5370b4df441dc92bfb019614639a87997a02168cc12e69a129d7384a7e86105b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8531954f63f2bb541ec24c5e91790112_JaffaCakes118.html
Size

23KB
MD5

8531954f63f2bb541ec24c5e91790112
SHA1

d0689228c15d388a7ba28651df34179992f07455
SHA256

5370b4df441dc92bfb019614639a87997a02168cc12e69a129d7384a7e86105b
SHA512

6b98b04ce4a3d99d9205fd9c2afaa21982040a6a855d31c647684e01e6b8f274d330600723ca05fd4d39dbc49b449de158b61c65a037e72d365fe03134075b68
SSDEEP

384:zKYtdsr9jQJeQeKDwz/6Zt+Q/cD2SpNDiQv06kApcf2R9PdGNlcY2tZl:k

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423271702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4A6F0F1-1ED7-11EF-9680-DA96D1126947} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2556	2836	iexplore.exe	28
PID 2836 wrote to memory of 2556	2836	iexplore.exe	28
PID 2836 wrote to memory of 2556	2836	iexplore.exe	28
PID 2836 wrote to memory of 2556	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8531954f63f2bb541ec24c5e91790112_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc3fd2af777b5187a0a0d1c6150e1b0f

SHA1
7818ba0278b29813ace99a3c47fa75f77b41738c

SHA256
98ecce8cae9fd6041be48260efaa909350bcd9495e26df09bb6d781d14491955

SHA512
b8a0a87d1c5ee13833bfeee7185d8e70fc7d1a43f808666bf37cf1ee6ba35acaafd020630826a8dc57ac12e89b27b4f28606e8a994c2eb464f781b0519e55652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97610cbba56d369f192263aa6c680cfc

SHA1
8bb7d1dfe0cd28b2d9a7855c0515911d3ec431b3

SHA256
1d57f261ec84e39fd83e270d6ebd211a70adc502df7b9d063f6fbe0a110e1049

SHA512
fd55a6118a84ac9e6edce6fd3e86783c28b6f1fc837280253e9c8002b6bdca0c4596c742285a44ffff4d9057b5ed9f14cd16e941f07bdb1a25ff77f27b388282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ed8f0ea4a9894a4d171ae295ae80c09

SHA1
4e4620514836bbdd8b6fae78da24fd92aa3714b2

SHA256
7b3430215a8305f048f1923614dd4887078d14aca213fc74822fb56d4e91790e

SHA512
c62950da5b318d938a273879271d0461ad03cc7f43b65a91e8deb6880edfb807143e743a52c28fb0747801579b0c1f8f447739e25962e948f802d9d4f410040c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63a26849dfe39431f6948f9494197ec3

SHA1
5e2d76be84be20bbf2bc1b831d91dc998184e865

SHA256
3526939bca21e933a515b4c8dadfd8703cf0439c37f2a3706abcf2220f0f8c69

SHA512
251870c51af983ccc269e7bd7a0cdc1ef24cd3e97a570e54057fe368c09885021c63b58d6f468b994b3b9c4c9a84f8d44f88893c82f7eddf53b74d68cbb57825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d243ac62af5e27fb46fae6d058cc0d1

SHA1
fd517c6c3714cf9baf5bf1af76d2a1f97046675c

SHA256
a3e2865a8fe1fd16b970015128c91b21f6050dbe877e8b1c44752ded6a0efe5e

SHA512
5da96cd5a0a86a3d2b3a9fb6d50e4879d7bf9fb32fc7182cbc992dd010631014f910d87cf1f7ce110640aec2b0adba66884c47924e69d4e500655742e9a4e07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
760c9301801decbd7150d36f6c04be56

SHA1
dde4b0b9f9447415c63707dbc6240014e774f2ac

SHA256
993a1e761b378e9b2efe4df546bb5e41f380fc3375211f26acb98acd40edd72d

SHA512
82d67a476698cb4e121c04b866350e901b71ddf8ea8fdcc5048459f2f0f2ba5b5bc75f85f7cbd2de12a75769a9975cf945df754e52879a6ef09c648c80554cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f69d8d0f0cbee84c9a606214afd30262

SHA1
aa6269ee81ac27710a2db9cb56dac1642b5d7d05

SHA256
00fed236b966450506c65524ca75785e8429acab218699c3786e9fa5cdca2199

SHA512
05c6a46bc5a389cdca8884afcbfd574d4aa99534edd84087ee305424451cd116a1dde6e053a53a90e269125c0bee203106924881fa64275ef37127230b333227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93a9155446b9cd4cd0f7a1bb5630516f

SHA1
52ae2e9a04a522711befd378dd0d97dd89b4341c

SHA256
430d4dc0efbd0ebf9c9d447b0f6fcd5dfc5a28f1d8f483ebc7b85d18fc3a4a91

SHA512
d5bc6d10050fb07fdf9ca711b95b91ee1b1585e7ee09815001b109aaac53687af9533a3d3561eb4caf6916e67d7d2c6768fe9c32a4642b47a7c85167e3d75e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a84cd5e1ad18e15ebae25b55687b8804

SHA1
0339dbeb3342b49c7e1867b6d7bb9fd21c8476e0

SHA256
881669a1c1a87ce09b46b616c9c7f58c45b717f701b4170dbf0dbc13e623446b

SHA512
f602ff41d0fea4be3e086377160843a4f481eb137dfe8647f2ed5e3df83a1d793b2089bf1d0aa1527d621d239e24fcfba00696e326113138a20004f6e4b87bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab277E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2861.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit