085ab35a286bbefcde0dd145dcb044ff55879e23d3ecdabff26720965c0ae5cf

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

813b3433a94aff303b44138840d8741e_JaffaCakes118.html
Size

27KB
MD5

813b3433a94aff303b44138840d8741e
SHA1

42a5b53fc464a5d45da086f5a51620b9fec84f73
SHA256

085ab35a286bbefcde0dd145dcb044ff55879e23d3ecdabff26720965c0ae5cf
SHA512

08e92db7fdae3cd601ffc3e95c249cb22b697b094f20321063642911d4d16ff63c598542efcb51d9211f605f6efe309ae0df2168064f71ce937a2e0f401c8266
SSDEEP

192:uwrgb5nLSnQjxn5Q/6nQiehNninQOkEnt2YnQTbn9nQ9eJtm6lPjtQl7MBBqnYno:mQ/gsXtjcSPAt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70B8BEA1-1DD2-11EF-B5E8-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423159382"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2804	2808	iexplore.exe	28
PID 2808 wrote to memory of 2804	2808	iexplore.exe	28
PID 2808 wrote to memory of 2804	2808	iexplore.exe	28
PID 2808 wrote to memory of 2804	2808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\813b3433a94aff303b44138840d8741e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec7291d9ef538fb1b66af580c8504ac6

SHA1
782a3fb4716bd60507c000c6c5c75b1a368955b7

SHA256
28704c0c4361a58723d9f0b55f9bc933e723ca6fe68a11e8cf741065f9af490a

SHA512
bd51331f1ee9f007b51e679e8031422373663888ad9ff313ba0ee9ac5d37b72369c00668d89d90de674682c41296e3eb57b7c5549e807448a2931ea333d3328f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccd2cef63f1a2ef2dc1c1946cabff246

SHA1
a23c80e87f7755b2bd4db91741209a6ca2e26680

SHA256
da28f79435b45480a9a1e7b528500cdeb03a4d4cecc9ede908b4185f9d8dfff7

SHA512
bd70b8bcfb9dad0e97fa4e1b359b07f381e25bb6ec38ff604026153c5ecfb4c17698bd2e6054ce2c01f810f5a73bada8adee118c7c210d31a972c602d3771b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d59ddf126e989b5c0f42f7c27f5955

SHA1
3d573c9323647aa3abfabd001c6a52f20e47055f

SHA256
9a03fd07a58849f7a6a4aefd8111c394500faa5491e65d95540f520c613e967d

SHA512
0db8efdbf7a9ee4ccf1a54fa369420dcc6f0cb53582604a6036481a81289ea3702158fa4cb4993f2d14b77a8ea5e9d4ecb04676449ade78df8b37e7671ac9213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8f84dca106de4afe6376f74b71aaab

SHA1
e76b08118042e80eff77291f1af16423e18a801d

SHA256
134ef73916b251533551b395adf0dd39b8bebb1ba57a24c303b14193b25ef5c2

SHA512
50d8ed06193074ed4987c0b5f5a8f19512507db031a7d3eec2196330d1d4d6f4f11beaed99997e186fd2567a3cfc4979c5c2c5dcbc0b7165cb74839bae7e2418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef14fc775f202f4ed2ce4d4d222536ac

SHA1
62e7b42087e55fad0a3105d00dffd3444d042d04

SHA256
f82ed1773f48556c239346c5f09639bc72467cffcad38b92cd93128bd5d33f6d

SHA512
8fa60bdad6ddade8d963e6f4507e6be6b96cc9e318410779fc071cc1ca11fb7015561ff839b7ba0e24a9c6bcb9b5a627c685da32441c2d861094122359f554b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08b940470b1eb0fc23b70595220045f

SHA1
ac84494e88913c88da14001937061f7e9d0256c4

SHA256
96a7bf64e01a6fbb1396d95a1ede0a2becb29f30ff8ab6081cbb2d481a9b1dc3

SHA512
a0ab8d6a757ad7e87afebe48f549241c9b8c27e669637fdf9469f0fbdda6f14d879e1311d3ff34c0ac38184b381f71dd5e9c319bc97e33674996bb5c3c5c46ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ba8b37464f95d6a87f713c673bb73c1

SHA1
097e10283ba72cfdec972b07cff823c881153d05

SHA256
4ce86fe8527c7b256f4d442a7b093f037cb5bb800d2e1ef54270011d24b53be1

SHA512
25d6c704a34e932a818a052bcc908cf625ca396cfb9c97d6b8b5d128fae375099efd800277e79d55d11ad7bd543946ff005c783011c36c8ca4ae78d71b0c59cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45fdede10f57575de2607c01fede9ed5

SHA1
b34f6f77bc728a605b00998eacc1b216e365e4de

SHA256
6493ae732e2fbd0a744a30f7fbe9f37c32ecfa729c6d79658a53041bab1375a1

SHA512
e79528e7d617d5f9a35239ed904063145202d22cb3e1306d99712efe6be9f025c1eb2532dbb4adb6f5aa3f18ba4e0cb100bdd4d1a2bd926a08418088a08aad40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f41f7e1ae53b93cebf50aba7d4a61b7

SHA1
c9d86c15b1cc4e1bff95a8bdf41b39c3b1a0063e

SHA256
8790415658606bac4c68e71f8a63da8f1497990f136ec4733a35a6312ef8fe4b

SHA512
1c6fa534ba95165630aface1ab65e88bad5cc80e0e790038532fc21f90f3c549ebdbad214edc2938b2b425e2d78306e28d7d71e9661eb143d89f449e1889071c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit