222e1179937634ddd80b90b88fc8761359b7ad8d766a94def353341bcd603169

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e3aa355a9f22cbae45d7786fab95607_JaffaCakes118.html
Size

27KB
MD5

7e3aa355a9f22cbae45d7786fab95607
SHA1

199003fd44ae362fd935c63a7451f1a6f63da2fe
SHA256

222e1179937634ddd80b90b88fc8761359b7ad8d766a94def353341bcd603169
SHA512

b0cb359335968e31623d606d30013b1805d35d050c7cda33c65d024d9129f44c409e0310d7e3f9a1a0af5fbd523296935edff0c31e5261b89576243689a6ce91
SSDEEP

192:uwzUb5nb/ynQjxn5Q/qnQiehNnInQOkEntaEnQTbndnQ9e5Sam6u7DVQl7MBBqnj:cbQ/CQDCDUS34r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423088545"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{832AF8A1-1D2D-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3052	1976	iexplore.exe	28
PID 1976 wrote to memory of 3052	1976	iexplore.exe	28
PID 1976 wrote to memory of 3052	1976	iexplore.exe	28
PID 1976 wrote to memory of 3052	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e3aa355a9f22cbae45d7786fab95607_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d29758a19a93c8affd13a010afb69a0

SHA1
81d2110d318c39d6f9d0e5e62b4ed1c1e2f8eaa0

SHA256
55d3591780bd729214a87b0260a83f823b70634322f144741551463494b67bf9

SHA512
72de6c23c74405262282ab1dd2ac00810c634e13c0f6236dcc4fcb2a5d199e78afc2b3a56a1af721002d11264a0f237d281a7b4bc758957c8c074a3099c0ff20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c5155ecc36c38313fb392a160a6fa5

SHA1
0342f455be17e45ef48a777d472796359d618ca8

SHA256
5545a32d3825bea82945c96d0a32082984e17e864338a2842107d69377f227ba

SHA512
cd3844b0209e9717f7a8acc787691e769f4995e13900d157bda8de8e35f5169240ded143620e33cc9d7504c5c48c333f0d5883e062edc4bb7fde11e1733095da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de29b389be3c520463d28f72ad6e95a8

SHA1
be70620ab70f879cf096c1e6daa56d075affbc08

SHA256
b2a6065a67dce2e6003848da726c93ba568f836644eaa4012db4ff1973a67c87

SHA512
f553492042f8b6b9004f33e52d2db86443806e77d2e3aea8d100168cbf71544158b539d53104697da187690631c606907a98efe3f7f66399cc1db56a51dedee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c8084731f131a2822be6956bf0825d5

SHA1
50ed550c07f2ab3b81a3f4f5b525ca2c0c008f11

SHA256
e6762ab891c696ddabe855efccd2a2ccc4d60fa80c7590ba9fd010afc6fcf138

SHA512
e0b379cf5bd0bb32b4f03a71541e7e02dfdca629b0b55eca0fbdac92f1f8e808de2e39a7210b5dc9df4644681fb6f25eb7b9f610b4ff52295f9e5f0f7f286dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3a2d36e55ee0f7edef24d96dc30acb

SHA1
962a937c4bc224cdeaf0f61d9d379b996f733a14

SHA256
619e91bcaf255d06dc57902ad145a05199fc679f1a2213e5fdd8e991e4d507b7

SHA512
5fc9a7f52dff4dc954493415ec6fca54cfd6c3dc5773c907b076de52bb57cea1ac4ba27739f1a488c299104f0db3e488986a53657a29f92033d918f03359447e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
383df3d85b915351343d3feec4633917

SHA1
49c1005ec3c76c811db890ab1ded3966095ce63c

SHA256
426c452db3d2929c96c22c635011580031099ee23b414cc3829e93be3c8e4dea

SHA512
a2a1a9d241ff782f2a5fc16cf7001210e87dd6c9851d60637c97eaac1f6b1b1a2240644362950e5ddaea50916f1258563917db2fe01cd7faa88aa6f16d0deed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb9391c42717dc568c9b4c0944734493

SHA1
433fdb59266ad415d6744558b030063ebe1c73b9

SHA256
5cb290e44fe1e46a35f70ebc3c060d4ca87f80a9ed59ba758321846d2b911e37

SHA512
aa465460d4bffdd30468876d7ee63cc20ab81a24621f664a1e1d0d634a6cd224c323d497267b2875e35f6d0f218370ae4e5d7e1f4d452381cc9705908f276869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e9377e99db5274bbd6953471dd5479

SHA1
42fbc97b9368e2578cf6d31e6bef3782377ab927

SHA256
886742fb40495c237bb9efba3cf25ec1a714a43ac9384d1e632844cf3e6c827b

SHA512
162fe39bdb1219afcec46201546db397a68c2dc57d9d31bdc53f55db5e726c7af6eb6aba8bb440a4e375c10164749a77f10ea32fd86d6e8a42018fdadfec672e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dad7d3bdb1861db3da7c60c30ed7f5f

SHA1
a015670967b6274ca4f2e3ad5faa5f8a34a41590

SHA256
6821855e182c7554296ceef304da91fea37fe69a1689d67f74954087741f63c4

SHA512
038240f7a3505bd20a609709c9deaa4e71fef264e9063b4de04ff547309146270df83d2b012a5f009cf312c0e2b104bc6d57eab06d7eafa462dff3e5bcabcb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b15eb57a669823890e370e8ac57f5f

SHA1
0c1fefe57b02dd4499a61a3b9036aefb665fd99d

SHA256
31797e2246e65b68898b9a5366228b8d4b3d725bfbdd894bed92824ec4512bf0

SHA512
cc25b022b642971c956bf8923b52b563f315d762011e8fdfdf8c04cd0539e47b8a7f88d43ef277f2d833848beaf7a0eaf98f59a98f3dd7f65a31796dff1562b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D80.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DE2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit