6729fc4af912260a41ec8db14b50a5327e62e86cb719fba7cb9ff6ccee3978e8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

825d375db8a4dab1496a29c12787079c_JaffaCakes118.html
Size

27KB
MD5

825d375db8a4dab1496a29c12787079c
SHA1

87182e4ae1eb4e36b0713911f7d53adbb4a79f73
SHA256

6729fc4af912260a41ec8db14b50a5327e62e86cb719fba7cb9ff6ccee3978e8
SHA512

26c3a4a640d40705dc0dc98318461d047d23f865efbecd8155773649b72fc1be26e90138cb38b863b2c00357a9d10798548bb110f3cc189d7bee79fbc379ba66
SSDEEP

192:uwXQb5nFvenQjxn5Q/MnQiePNn292nQOkEntcinQTbnc8nQ9ejPm60f9nQl7MBvX:qPQ/Q9mHyxE9WSJagP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423187745"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A69B571-1E14-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\825d375db8a4dab1496a29c12787079c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f9891e09b03d4c222bfd9b2ce194abe

SHA1
cb60d2b612809ca1503aba2df28f502ba433d691

SHA256
6f9d044599be804bf21a30b96186a201bee229cde5556ecb88f3267d260b4a37

SHA512
15afbdb4d3cdb52d28656122363e731a9ddc1028a143013158151729346492b1dd2735b17b48b66e93a65976f45834470a87a528fc9d22c18fcbd253b81d39f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74c4fab05b289b16f7efe1c0487e1a15

SHA1
6e0f61b6c83807f04511da530864c8908a2d7969

SHA256
080dfb18fdd4c330100b2279839cbc8bfdad5537c20f4fe4e7d9cd1a04cd465d

SHA512
d1ef3af8e1c5ac4279a950e57ee8aea05c3f65f115277101b13b2b4d7f46122bd09c2f0ccf0d7647c7becc7331ec0d4bfddd60ecbdc8d4e7211862967c8b5e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
412f0f7e866877fd9d386fc71bbfa367

SHA1
29f179f602481f0f6551150eecbc7b4b4ea0dd78

SHA256
3d7b02b9f5e1fb4e754e94080dda033f6d3300264f5f8014d8fbb773b1971c75

SHA512
0a1393d745c31e1521f59f018246e3a2253d1da5d5c4013b535b1853663f3d49afd4a92afeae691280643a4325663d8a426ef51698acb6a9904fc72bad85875e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d059b8c474cb4db0def0a3cc41c492c3

SHA1
e6a6cdcc55ff663d8a98b0a4fb121e0c72513f02

SHA256
24ec9ad79a52bd1a2f706c43cb2475e19e9c3d4f3639873a6646f1cdcfe652a4

SHA512
cf4a3fb4f9239fcfff89af2da82c35f5a81803f9333a1c7224d952634a0cedf15db54af441a41bcd2f4cc011dc54fb6db070113c42b20ddf1e6e8ca698f02193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9768400e2b81ceca80252f11f63fac6

SHA1
d56bb1025d5876d8b7b03452c5cee88dd8700405

SHA256
1a220b04a0ad522f91e8cac686326414dfbd9aec6c09353666dd79d941727739

SHA512
3099c64bfc966d1023d87d3abb12277f92e3efa51dc81e55edc25dfd5fd78f26266e1cbe9380f94147eb4cef545831dd72c25eec92bc35d6132ef9b505891298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c2934d10f761712252ab7beb0077529

SHA1
91cbc1a9d1ad90f0cf8e439575ecdc5623bef552

SHA256
f21f46136062065504671bb6aa7cc9195ba52c1ca2810304f14fea4e3f8b5bd6

SHA512
43cbc56fc32263d978a4c4adae922cc2236e67c9d69a497f7762dadb7d66805427cab6208bdd6bd40a11abee70f8194faad330c2b64579e1de5700cf72cbdf1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
639adc6736a4565a7f57df19ffa10209

SHA1
bc5dc711b4615df3dba5c37a6fbd9db7f4c0cc67

SHA256
2811fda4da7d4d49fbfa4984064d705b0d4947e15b4b3b5374d16525d49e585e

SHA512
2f3ca4b82a18134fff7593f68f292038deba01f6b9342ae3c0c77769eca560a18988cdf2e7fa535af54e78b49082bd1f0a8307f7e682005067335c49b5ecb71c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d30af0e0ca6c20e20f4b4cd18fb1df3

SHA1
9a8708d5b4c284de72db8139500f9a096ad3ed02

SHA256
f7e47140fd811e26b0524e8e45d4980441a5c4f7bf57b67a8d31dcefc7aaa47e

SHA512
f137a89f36f2899a1d41f0eb122097077f57849abb9a57951a13a39b414455da4f05f12c05fe5c6e82de055861981eceafad1a4d1e1d5c662d0d614c10063eb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5046ab5897655c1c6193845eaa71609d

SHA1
a7cc0c5b729efbc60eb67263dd6e1e5846087ed7

SHA256
004bbf06f151567139f249b8d84c22f222fc8eab4d4a7b7053aeb19d56da356d

SHA512
5beff9bc02996d28d7cf85eec4b3ce7887585cb9a7aff0e4f7c69dc150736308e2bc2e73c66bad18e9c2db3bfdbd37d6d1ca9f12d1bb0bde0e1dea7233478759

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E91.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit