2d94ae678cf8fbde2314392133e225f304890c24a4e1fc195cd3dd33ed75701f

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83db78440e2315b830b6cd1df6978639_JaffaCakes118.html
Size

104KB
MD5

83db78440e2315b830b6cd1df6978639
SHA1

1b4c6359e6f2d5e2c9785429a97218fc096c0035
SHA256

2d94ae678cf8fbde2314392133e225f304890c24a4e1fc195cd3dd33ed75701f
SHA512

6112b1fe744724a097151834d847772f04b607d960eec5a81a9250c03d8656d0c8cda11dbec05b1b66849acea6cfc4cbcf6f1b1528b45b9b7d3e316cc6cb461d
SSDEEP

1536:yI0gTJHnbs3VrhWBCgmc1p8osRExkwNXLyhKgCwSnW5M+LVZU3Vbn8Wuu:tTJHvnrg+3Vb8Wuu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B62BCDC1-1E6C-11EF-8189-4637C9E50E53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423225643"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1608	iexplore.exe
1608	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2172	1608	iexplore.exe	28
PID 1608 wrote to memory of 2172	1608	iexplore.exe	28
PID 1608 wrote to memory of 2172	1608	iexplore.exe	28
PID 1608 wrote to memory of 2172	1608	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83db78440e2315b830b6cd1df6978639_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f26fd6904c4b205d2617d59cb874dde7

SHA1
aefa7e22d8b4ae3285caff491ea7c67251b7743e

SHA256
8ce01e65a6a10ca30f71f7efa6b0a8702ac4b3123df6c4cc6d4b3959019c8420

SHA512
18d990deca87833a26dd937937f6f5fd0be82a09aab3f9a4b44dc2b501814e6d5a2f9293650902bae95eb0bd8b6efd96e7dd92d9e8911a43b8d261aa5502655e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdce3b207f3e8eaa73c092852de9cbe7

SHA1
e70d71632033baea02f3f4e3ed5f097a859eac4f

SHA256
c0169c0801200e67bb6832ce2113ae081c155bddd104c4db0913de5c1d4c5dd7

SHA512
172f93ff0c193217557a4b54cb1e6293384767085e92aaef7d3389d131cdf32d3bb5bcea52c6491c038e5ede9f7098f029f920c9fcb8b79b428250605f84f7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a659e511fd204b2523c33707770ac26b

SHA1
b62f5a79769bc83c9dfc837f535bcc2a5eb91d36

SHA256
b3281d80eae984daccd54e45398d910641fcde7402ad6a142d083da8182dddde

SHA512
5d33069c693cd137c8e35438813eed9830f1ae02db545328ff42fbdc016f7dcf01a4ecf2a9fa8d9ddac45a9ddfad2ad22e1abe3922188b3540b3ebeeacf1fbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b986e80981c5124c8c6730a1559a97b

SHA1
17a26c419105c5e72b07fcf14f7a95f96a6d8672

SHA256
e0de414a23aa238e5f564d10b89c0087c67aeb9f0c8566114acf6e1c76f2c1e9

SHA512
567c2e9bd1744a1e48d7cd6cb4e77dd46d50a9bbba68155c9103d6639c2706dfbdb47c5d5f3c9c4717b5de84e39fc44d46db3c12c51acef1d0fce4bee349e44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a9040d52711bd983aeebbe2e2ad8f30

SHA1
5e90cc68f138ef52e191ba7664032f34dfb79758

SHA256
7e7391672f3bdd3c8fbb705dce8a7c7f9320b8277f0f04fb013f4d708cb100e6

SHA512
1d5908a889779dcddc07d40c8cf779abe76abf821a6b35cd6f71e1525995b5586d9ac7c696fd7878c0c8604373359873ade3b0d33aad89e4932f0f62779efbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e8c152e09c39fb44b14803ef4cdec44

SHA1
ad5c60569dd84cf7162f1eb758f1d63ab9feddb0

SHA256
a1d5101a79f17f3229f7697ed391e60ece89898003659be85abfe6e1abb19116

SHA512
0f8833a6521cd068c64c54c62be5d3b201e2aab2dacf00eccac068f3aee433a53f1c209582ce8575a645d90dfeb5a27cc1f4a1a42056684e6ea6a32b6c5a095b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4d98808349721796e20c0b3bb05bb2b

SHA1
d574e557ff5b931e1acccde24f67fff5f0fc8e58

SHA256
7b30b624997e575a1be0d5535776524e8b069d3c7afa70d17b77d1edb4d116a1

SHA512
1362fb2fce82b7793ab58bbf94f1179be4150feb959d7ba950a37c14758d87963f970164313fd1ea88b92a545df9de52a5efe37eb2dead2edf1bd1164365423a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c17f163ea2ab20c2b319fe182c4bfcf1

SHA1
0445d4148b708dc51a4d4ad52e676fd8d8ad2ccc

SHA256
b9843a1f2b74e5c59250b3e1eee7a98d01544a89eb251686cfb60397a4f8a307

SHA512
7d5ae8d189b1c03fb2ec777405a4dd4ec352e98ff5bc345711eb322e126b0302dd2dcf54e3c52f1b4b5340aaab0c138b77730d2aea247d706e44d724dfa0a8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8843c27f2c924840a35c32f1fae7dd6c

SHA1
d7e99beb81b9f7b610ea2370f1dd61b748bdff93

SHA256
6da187169cdee77a63fa01927c13e6358d211d19209b19513a93419c4e7880be

SHA512
dbb7a2041c93b01d64f92dadbf2b28ce06de1c822e208edd0839b1d8b74b94f6f0335dde1052facae675c1c1b0359137e7a1e01c37cf18c554c6ed22dba19836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1872.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1906.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit