60d8578856855311e2a9f1dfcd97e8f65ad6b3a9a128d848962c3829ad92a71f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82b20550f42910484d501d0f5d137589_JaffaCakes118.html
Size

29KB
MD5

82b20550f42910484d501d0f5d137589
SHA1

e3cd515ce6db8ef87b3c6aec158b55952851a54c
SHA256

60d8578856855311e2a9f1dfcd97e8f65ad6b3a9a128d848962c3829ad92a71f
SHA512

3673d24fc90b28e1e41970114f8735ff25301fb0ed559687066088e110f62e7a6f0d4cdc8d8f342c97f2376c365b9102787580e88d5de6d9ef7234348048f7f0
SSDEEP

192:uWPkb5nD6nQjxn5Q/3nQieWNn2GXnQOkEntxZnQTbn1nQdMCXAPSmSbr/YC0e4VX:QQ/UGXVjmSbr/YC3/Z/OFL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79851791-1E27-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423195903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82b20550f42910484d501d0f5d137589_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b43fc37b3582e82446c1ce097ea49c0

SHA1
630c35c3f7d4df01ccd40673b3c40ec988ea1003

SHA256
a9092f88fc40039bf3c01190921031d1497004d31718b858f60d81a03fae72a8

SHA512
17ba4ba77f32ec07828375c7583583565f4c9a5aec92a97533b4d6e44b1a633fe983053aebc449283dcb8fcea82d3d156add27de154de7338b02cde9be560dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ff45fb65b54306f9094c3d6871bdc50

SHA1
e606eaf733cd61fbb2b3c3793d3502d29ddc127b

SHA256
89771deffee8c7ad0a00ca676923168615bb325268d62bc07c8a40580367055f

SHA512
09dc824f97ba128b6835531ed8675f6e726302523bc7ce88522ff05d698ef1e5fb0f955ed6c8ca4b9c51e75822f053eee58fa344ddf61f53d3bf8f9b13a64e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5907b931f52df67294fab21273270941

SHA1
fb131118f5b0c464f5e3cabeb6ae7abcc69abf77

SHA256
e0e89c97698ec68a6d002c6c59ba7ace0244445ab8806b040a987b7a13afdad4

SHA512
37877e38039a4708f7152be18d925b1b8339a07b238ae68eb6872b2d6df4a16260813f9affedd1d7c4f87f9c157b930d0d2f72e50ab94ff13c9934261c2c942b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124f8b35df8fc91534e41e7d4a93fc30

SHA1
3899a39c71e727dc81ff53465e49fc45e4cadde9

SHA256
66ccb1865e735586dd30596a0342a8ce93ac36386b1045bcf7bce98581b261ef

SHA512
ae721a907926e352d1bc5e39ea1a741d4ce8c24908fe71cfa7ad64564e4544a525d2377ee079d6a30a2b6b2379ee61075e8e141bf0a71769e5d9aa2d1389d74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f771ff669c74e59646e5430ccd997d53

SHA1
5eb7854da217111ea10e9795d97c998f56878017

SHA256
99ca96e8463fae2899bde3fc9cb9dfc98f485a1cbc70e5839cf0bd153b293340

SHA512
a96f91de5ec500a6aef5d47106795994ad2fbb921cb6d0d6adf2952decbedd8de58f5b2c3ea26f614b50c06da0de2b7c99dc0626868153aa48224419d937a781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76584d04f04efb7d93f5c7237dad9d7d

SHA1
a58dd4f3d21f1298a0c6ebcace71e7334cf5b67d

SHA256
b4587b58e62043d5982027bea71e44c10a99e4d17d103cd771073e3a8e6bc3a2

SHA512
eb913204c3a4a8b2e0e529a8c316a1d579bccdc6ae8aefe4936694b5dba2907ff87e3ca8fdfced174c2f363c0ef35a8c0887e2b5d16b77dd13c8781c1568504d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bf349acbd676d4ce5d81c77d75529f5

SHA1
dcbd60429058c224713d165fe527e6a6622f8b7a

SHA256
dc150b4ebcdaea64af6e8a2a806e45e2c8680c39e695873a877c843ba74e27ed

SHA512
025b3ac389f62bdcac3c19e6af36536ddf784f1e9545941aaa6fba386a51ad60f7fb58dc91fbd0d9b3c92cba0020b566de1e8bc2eca4c2b9d6a5921970984955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12af84e41e7c136317e1d37b01adac51

SHA1
3e462474f7460ead7f91092691b83b5e4ca2ebfc

SHA256
aecb9ad9ca78d17a45695fafb78d7093366a8754489a97e7abd13a5a088fef30

SHA512
bb9a5ba8b9ab798a3e9d19e240e4b19f5678d3180e824840ad0b2e4ba9f378333b81b748fe2aa549fba01e001b2181f47e95073960a1b678b79fcd56bbb266fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b7166573e5e960e06e3bc7a9bc36d72

SHA1
466a6079e8df15bf3ece58aa01f2757d7bf7c53b

SHA256
4bbb8ef131d94ab40e049aff27d33acbe8607a96bb071ba60987129ef5698b0f

SHA512
a2137f0b45a8aa1b20f8899e43605687d192a2c9723f3bd72df44b2d3c64c6491d4b22ab53efde4edc731259fdf2614c996f91ec1f14e6e42a0a54bf530ad8c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
838f2d9104108f75f5ee4c0e25b9b20a

SHA1
bfbcb1848ca78d18ba1ac19ddbcecab439b2e29f

SHA256
5a0e3ab6cb38c7b810871cffd35f61832a7317cd86837bbe0df6e460e6bcbed8

SHA512
61f05fbd9d1a6cad43acf706a85bf87a7f9c0c2b6df830311246cb4511ae7843e5b47efd033d92f8a004c42e4e16313e10b2a94443b0ee3a5aa0ac039e1bc9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB58.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit