940b65f03833aa08f5bf68b674644db4f96c271b3a0fd8d62f3602f4cc268ae1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f548b6e684934bb83855eca44d4ab11_JaffaCakes118.html
Size

69KB
MD5

7f548b6e684934bb83855eca44d4ab11
SHA1

59968ae472d1f3c6f9d77668b4e62b0bf0318db9
SHA256

940b65f03833aa08f5bf68b674644db4f96c271b3a0fd8d62f3602f4cc268ae1
SHA512

59445c1fecc364c8d0800cf69fdbf5251677072c3debbf4d29a3964348191c707c170bd18143dc7e586e6628dd545324458dab9ce2b27c65245d051c77446db1
SSDEEP

1536:ocS5orQ7J44+SwIg4glgEgegJL+DOz2pg+WcMUefCTRRmSODJ1lk4gRb0hrQ4kg/:ocS5orQi49

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\weibo.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\weibo.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423114541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09FA82B1-1D6A-11EF-A5B4-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2924	2224	iexplore.exe	28
PID 2224 wrote to memory of 2924	2224	iexplore.exe	28
PID 2224 wrote to memory of 2924	2224	iexplore.exe	28
PID 2224 wrote to memory of 2924	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f548b6e684934bb83855eca44d4ab11_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a308e78c07c7b11414e8e812bf2b08b2

SHA1
f25ee093eec32be75b2daa7e2232c142ccd57735

SHA256
3cd59d8d668d6a33bc9ca63dc9309533abdf9c0d9f2c014043f4f23feba44b16

SHA512
64f09828d779a2b0e2dc66ae42f126425ce460fc4f0fed127742c22140cb12213e2e492938bf47b0c5e0fbbb8086105b7d51a4d86140bc9cefdac8ac2f2532f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1dc594eddac381281fa472d0758abf5

SHA1
0aba6f632b02057d4e8d0d9ff469db80a047f020

SHA256
b980df9f6bdf539e187bb01f99436ddc63561e2fdf3ef521bd7b4820b030ae19

SHA512
e9c00aed04d6dc27ac391db76f507631c499a65c3321b6bdfb6e4284a44e48726c2a56c7cb12e1880fcd4a635c5a12d10404ab9b401b3f2dbc663449044c038b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
763195776e1ce33e2ae99c23e2545a12

SHA1
e46598b13c8abbea7c64629e01b9ed86a601f25b

SHA256
653898447eaa28ff3727977b22d19ea524af05a0ab3f7b8f3add2977c23df5ce

SHA512
3df9151feb1ba2566f3e9827806af64167604e8d2c8182c3ebe3ee7fcadd2d2e52befc4ed841c09a884f5f74d3fa5c069b4a6c01f5b4cb753aa5e3c9edbca833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ce234b505dd0b04f49a74ed6f531d58

SHA1
deb1c5a5c3dafaabcf9d8b4f784e8fdc3b77fa2e

SHA256
96909c4c063ef4fca0a79b1d002bf6875fa959392024da21dd03cc117b792b73

SHA512
61030b1fa248c24ed898c03c136f7afad369906e11302f7143d94075c040c5b18eab7f9d130d6cd2863f4563e1aa3881fcd8b282098819c591224f4ff0fe5405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2142297cb06667a88a7cc7dcea89a35

SHA1
c7f2017e3bf6981889b9086fd50201805fd27128

SHA256
895ebdf7ca5067175334379831fad8b2399341249d2483b61f3672ec51c72705

SHA512
ae5445e565ad1bfbc4f3cb1b1f8bdcf7c1a4070e2aba986827df819f5d8a691bf5aab0cf1cd8ae5fb4e7b06ae74f1352d59bdb1775400517703a09957c8ccbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
362add8f521d18ed81c947e00c6ad813

SHA1
04ca2858d71dafab94761e6fc0c7a4fa6fbf61d8

SHA256
f6a0ff78b35377eec90acb21402bcc5c7acff55f38a8c0f0c1843903cf51b838

SHA512
00450b2118f5cfcea2db6670d974d4bc7950491456f3a0a88287e0f5c5f99dfdfaccb80d5dfa080c1b3773983213de5307191d2ed414ba8eaabfa8f13654cf09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b09f5eb2b194a2ac848dc73ac0a8877d

SHA1
e81a2be83e84b7378c83a4ddbfe994ad979bffa3

SHA256
d84148dc3cb8843f076bb9ca758d2ba615ac54f3cde2c1a02d230d29846c019f

SHA512
7c375acfcdd4f1e7e802e7778e4ca8cf3905282f2183d9e634b4af730c68a57e0b9776cbf472bceb15e8ee96c1bd54c9866b3cfebfa6c4876582cde3c40028da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ef8589d399b228812a53dce74671e5

SHA1
4686f69d2e8e7420ed48c16360885ab890a383ed

SHA256
85ebfcccd4a02a5f8a41d84ef530ccc096f939426dfb7f62f92bd2f5f05491d4

SHA512
14ac18bc23f6a6f156a5eed31c61022dc66c3b6b7a1fa6449c2b88505df05f42edb7b061d03279c06708b304fa6365b2f0943d5b68ad33ec828ef2285119ad1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf189117ce5cc8e35d9a0849d8edb4cf

SHA1
4af8e3f558b3f9605e71aca2af6e923edd044977

SHA256
50939ab6c58cd5269b7b137dbc8911e2cf42165d4e40a9fec596507b7092374d

SHA512
4a9bfe1b13a634cdd490ff1fd81ccc81369c9e9884d1df285a46fb6a799ef57d419d96a35f94cc5dea8102d373f7c9d72474e969784a00bbd08163a7a425737a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
082eb0749f9b10c23d33023fdf91b50c

SHA1
51dc7d51637c8632e9c67b86bba3ea9f88968b0d

SHA256
f53125383567580466248d50da22e485000cc9d104d35f0debed3bba65f9a73c

SHA512
47bb9a4adda43e065855ba30dc921673f51468217aed14a5a2db567f55300490f49e0156252b737429909e59e6c5428df57427105f9ead2f2f861431eb22db5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55abff01c82d8b8d1fa32c7b5ddaca8f

SHA1
05fb82fb2b6b03fdfb0cbb965553a4235756ba1f

SHA256
d6a618e76f39fcb472a6eff3b38d7ed56c9437c9bd291d02f23945dcfbb9cd89

SHA512
aeb71e6d63c460eca8f5d92ac8ccdea55df137bb66af9714c1e87d27854dc352b4063c000e87f77c0009d0b2b8b83630cfb841aaef6e57b5ababefad416373a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16DD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1780.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit