6299d79f224d0482f8b7249603758afc7abbc73dcf6ff023dcb53fdf95cffd38

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e316ca706cbde14c9deab25502bc3c4_JaffaCakes118.html
Size

27KB
MD5

7e316ca706cbde14c9deab25502bc3c4
SHA1

a42cb414f7d8a5063db380597610dbc486316ca2
SHA256

6299d79f224d0482f8b7249603758afc7abbc73dcf6ff023dcb53fdf95cffd38
SHA512

796bace09a57f14f1f4e36232c51ae97011ab61f8540fc5655febbeeefbd6e06c24f0565405f4c868c1145af20b6b67f06a8665a9f818d93050e8da3885633e8
SSDEEP

192:uwT19IelTMASb5ncEFRpNAHD0+tUAWnQjxn5Q/y2nQie+JNnT5BnQOkEntwAZBnp:XQ/J7AuYZSSdNq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2F03C91-1D2B-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423087794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28
PID 3060 wrote to memory of 2660	3060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e316ca706cbde14c9deab25502bc3c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a203e0875b4b544ece797f31e341ec3a

SHA1
b5f7ac124578c6d8bdca0eeea45b5a313274e39e

SHA256
5729b005c0ac79a00cff29aedfd8971163adaa65aec8171893a28d4283341f5a

SHA512
4fd44e3484796f000e10b8cbafeec1f46bceca698ff518f95bff4f76c5beefd1c7e562151b316a879d6b83ae9f3956aac58ad13f50fb23807fe60378e5bf6440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8551ec219ee81eb78b24ee9ed62f4dd7

SHA1
98ab5ee8846df05e96a14a6f4c27668ed8d5a5d2

SHA256
48c2e568f52bb5a3217a54ba02bb9d671971d11cc0d3c9fba610f094608a2672

SHA512
51d2423f43c1a46844d5aadcf24f5f2e5125638f82c4f90d589a2f59fd850927d4a22c3bc9e8cfe63bf759a9d6ea56e33190059cb230f131e462334508a960ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
121193f651a43996f637cc87d1629426

SHA1
5878ab9d9859a1e90813641b211310d37877f351

SHA256
03e0d53386e917b02fa10586d1f6e2f49eca28570cb261850bc46a6dc3f66e0e

SHA512
69d630812c84697b30c4a527faa19d9f6577da3af464407070c4e2e2a0150521f0a0c5a85c195d26f1591e176eef352e7c81dec3f8b564a2ba032853643f3834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0bfe57be1ffc3374819b18a3a861853

SHA1
767a34147ce0b50b9ea80b4f426e127a712c9513

SHA256
e2e8be609b7d1101813168397794992e4bfabbda433c2cf13e52b6249a192204

SHA512
07219d14ae25d7a2e613dd5ab1cc7488589847ed48250443a1a373ff5caa8618fef1ad7e35df9f4f7f7364264cc200fe6ae0c689ac4a0eecb198005c5b05558f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f29ab5fdf103d8eec533b72aae8bf42

SHA1
c4fe9e591ebce76575965b1411eaccb899691d78

SHA256
90d47d6344557b949fef962a7d5bf15a41f0a6cddee582fdc03952bb1914af34

SHA512
d9ed256bffaac46b07bf49767301e82c940fc8fe10b5e58dd356be0b8ea15868b443fc4385af6985f32ed5147f1ac878bac2c088ed43a40e6e70da8e9a712714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8961aaaa813cb9495e281abfb422ce8

SHA1
1ac6fae85768e771b0bbcc7112245c22e1e74474

SHA256
8ba56b1a3464aee202f2b53b62741e67fbf806cec277db811e2c9216b36523c3

SHA512
97f056f5497745609107c39f7e92ec0067c3c0c341e1a9a1a49ad1caff5e1e09ef13bdebefa103840377a46bfe28b1367a27cf06485e97f8a91cb4bb2d9bbfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92be68985d02898e1447e45ee83b5fcf

SHA1
1e1bea810bad3220f5892949cfb0a5e3c2c853db

SHA256
815e85297baea03da830184ef1ed10ae0812b6ff22f8990fccae91727cedf006

SHA512
fe5a02d583cfea421f5f1c07f639d71f1e0dafc22e441ba0adf16de4742e33b15fc697a250c4a5cd770eb04deb4780447add927c7a6c4b6d9cabb7cf0e435230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26485e17dbad6186ba976e11c607ebf0

SHA1
d80e27f6d0b90fa6766a696c0d54d881574ffee2

SHA256
0dc2d7774265a5fc660b77b79a92ccaf00207e024db5bafacc2b42edfb668790

SHA512
2359b1e28ce181680b64c750cba627c6ef9705dbd3943c9c0bf6c43c64a1ae7475ef2e8106db458a39ab292cc8f963de2da9d41f3dae34d7075cc570309ddb09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba35fcf27614d163b495224ba05ec4a1

SHA1
4d9a9d8e04b1405d928ecdeb297b65f3ace5a8e5

SHA256
e38f0170a093917b088cf797d6d231d8db91255dc637c07cadc4735df8e7e7b8

SHA512
ba272551f5b298b9cd8f2985d36ac7714b631a68621e87d244da5c33dababda5ce7699ba9b6224a573dc0afed7a25f5d656648481936751420204ad9bec27ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709d6cdbc52872a184e5a46c75ec8184

SHA1
124609c6928a6e4520861e73d55e94a065962d65

SHA256
4e5059b77b081c9fe11d9220f21f3db255b11b2b031aa068bb3646318b962a84

SHA512
0cdbf66eddf7c7921c9606625bf9a281779fe1c2794153411f542e79883006ae5a69b03db50581f1cf2068942502461b5fd0219c7ca44f604f576baf4e3e485d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ac9fc4313f001090ba15208084c0da71

SHA1
942c0d48e328f1c12e927e74dde8c83e0832fa68

SHA256
20c18ccd32ca7e79e983e7c0186c4fd0da5b4c1d34ee160158f7c53dc08c0832

SHA512
ee33cc5f82a72a26b31cb5f5b32070b28c68343493185c8489fcd8e9819308f26b001ae12cd76e7c97a81b2731d8d09276b0f2e61322b640a284aadfbbc6e61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AF5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit