539fac9208e544a02c7fa5987b80d0789e6dec364fcfe2f8ca314abd812dc6b0

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 21:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e67327cf44d4d6f70d154bf90ed8487_JaffaCakes118.html
Size

23KB
MD5

7e67327cf44d4d6f70d154bf90ed8487
SHA1

85c2fbfbabdbf536df62eb684cee41426f2e99d2
SHA256

539fac9208e544a02c7fa5987b80d0789e6dec364fcfe2f8ca314abd812dc6b0
SHA512

63111fec74ab3e3f982254bc778ef88e547f5f77d1b89cf9416420a2eed6238bd4e74d979541149b4f249cb0bc240e35b0ba59ef5b4d5dddcfb61fa360a290ed
SSDEEP

192:uw7bb5nS+nQjxn5Q/1nQieANnhnQOkEnt/znQTbnhnQ6v06J4RnQNjMBgqnYnQ7r:MQ/sv06kKtC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14A398C1-1D36-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423092226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28
PID 2276 wrote to memory of 1996	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e67327cf44d4d6f70d154bf90ed8487_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42b65a046b2d09a041002ea164ed660d

SHA1
4f2e7d7d32d20c8c1a23042db33e29eaafd515e5

SHA256
a18c1b728fa7535f58affb1d50c91ebe234b923100565b85415cbd452507a862

SHA512
c382c04fc1fa08041b13472d09e91fa431a82e4baa00f40d08b6b15cc7627bc6ae2ff192a225d741e318be122729623a0ee28635983abfcf679518d29a460347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3491492bd9e00a02d94de2b4c879f86e

SHA1
2c99802702074407f3d695c08399f069740c600f

SHA256
e1878f470ad2a17a7ecdef8f21040872bae9eefd5b3f8b9ef407ab34044897a8

SHA512
825e97a2e5f31f9a5b58c39228bdea2f9806a48e262717cf9b68b216e49864dacbeab1e8d6c758885d9ae608b9c2c08afd90fe342fada46641de63d1e23c4319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b7691dc7aed533194f0e2847196a2d0

SHA1
d7a8822f50d5516885831e74ef834520d3bd17ea

SHA256
9569bdf3fec2816a1416cb631b7ba0d3b9ef60cfac7a1604f310d8da2704692e

SHA512
06940b7852bf47baf1a525b714e063f9fe6e786531bb0059667a538b3979854a326cd9a6bdd035531c7a717e4be34ff73d34d19565fa11a47130a969248180ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77613739a7a1978c32cb8d710a43fb5e

SHA1
fca71cba7e25ddf8ed80f3d511f90826cebce1d3

SHA256
89e064e7a4a4cb8561a9506b9a796ecab3b4deb8288314d0300c029e72695a51

SHA512
3ba86f227e8df0d05ba8c46eab2f1313db89ddaf4907772b197783af9a8e27cf64da58a7e8a640644f8e9f1051479fa1b80d6709627154a4d2728805e7cbfe53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209a168f46c06cca656fe407a86e563e

SHA1
04ba12409397b2443f5abee723a078b601f1273b

SHA256
8cb6674da6e39d0ee1ab7f36a551ccff63f374559359d5ad0625639896cba0c0

SHA512
52d0eb92ec428a247b8738a8f176f347fcf1dd1d932e67c0f9c857efb86263380cbbd56674f3f368a413c06746b81061f7882e81aa43523d0edaf78f540d0a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9c9d9364431d4fc55ed6563f7dbc9a2

SHA1
78a7ab5a189516493c1ddede398d969169c35777

SHA256
4f12dfd8c5f8b1d183b2d4d9e25a920845072b0abe20cfa24913a586f415702c

SHA512
369e29bd603d2c9757b2441ff046c89f335279943ed8902abbb293dfebfe6f27cb7f66bc48d8f07a755dbfc1747431fcd17b32ced3eae4b594ace2f7a375b169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
061dbcbc52010086fd54f5cff79f535e

SHA1
609dc145f7a25113e9b47621032a44294c9331fe

SHA256
25c637274fd7b34a2a66bdb0036d679de96bdbe75d1b1d14171879f68036f6fe

SHA512
36bd71e65dd27a77a4f4cd96607dcc96873cb266c3b8e4d436a0f449912dcaea4ab9609ac608c155bbf271744a20cc9473521cba13cf46effa415d4b09166921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2ba36c94835b7a610380c2163ddf1fe

SHA1
3dbff63c05f2affc25997be0d67bf309b65ae374

SHA256
cf65c0223d602f9c6af8706ab5a0cac9bd771803174e0b47ab21ef0ec7312dd5

SHA512
6b76dfd09becbcf38968d4676d93d30520b8b28e7ab80f024c419047be7b849998a6bec3c6ff72a4ae1e87e749bdc87a34ab40784d72af6fbfa6431a0e907331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096c1769bd812e4606b47e28993e117a

SHA1
f47883e3ecb9cba51bd92bea23e821c4a43c1bfd

SHA256
a594e3cb980add07f20da3551e368523472549b55ae95bb8b8c70f0851775f22

SHA512
f7371ef5cd2c3c4372ae6034aa2a5094c2049e3d6f6dbee20a13263a1953692f1c0ffae4ab75d0602b0f1d06e1563eb2eadb7a5f9882c7de854d16190f22f9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15F2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1741.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit