b9b9f8daa5bff3dfd1a3f33ad0fd4a08ad54f42aeebe11bbc8df90881a400ca8

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e84f1bb6203dac0a2211057d7f9831_JaffaCakes118.html
Size

27KB
MD5

82e84f1bb6203dac0a2211057d7f9831
SHA1

14324f31fb556b60cbf335ef2edee3a9d6de7ebe
SHA256

b9b9f8daa5bff3dfd1a3f33ad0fd4a08ad54f42aeebe11bbc8df90881a400ca8
SHA512

032603f694583c341296862ab01a26866c9a43eb97b537b180424a0701c4aa82c99bdf090da3008ad35399eed32df210611a53c0b2646b62dfd96998d97abf8b
SSDEEP

192:uw3Ab5nJ2nQjxn5Q/QnQierNnBnQOkEntA+HnQTbnJnQ9e/Lm60/hrQl7MBLqnYQ:wQ/tWdshySlW9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423201792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F09C4A1-1E35-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82e84f1bb6203dac0a2211057d7f9831_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4f23e87810fd8584d07bded8247a2039

SHA1
29007adb7a80046e9e55a39bd233d393af66a47a

SHA256
1dc5a72e7df8ffe6901c831b841efadb1212fb1dd2379e995ffc9612e9033036

SHA512
c1e3a6484f46077fc05534282bada6f721c8020db38baafb65e738272ec82c574195fb2bcd29a9cff28afc342865b7eb8ebda17c7df862ebf49f5809af24a31e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e33dfacc547069b0aa0c080079ab1076

SHA1
de43e7e175f7681d9b2a133dd7133137fe4b1c31

SHA256
f3594fc0e4b7c41d7d06c9c822461edb1082454db9e3143f34c7ff86f0e1318d

SHA512
fd4931a25828b81f1b99834845ee4b948dbd7f4fb4503e711a7ac0d9d5d4cf3c8d868a87cc4a1c8baa4b4a7d9f65c4897c59d0b64163c20fba3a3091b0fed08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4dfd2eaa5c583d36844ba67399eaf8fc

SHA1
265ef9ffc3ed71c09993ae1132db4a940df6b60b

SHA256
ce88db982aadefd8937fccb06840883dcf92ad288524a5ff5b9a52590a1a36a0

SHA512
2695e342a60d35e537d47e0fac9144bc8a43b36c151695aa579bfe26a20c2798be8a4f89657a0fee6c03ae5447b3f12b37c5515ba97487a23c8839cca5c7e9d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7f695fc488cc827027ef6ff5e7a0bfb5

SHA1
652305b896e310cf33af70692ff884c284abf45d

SHA256
156127b2960a74e791211be2ef4c091cb98b2b3e28c55c70266ce7d6546167f3

SHA512
c1bbd0fbee5c7b6d5d15eda6a217a22e923ea20591782133ab742604b929ec657425dd6ca515544921069dd36c93f3327503df94a192b064b8b154fe8095ad62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4eeaa051e4d000615e2d678addf90dbf

SHA1
f15521ffd57863063837cabac18605d1871893e4

SHA256
9723c5d3af6b0693188402e55058263cfae5d1e9aee3594aee43841872a224e2

SHA512
fbf452e005d8e34bc27cdef3acf446e2879181ca7c54df95dc73100ed31f560da5b5598ac777ad42a1173970ffa0e72aee4afcad5f6fd87d23f35ee1b420fb36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6026586eda0721ce6d59a61fa938986

SHA1
067d8a088b9c0804302ecf89edf4479d5e1b2ba0

SHA256
2ad89b1512157b9d28ce89b3072e980e32e1461bfd3b47dda78efe2a5d404361

SHA512
cfd70d641b1a223173f10e22757da52b26684c7a4bb09684d54748f80795f45b32ce1cc52cf297fb44bb11dbed532f70b010697f6a48a7cbf10f458c529bcc80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d98ee4455c761d7de8e1624e717bf9d7

SHA1
2b550bd5e7b2f2a33600cdc3b2f9c22786cba208

SHA256
f679d1d84c685fd2b67d918c513ca68978cd2aac5ae28133ecfec41cf91abd7d

SHA512
cddba5ef537ec1b216c643f990d583ee9e32fcf667402a2cf552eec08227bafc487df8b6abb9df6660608aed153268b3d58e017f25cb98d155dd48bb7da0cfad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fe0b65658c6e23e84e6de688b54b3587

SHA1
3d890892a8b55246c0120f7f036e07e05b208a34

SHA256
2f843d30bc013fa9fc27c2e364a695ced6f2d040e0ffe81f961a9774708205dc

SHA512
bd536bf70f2304d850a1660da640a982642ff487b530d6ff5690c280ca90ebdd68988a8ad4b671a69f026c030e3ec8a70e185559291dc6c181e06c47bb2c02ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b06c5eb92db09b4d520d1a5a2050b9e1

SHA1
f07f2787f092ae03cdc59ec4ea59130ed8d38673

SHA256
3f06723babe1e17ae82209c79e81df94a5b5020ab48b54a851f87fb6afb91680

SHA512
0547c940d1a3ae5731aa64f56159112c27624d9bf06b3cb01b78b1b04f9045f9243adc036438b165db9bed29f08de9a19a87a351979f0d1be0a776dfe2b015b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bb432f75a5815a24205478a00fd10dae

SHA1
8f87d8fa43500677435c0a644275ff9141a19208

SHA256
a96e334ff62ba204661406a5d75373062c8609842ab51645a3f0947949321fa6

SHA512
7bc874aeaf3979b9775422508713e32821311d957509d3e069849414d9c9634be809bdf53a12ed99090d89b115fd3b49642bc72b2dc7798dbbc9d43e58c16eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1566.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit