bb4b71d7d750003f9cbdc8c207ec88ab590a0c7029ec8e565592e12c955bb83a

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8304a5cd4db90167d75406cc1db16ca5_JaffaCakes118.html
Size

35KB
MD5

8304a5cd4db90167d75406cc1db16ca5
SHA1

483cf2a0e0f382febd3c22f74ecc7032f5b695e6
SHA256

bb4b71d7d750003f9cbdc8c207ec88ab590a0c7029ec8e565592e12c955bb83a
SHA512

87d2e6b787165fd098c94c4b07db6722841ae0cc69e9fd10b85c6e04c65c6edd061853c8bc683ec5f9b3801b3eb662b02f47076d17ad6d2d24463a5028762572
SSDEEP

192:uw16w1RTU2xPVb5n03skvmAqBYyZBYoE9nQjxn5Q/AnQieKQNnL1ZnQOkEntgHeA:RQ/AY7m5NIphpNovguGLNA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8372E9C1-1E3C-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423204940"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2448	2176	iexplore.exe	28
PID 2176 wrote to memory of 2448	2176	iexplore.exe	28
PID 2176 wrote to memory of 2448	2176	iexplore.exe	28
PID 2176 wrote to memory of 2448	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8304a5cd4db90167d75406cc1db16ca5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c80ebef7cdf9778411908ce1cf853ab

SHA1
26e02cc39bb62d2e56a36a80600e98ec91315192

SHA256
e1cd4430d9f5116fa78e228ab990b000e73dee7f0fbd5d3a6d4c4e4bc8cc3d1b

SHA512
f206dd74672fe76ae8f5d597020b61072437f951a0cc40197ef3bcdc73b2307e5bae88046be8d8f7c1c1a5154c520f29d9b9e7f33aebb0c132a244e57eedcbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34afaf008aa9ec0bab42787e551716e

SHA1
42e62712535485a648a4acbf1163afe56c25eabd

SHA256
270d9914fe550c0f48076264da2a74dd719c7d4affff965a3e763e57331e25b7

SHA512
276137edcafa7a0ae761c4da4a5651f28570f7a786b5cadff7418f5fc9c193d2e10602bb28618acf3382ebc4db4bed121e79ca2c7c728028ca31adc734cf927a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25528e999e05595f99be4b62ff3eb177

SHA1
8fd142ae70bbae5c6a0b689e120f73bcc97fb93e

SHA256
af58740c47943a9fb1fd757d1e12c89d2e599a5891f79b7f703d8cc152213313

SHA512
efebeaf6af2d9039b5c513e3e4548a7db91902be43c440c9959b55d6d3658d1c432c450a967ea416bb5eccc2a3cd6b21be2e44dc80fbc6dcf11d2df14c4c3270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
704d2d39a9f12aa880d41e0798d866a4

SHA1
d313086ed365bad0af07e5aaff7acf024b50e37e

SHA256
985d8942ea1ca8da5947a25cbde1e6c793ddf87e25bcccba57091c2ff7d72bf4

SHA512
ef056df0625d5ac79455c0b4aa95932013c7d870f25b07e2684799949970d038b6c73bc419e79b903216c5661eb590477c685f579457122c9c5472c8e75f01f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e5e2d764623a046159925652e87a1c8

SHA1
2d15edc717047a6adf2fe2339fed06fb00e220b6

SHA256
75b35efdb7de5442861bd69607adc0a6ea4f16f01e1d08a5baa97e7e7c44d481

SHA512
64130705c1a0c43a57d1c90ba6b0d74f8017c23816638e63dbb0093c12af4ca53b06e34196cfc5ca60ea3c6126629ff9f6bd8e152afefb6fc464cf4a9c2d6c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9096729051e86acca6bc72b84b6d1849

SHA1
313f05a9c6bed6c8197730da2601d61a94a20935

SHA256
17b91ba9559389f5d44c6918ba23769cf96424e045b03adb2cff16f4270b2061

SHA512
ce5aa9a7f6b6ab87b6b35d5d7adb7e3c4e004ae98f985a69eae631c0363de5efd3e56551ad674fe00c21f1e876ffcc93da0603b4e2ac861ed61b46c66c962b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07bb32e3b68323196c6c896f06392964

SHA1
3f01ebf3df29c63737b56d8c3c6d36f8e2a63766

SHA256
700f1ef46cf50bc19fdb58faf90f192b9fafdcb85894a4ec6d459f15f37a2345

SHA512
7049ba9610ffbb387fea5b3e5158055b09c1e666ef51c6583584360cdf50a2277aa3311cd8dfc9075f0741029182ab85ee972570a9ce5ca82d31b75d53f60917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c0c862b696fc4e8728a3716e4a84ada

SHA1
9f5173341e7eebf9c64892811527c45fffceb3f1

SHA256
dd549cfca6655b461f54006295d8b8241ca306cf0f013ce09b2182f33f0eb947

SHA512
5244e1197e9242ac950978f9db698e798afd9c044a68384759e54300eb5cd9970dbe1021627bdcbaa6a23e1eaf4ef5d9da263c1d96aa3496a6f5732a8108135e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f3bbfb4b656fbc4eca9ace5c7bd016f

SHA1
7af8311e9ae79a2c970de57ceb2685ed6daa8246

SHA256
0eea74c28661993c5cb9f14b2969c76a985e528419ee96333a485e55fa004ab7

SHA512
e93958ff6832ae1ec4d6cd8cc0c48f2d3bd6ad880245c6f365791667a4e23fbf470033eeceaefb53b99a6786b85ddb7391f59ee29293b700b5d1f28f0f5e23f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c3cb940e5b8f47f82b8546215f82d47

SHA1
5626dc3c9753c31d6a33fe88454d3408c910270a

SHA256
27bf013d847ef300042a578ebf12b23de2eca77c0bfac39f73e1cc75e223d32b

SHA512
08dae98cbdc14fdc8e0c36b09a8b1d50f1f6560ab24e38ce13db7f421a9f556d6d835eb790d13b32f2d2583c31bfd3e6c907bd9988644b0cce959b3862b35405

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18EF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit