60ffc1d12dd7a35be4214c72016b4db057be47c3efa908c66878032fa1bdaf4d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7eecdc91a905c7a7e59af04d62ed0762_JaffaCakes118.html
Size

30KB
MD5

7eecdc91a905c7a7e59af04d62ed0762
SHA1

216da2929bb1a03b96058557d1ead229c58726e1
SHA256

60ffc1d12dd7a35be4214c72016b4db057be47c3efa908c66878032fa1bdaf4d
SHA512

3c898340aefb301097f452bd952ff1842952db6d7634ec51ab119e08f8e01c7bb5e35b0eb4464ef2e044b227aa70269bcd3c25c5d7568110194b6aa068dbcc6a
SSDEEP

192:uWv7b5nBm7TnQjxn5Q/RnQieENnq8nQOkEntPfnQTbnpnQcXCjAv9EHkcwqHAM5b:FQ/sXuX15XL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423104279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24CAC131-1D52-11EF-8EEA-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28
PID 2936 wrote to memory of 2844	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7eecdc91a905c7a7e59af04d62ed0762_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b7f89d7c15748f848d476167b6996136

SHA1
8501460fff2ac44883d654bfea5f2863415db6d8

SHA256
127f8e6a5e90d491c84a71e10f4826df6914fb439737df0d52267e7c0dfc35bc

SHA512
fcc4bf6762d3cd64fcf02edabb2fd586e9c6ca56790197520a7833f40b7e75f86240a360dcf351e1c067dce81a94e430fc7dd92d2f63f1a418384b0d6c659118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ea1efc567ae670e5e6177dd679c3b2

SHA1
a1eedd8356b2335940549a53ad0ea94820acf630

SHA256
6304f2e45fa92fe8db045acee8757b272574a5dc1cb9999b197f40e62bd9f07f

SHA512
078d1ea109b7ed032309955a5fc037507aebbd6d2eabd0c33f5ab34b07451ef00dacdb1db076862d7cf8321d996090008b8e33bb810ec0fcb73b940d8153dad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
435e33271c2f0432a9126288fa1d973e

SHA1
6402ecb7c6d7eea21d6cea928b90c787a0a0f57a

SHA256
0f5a23596c5ac8542eb4f0cf5d1ace52df4ee82b90084124aaf41569cd7b7568

SHA512
a9b4bd458554b1c1cece479c508d4600cf76251bd88b0215dc14458df1fb9f54bf0e90dcd684579e7d41a33f2927cf0157f23542ee6fc1f172dc130bd34a1565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ea4c43503f4d04defa56b1fe7470b31

SHA1
a66bc3b9cda3c12da133b3b417d6371e771a864b

SHA256
64fd47735c690ab7506db9488e4394d6b91df344bceb490bf1e1b3efbc5d5a0b

SHA512
743eca15f38410ec5150663e0217180620be345fb15d234faa6c2f42c9608fc7f532152310d7e02d4f874b0b3a3f004131f390cdccacb7b1567ce2949b2c3b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
099a327232e7d5bc40ca1a8e6aac7444

SHA1
d4ec4028e4a1ffb07eb70cc1b9c0fa39273734dd

SHA256
d854790a002027b5840f8bcde148e52e439c42793be883dc7dc6e9c319d56e63

SHA512
89953869344b39e47cdb9dfb415f6b7489b91336feac714546c45018d96f2655c9b97f989c4b16028fadf0276a180ced5ac832f72945e91eddff0125562d43f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2b7b7e62eb84fa1ad5af01db76a02f6

SHA1
de62b8f9f9d90e8a941f00eff57cfd6f8e40f6ba

SHA256
8c0aad4d2c651f8e4ac50bcba7a53b1ffde9cf9eb2d59a7591ad60463589afeb

SHA512
6381682faadb9f53b00ad14fc47add13371eb210e568bc26c6eedbf836624f77ef72064aa63a31d3ade4d8f4f021a2b90008bb524db960bb93fda6db4b0dada6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbf07b36ce9bf7cae48f4863eb15f977

SHA1
0fbd1121fbdb2df90167d2564971a4850f603ea3

SHA256
edcc3441af275cc71fe06711a32e07526d3021d118904631b052e94046e3fe57

SHA512
1c08af741c88306105dfc88e46d378f44269567d3fba123696c231b26533536f567cf8b065a6eb67ba293d6df2e218cec5391a47962bcf99287573c53062fd73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8538b6049ec06488e12837b1fe3fc1dd

SHA1
5be195cd98d0a682c0adfcd397db959c4e54d630

SHA256
ac6e472d8fbf815addc7cec94151c5e2c8d7e64bc40aaf5a4dd8e8242ee9c711

SHA512
b9830fa884ccd4005b76b00012fcb0535b66eb46182ff3d6b5d38a1d0bdf880be043a9072f890320f175a0cc132c1b030ccd911a3a7cc4eb5a35e24d96acd996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9468d954654f07049cf2e5fc7b140351

SHA1
61929c605e0e70b3dd06f949acb7e1dc2be56aea

SHA256
6259062d090484e349f3c0ed8be0f8b0b96478264588c1657fa3331e1f5aa4d7

SHA512
a0ce33cd5a3890d6258a7adb9b2e493874117cff5d5cc786ba9526797306781d19ad60ee9c714aebf35691ae6a9a0c83d7a40431547ce517d7f603a21e362261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f58c75c2f208b5ac0f94dec6229263

SHA1
16d33b214deda5579acb70186be9f7339c808069

SHA256
f3736699c6bb54063e5af01c4479cac0a3be434dac9832f98f61e6a38f2cb384

SHA512
bfc087f4076f18745be116f6f6633e6ff1375f40b69dd6f620e17440b8c911650c5cdc2ce667b0789635a42b14f911c258b984f326a20355057108195b13ed12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4adf9b9c39b5260b6cd6fcac203b5ea9

SHA1
8b82b0e8e3c261395c2377418dfd3157d0c6f94f

SHA256
3cb998c8e2a47f4e0cfd8cbb2a7304ccbb11f2e2d0119d6f6de5ce62dd4fb0ec

SHA512
5817b65f8a4029132c244611173ff6f2a94f05b6c7e85d16f76fac2bfc1342e1bf615194caf882b32b5d5f1b7f7d9a88302a334678767bff04252177b1e28e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit