9f44403424b1ba70c04b1a7f7a807f00089fa88ff8a36dbb6e2dd57f636b668ea134c0abfc8d09af7e3eb116fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72297bf4521edbfd3693be91fbc004f3

SHA1
42bc01d64032c04cf0be8e45dcaebc33418e1e69

SHA256
51059d3e378d91ab51fd79f21fc3919533360989c151af79cbaad7f59c8938d0

SHA512
efed08db075e25cabc2149e95dd9583ce0f7b710a203993c0d92b9918a2a1638740fdfa88e5d1799e9df4d68c260d983cca5b243852439f88313ff004d59950a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D12.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D15.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit