dd1fd031d31fbba3e54fbb434bb35a4669e8c91f41fe933896b1453d83d2fcba

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e369e59fcef2793c782fe7013ccb9ee_JaffaCakes118.html
Size

24KB
MD5

7e369e59fcef2793c782fe7013ccb9ee
SHA1

d3a4692879807657e893d1f378e54d0057d21214
SHA256

dd1fd031d31fbba3e54fbb434bb35a4669e8c91f41fe933896b1453d83d2fcba
SHA512

8a5edecbe77e5338dccb37f2fd8a13c371ed3721af7c4114147ba99962797c6b6da99cd367f75c63ce72d2fafbc356e235d6b4b9afc25a1a602542ff5f82c6e4
SSDEEP

192:uwP0b5nuGnQjxn5Q/tnQieANn2ApnQOkEntrrnQTbnRnQPGLnLnQtuqMBgqnYnQm:DQ/8AbG/qN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423088234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C93D3931-1D2C-11EF-BB01-66D147C423DC} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1784	iexplore.exe
1784	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2724	1784	iexplore.exe	28
PID 1784 wrote to memory of 2724	1784	iexplore.exe	28
PID 1784 wrote to memory of 2724	1784	iexplore.exe	28
PID 1784 wrote to memory of 2724	1784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e369e59fcef2793c782fe7013ccb9ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8de262605be1c71e06651c5e45a6f03

SHA1
ca38b037bd0b6cf7121ee51b58bd9737948fdf88

SHA256
7586b57d8780fb64d3c77f5b49adc894d8680c47ead2af9a4d9b9a0ec92ad05b

SHA512
5c788181a2325007ee74e65524506429437e84c7f7985f26bd8e4dc37355ae854ea4f1d069391e3cf43333a3f63d3dddd575eb2a73babc15a38b25d3e57984ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de41e258c9cbc302045a19ef45ff3f3a

SHA1
ea5cfa9e20b3d4bcf9e97456dfd1e322c150baed

SHA256
37256fe0842d3b2e45fc3d5c48d8cd88663a42526325cd96981151677f55943e

SHA512
954e9fc00e0a3736131cd7fc34792e3e1e36f911a59f3ef3b8f181019ed5252383d5e474849b9dac8bdb3b62e02109f8543c512acdb50d1b081caee04320414d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
559f9c88fe29e9b91e2111ac78a8195f

SHA1
cdd5bc1c1fc03e116efd303ffd50e5283da63609

SHA256
28fdb5adb023dd6382d3a5e16034befd693c351fa750d0ca168d9850860433f2

SHA512
d7aab223f0d393157b5d894a725408120e06670bb5273011c5d31b745a86b4c16592db9e473aaccb538aaa1176345a4608115b8e714da5f35198839fd5ff6d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8fc1be4bfaf4dc60cf023947fc15ace

SHA1
0604c5ea0811db55d52d342fef0f1c19cb0c7b1e

SHA256
1faef615ca01ba2bf1e9635c0d9b87b2a124ec580d5af113ed8018e910821dd1

SHA512
b382bceb8d3e66ab6b75e1991adc279cdc0f8cded3e5cd2e545e2c13f59e1ea4ad3ea9e6511ca517d9b36024a1772e1a2f7ce1e69fe815f4560370afa72259be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e22008bd5041946085cf85871254a06

SHA1
b2758f0f149affb791e8b3a70aed3eed916a99a6

SHA256
325bdc07041bbcf44a6f01713c742bcdbb46cc99184a3d20f6f6f63de80e5bdd

SHA512
54dac118c26fe73fed07de4c8dda370647bc7a549ce4953993cf2094cd8ab6c258d22e200e2ec11c72b2be7167982fc1eb173910eb777cb476204ad60cbb8215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68846e3d57e6f05a4a216cd59bb8f2dd

SHA1
674db2a7a5b8ba10bbe7236610d97ba9b2f602f1

SHA256
b4c16b34d62e56fe2fed77be33d4337e9c1b77af961d1a17638cd79da943d33c

SHA512
7cf9acdbf68d233ba1c7d4be4e154ed279811083612cf0fafb38e29f30da0ea90dc74c72fbdf06933e9f2914d55ae8a55b89f6bca40ef121c771ffafc41a61d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1747518a8047e0753e474ca8a763889e

SHA1
40da06ec501920ba78a71d2c11d808edefc49e0d

SHA256
6bf45c0228d1eeb2174d15b8d3a2fcb4b354b1f8f79639d071a2bb8326f1ed2b

SHA512
6f3998074acd6e48f976a70f37bc32bda4316dd7da566ba383956b413c46d9ec9e32a3b78f61519bfb1c5b81ebfffcec598a89a14c537e70b86a9c7c59e7b55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fdaef37962be0da416f1130452d11c3

SHA1
3a912f0916ac49e442a39ac6d9574a964f5f9f67

SHA256
267d1ce949af255fe01bbfb2d7703cdb88a8ec7bc3fdbcb4712b3d5b34482275

SHA512
06eda0e332a77a81a6171247594a6664e6397193027ace82f1130d311a5971ea0f76b6a8039f03b7fccbe3c6f8e401c2662a64412a5669d6dd0d8d538e6161b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db4c90a12452b710c508234a42a0bd92

SHA1
d8135b0dda56b4109012d1f2b5435bec5f4f7aa7

SHA256
04e88c1a1ef0caf050beb4995a69eee042c9c85e27eb237ac2281214a264ee5a

SHA512
d2c235353d659b419125dd8d3fe9dc4193954332aeff9bccadbd2967f8e14086c7d1a49a9621ce1f4961e8cf3d73f6fe59c3f904d96efdb1535c909cfef5d9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab123B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1327.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar134B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit