09ef5fd1b3a565feab92931c7d49d7a71bb1a16a57cb3b4841ca2478259ed5b0

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7efa73cc169f082d47a920a0ecc10e64_JaffaCakes118.html
Size

47KB
MD5

7efa73cc169f082d47a920a0ecc10e64
SHA1

b3915664171ade62a5c623ee121ab071768d574a
SHA256

09ef5fd1b3a565feab92931c7d49d7a71bb1a16a57cb3b4841ca2478259ed5b0
SHA512

ab913ecf6ec4859dc5455c8fdb6eb1df4144151744d534d4a6a3bc34a66aa3a0360feacce98cc7afbdb6b0b622a841660df92d51de16a85067f43a4565a533ea
SSDEEP

384:EnNCyeqaodWz1T34NgMfGC1Q/GQ/WAXYW+x/YLQuFJx0XOJMbEkIkcdklKDNSV4T:vFtdB0lY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57B61881-1D55-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423105653"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28
PID 1724 wrote to memory of 2008	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7efa73cc169f082d47a920a0ecc10e64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9eb58e4bc14daf0705de450956f1f7e8

SHA1
ddd5bc22462c720f47a9fedde676a1c8bbe35042

SHA256
93a0f384e8749bb198e2d98f92ba24313001095f8eed305188e0847f77c31cc9

SHA512
a8cd1e70260d38aef121dea0e70b708fadb97a9789caf009951320b79617e3719c0e8b4ddaa016cc8f9f45335548b686a09085d6ed6786b05dd39c1d7453fe3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c6acceee5247941fcc7ec04ab97e32

SHA1
dab32dc5879528d04e5351d3fa3b08da0c2eac0f

SHA256
96ac14d28634f31ab796144e83e0ad53995ce321bbcdc1abda575d64c1475a00

SHA512
85f820a992c476b39f620cda394e697ffdd4d52bb93056ea9b45150fc4b2aa8fa73fe7c3f976bde52f4767c9f58818d9d23b64e066fbd0c6c5cee566906ea9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7ae3e55a0b8e8c1575173b4b383f2ef

SHA1
b8dba2bc5405baeac2944366f5dc21d92ef78753

SHA256
103f86629213194c2790d7e2ca64a160f017e8d6eecfd0662a19d8dac8ac085c

SHA512
60b35edfd3e8ad4b5f6c2499b5736463c81ace2b92217e8f2474aa3d5927fc7af43ff1a674e5bf8b35fee8f368ee0c3782a011bf317cd27dc8937602d6f0ae61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82eec1f87ccf2dcaf74dc40fe7524e4f

SHA1
86069eb1f9b5fc3b68d1484349044340f6bdd03c

SHA256
6d59875e48db3abaad12ead041a0a2cc965b27312fe20a2906590d9599e3f136

SHA512
08f55518da98d007853280c016f02683a53c8bec6f1cc087cb27d95176f0be53c43e7fc287c95658afd562c35f002a9816443909454d464230289327fa9aa740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eac7935589323bef7fb89c87917fe5c

SHA1
deb6312d62172ee188298c9fbc5161e448846776

SHA256
2aa93c7c15966f9e2a4dd77bf611d06843d5fa1ecdcb0e090f20301a4b326d22

SHA512
97d1b9c2f946a1d3a59d7130df91afd94666eeb1d23787ed66883241801b82fc867912d63aba5dca263404c1dc018dc50c67c266241ff982fe5d893421e8214e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b89b57d4b92a50eae745db080c038567

SHA1
92412189ef6f9ac1e9a530f1b38336c6d2a6628f

SHA256
859600f6bec844e2724ae6a75c4c8c7335102a9172a984533a218a48a44b760e

SHA512
40bb62e0443b6c7dcaee275c6638f85835d4d5e8de4b790806e2dc8c19a696b90ab8404036e72454a2fe945a7b15842193e5ef50b39e01009b40d82c4d395693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b96476fbf038bb88c5d3f099aa3aa045

SHA1
55b1517e4281ca4f2ac9a14d6cbce26742e00c0c

SHA256
fe107db679cd0890f2a72f6cc8f99f45ee7558faa467fc1cb9b7d42108a03a38

SHA512
02b01e9f0324238702ffd6b038408819d3a1425104d8080ac9256ff12dceb9b92ad1163a09cb42ecce62d3e5eec8ab56af220fd0a5c9f8f2ce7a0b3be1ea47b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70ecc55f81cd8fb7f8fa6394a5b36b70

SHA1
6756e716c6fa9306a1c7cc5b0491d74edf3ec418

SHA256
2ba1ce8e94242a4e68bce7683480a01d2bc4555e51c4791d282de002b42f8fc6

SHA512
8350a0c5d50d564e60fea613e22ad27a32a349fca2634a8b7deefa23a1bcd14b3c92806d9e6c3f26625a2b668d8ed08303090ce4b19dadf457cae6caa1df3cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22b551ca4986d76892e2cee8e930d616

SHA1
3dde307541ba1d4ada421fe5ea4e5fe8d0f9458e

SHA256
b7a587dac4ece9671f1364b10db70be58f19b4cef05c2456404e80a005a7a0ae

SHA512
2909b96a592f92e7d4f979097c088cec821702459b4e2928d3f6d62bf418d3e4f882262e95f5e37e98f5a51db87633098f02b3c1e5b91a71f43345f45a8151b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbee67e7eb992a4edbbc3c40b50d96cf

SHA1
7d58096ff5a230c84c1550310061cb5928617b9e

SHA256
a1c92da8397ada7fc43583d3de411528000312bb242ebd22abff3137cb30f167

SHA512
1b1a160c8c03c0b1ed60ff43a3fd04670e837fc7e08cbc75401161f90013d9fa1d5ea96a1eb43cd2445a65c527b04cfccd057a7d3f5a9d9ba374c9df21978546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1306220c16901bb6eac34aa752e0d781

SHA1
c4c4241da7232867f6c6759775dc0d9e0b8046d7

SHA256
53ab4d561f2d1d56082590ca7978181a0a54b5cd44cb2ab8a9ea366a85c9ccd9

SHA512
4842f79beb7da9cebf90d8c6d1ed50679ee54263bc878a9e5b169754df920e9116d756254e53fc04623a9922bf07fa67e61496be09d5143e733f2bdb688bafc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1615.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit