b502cc816d1c9d4b1e867bc6169fdd1998afaabb7dd9dcfdb1dea4bd956328d7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82f5413ed658e84b36d86b35f2151925_JaffaCakes118.html
Size

23KB
MD5

82f5413ed658e84b36d86b35f2151925
SHA1

9e9a3b188667ce61293eeefa6ebbd5b5dedc3af8
SHA256

b502cc816d1c9d4b1e867bc6169fdd1998afaabb7dd9dcfdb1dea4bd956328d7
SHA512

da6391af6a6bc62e5c095a3fcb32b42f7c7e19fc176c9516cca97f928c9acc88f3690251c44667935c3ac26d944f2e08371cb121fb7b8fe4297066a07fdc422c
SSDEEP

192:uWrIb5n2mnQjxn5Q/ZnQiesNn8nQOkEnt73nQTbn5nQaCnQt2wMBMqnYnQ7tneYc:jQ/qmf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2401C3C1-1E38-11EF-80DF-F60046394256} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423203062"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2420	2904	iexplore.exe	28
PID 2904 wrote to memory of 2420	2904	iexplore.exe	28
PID 2904 wrote to memory of 2420	2904	iexplore.exe	28
PID 2904 wrote to memory of 2420	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82f5413ed658e84b36d86b35f2151925_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
900171759ff27a2e53ae16687f5901c9

SHA1
868d9419ca5850c60d5e1581b3bb465ff41cb141

SHA256
a28ef4b903add20b1d2c7051945f5c6ef6b4ca6118b6757b159ae95645b60ebb

SHA512
67af26cbdf93c47afe11c6a4ef695d508556753f70e48aad9d13f95c4f0ae661c353242f9007fd9dc3932cd9e194ab8be183cf20d0b7b3b9655f810e0d24181d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b2d877ff0be7e449c1c7e24b040237e

SHA1
1ceed9703b94ca220a0c052dd081520a8810f73b

SHA256
1ef1e62ab28b6c8be06664e064acbf499f713f9addc3d763d065a3d159da8776

SHA512
8f70c39b15db2503d9aef26d48fc66e164d1260d4842e325616c452ed06ac77078106b2da30c9662e8e9effafdbe0310773b291b30c40cda0b6cd1575812f501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b33269e220c0b52c33749d98363e9b1

SHA1
5b41bf375ec72f8f053922014da41fd48e86ee32

SHA256
783513e39070f78e84304c75d2c58cc5ec1767e6b694656e7653ca3ee4ac300c

SHA512
abea17f01999aaeb04a6afadc13dcf924c0386978f134677f957adc3d1e76b0bd1f04baf590d8473c4ef8d0f524c92e5c2d917f82c551b04f4285ade4bd6b0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a326848fa99f3bbb6b9fa6d026c12a2

SHA1
cfe644772d16c8ae7209c347033c4e418c6a1969

SHA256
2fb53faf071578de6df387395b83cebd75d5e1544cc8b4a590b1a88732a5683e

SHA512
8b71c21dd4d5e75449e8e1373130b2baeb2d252c400a846bbe5ea502c7930675bcf1e03d051fcde465edafc419cd6aabb25eb3a3994fa598bb08324a1c862a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79730a3c3307abb90d3da12071263c48

SHA1
3468f22d2dbecc5d8a9eb445e640895406aa2098

SHA256
e0a70ea7410bc9bf18177ef831649536edc28e133807e3f90f5129d85f83b22e

SHA512
1484b184fe2845e63aa15d394328ad4f16500901031b42573b467e0926206d55f4fac87a0b9b05c4f8635b20c95760b23b967441cb3043c611eb3c32dd3198db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e8363a000448232f586daab4f6b8c24

SHA1
ff7a6bc17ae9d8739d3f849019970a1bbe2f8ed6

SHA256
0e2171382c8b17bc2fb3b5dec75c43ca7c90a0067adec2d90e9cec90a4a9ed06

SHA512
abe02ad2dad16a3510af96499a783d80ac497c16b0c9079d3b153e213f4d023bd52b517fa515461fde8a4b972ad3ee585d4723637114e4ced153643def44cbde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1888ddb27845e0a6452ebddee4f7f33c

SHA1
5b49d34e3aa213522adb9dec8afaa66520263625

SHA256
46ab696c558d612b5b623a29b1d946fd190456674695df1f895ded4e17338d4e

SHA512
f416793d71a524bab3c1f0be24e87de3eac8871550206a0565510d4005e8ff4bfa35d9d898be628bf8e5847822b13c0e384e008bb41fdd80f6741826bcd9e79f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dfc5627bf935a61a4f9cc25c10ac3dc

SHA1
cec8e942d1227b3959adcc0d9c3e75b5eacc3128

SHA256
41ddbe06412748758404e67fd0e2620f864fb62ffddcbe087340ca85057ecb42

SHA512
6bc34c1a4c1da82d99a6c501689bea54599151c2873bd9e124b99c88641bcb3b323c9085e15a08e552186cb92997fde3417b39c91f1fef654b7b3237480808b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10d569f60e8d18f9a5537bec960074e3

SHA1
6f448b101e5ba8d4c1a9bd74a26b6d3491d2c721

SHA256
8ec2472a0ea2acbff5b23b7aaf324ad9273d68a542b0dafec31c3e73c774f24d

SHA512
d2f24bb759c71158ae67af83bbad6d4041e497aee7a221137ee5dce0b5c3c19b2ef7022dd1c518b6a9be6a57c7f60ae88743e898a251e09f34530ee0b238ea9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1870.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1963.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit