e6dc80c4f909a5157e9fc951e30d5cad90045e916b28b6e3ba7b3d1130c6e1f6

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f49f57bddc227dc42b900e94bef00e4_JaffaCakes118.html
Size

214KB
MD5

7f49f57bddc227dc42b900e94bef00e4
SHA1

9024e6bbc5edc5a5b726bbb7db19ae23faf881bb
SHA256

e6dc80c4f909a5157e9fc951e30d5cad90045e916b28b6e3ba7b3d1130c6e1f6
SHA512

0b03cff558848c21ead74e5c280c92f592e77860b7bee1af4cd336b7f570e02a13eedd1cafc4c8c4f3da5c227cb3ecf31f013d621ba74f299b535d8fdffc5324
SSDEEP

3072:SYrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJa:SAz9VxLY7iAVLTBQJla

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95C7A1E1-1D67-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423113488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2616	2036	iexplore.exe	28
PID 2036 wrote to memory of 2616	2036	iexplore.exe	28
PID 2036 wrote to memory of 2616	2036	iexplore.exe	28
PID 2036 wrote to memory of 2616	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f49f57bddc227dc42b900e94bef00e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7101647ea58c3bb432d152c3228a091

SHA1
0bdddf2ce4c9b1695b6ef17996dca0606133e035

SHA256
443d12f482d5e975000f4a0161cac9aff6ef3a6bc0fa50c6fdfba7cf5fddd9bf

SHA512
8ab893b03b4823e52082e52a6e50007b3f0ce139d5739b97f930e7e48f64f99de5605cacc8ddd57304056f1a373c02d373da9a38d99a54a76ad55a650e810262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b69b3afe7c580fd43f7d825dab050091

SHA1
4c9e423ba8553036fc3a28202f5a53daeec45b33

SHA256
d40684e658987b37418ea57a340e20278068204b0517af6a0e9fd19aab6bd854

SHA512
7d770a2c4fdc85277497b88f2c233e0266086183ae5d4f8dae9e9fc334ad188b045ef59b355e3d1ac6e266556ff5077e0dcf3880dc3c9f40ca7a3d0cbf20be7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
273c49c2c0449a16cb530de15e2a4b5c

SHA1
aad0eebfeaa106afc79aa2539dd0e36b597d89a7

SHA256
52fec531767145b6d3115e9324f960b30c68e82db7ab5f1eb41f67ecd3a383f7

SHA512
c4e646e4e0eb90dd8d9f37f3c70fc4d101794296975c59db410f919ca91444353d83f2f2f68b68f2217ae1b6514f4ef4fdb339744a1d7aa246f3aaad13848bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfee0a8a1a7797a5e26437b9602986a3

SHA1
7e717b133c544fc25f01a814712d24e0d0022f5e

SHA256
dabbd56a688f19e43cbbd854c734e33a5c1cc197f93aa9f297206429b9905c7c

SHA512
e17fb544acb30b81af50f4a81275a2465b36de17e2c20c9231eef68da31c7e69106de0bfd2c5b8744c7808e4971f2d27e9e2aec2b22468ac4a5a9465c166a5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11b29a49ac389a2d39adf966d75f06c2

SHA1
f8fb9bd858d2be502230b772f9dd9c861dc0ae6f

SHA256
7aa5c727fd99b6879a217b2a5858a7d2505f6b73e04af64dc965a8107ce96253

SHA512
13695cdcf5b7c31575e34be3d879ddce16bd5ec3037e72f51b7050dbe93555f1c7014696ccb6f8c61869f60e0f666dc9ccc3098099f55de3d2cb6004e462b41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bf85be3b591d3efcce92bc6259360ae

SHA1
b17b64e832f2ed0bbce8eb11612e5fdbdc70af63

SHA256
9dc3ea13b353ecece0ec9a1d4f84c4e6c213a4f0f3364b3a0958540d5e8f20b8

SHA512
f323491567bc6faa349da36e91016dfbc7690d974cce19e8a114ef5f393a82c2a8b262b4940c8c12236ec874554dbc08d1e893b1be75bf71cdf5a7e3ae9be434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da5a59f4fd61ae9192e93ced7ded6fda

SHA1
388610ed418077e4b2b87ba775ae705aeed1cb10

SHA256
9f2cf9b5affceadb5af1143d6513fcd2bbef8ff38007d62ff4c70dbb72f13f70

SHA512
45606ac8e5016bf3253bbfa8b041e4e68e6683f7984074c9d04c328f41136af9ed473aa00f373f460ed73532a618ffaef3bd6f123de33efe67df55a137d021d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d955632f2c98b1154c9f3174f798de7

SHA1
30d2d8b8e7f2e83dcfe3c62361a65fa62401aea1

SHA256
fb50672dcb47c0c7c7294926b4afaa537401b900e293f41507e60d8be4a636da

SHA512
dd0d25de88feb00b686de54d68923f1b8e653fa1eba9606245590b1519f6a003dca6371d54c3f79412ef8c4fba63eed8f9d55b9bc61759add3dac831568b38d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26E4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2753.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2767.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit