4baf079b54f005681de0ea51a90c8d71a26d5d49258af84e058ce28f5ea6f466

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83bcfde5ceb4c1969fc4e77163fdf074_JaffaCakes118.html
Size

23KB
MD5

83bcfde5ceb4c1969fc4e77163fdf074
SHA1

e06f08fa66d90034595096d5a8931a3529b66350
SHA256

4baf079b54f005681de0ea51a90c8d71a26d5d49258af84e058ce28f5ea6f466
SHA512

e3346051da05c6727e1a88e3307ccbf787563f7ff26ee939151ed4ff60427ad66cac6c5d363bbd69cc5531153979f5afab32eab509d48c58d03c0bc06170e4a2
SSDEEP

192:uwrAb5nO2nQjxn5Q/JnQieMNnWnQOkEntnrnQTbnxnQHGLnLnQtaqMBsqnYnQ7tk:XQ/GGnmSi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BD03821-1E67-11EF-8DE0-D691EE3F3902} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423223342"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1916	1688	iexplore.exe	28
PID 1688 wrote to memory of 1916	1688	iexplore.exe	28
PID 1688 wrote to memory of 1916	1688	iexplore.exe	28
PID 1688 wrote to memory of 1916	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83bcfde5ceb4c1969fc4e77163fdf074_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1653c1f8a9dcc5ee37165129cbe82b89

SHA1
6221b22d7702edc959f7a738f1fbe0c734a1bcfb

SHA256
0198c6cff1f7d47c00c1b7892f55f26bfb2e872dcddb4c36dbecc4528264fce1

SHA512
703683eeb46dc3f19b91822aed994be539683c4bfea22d3c16cb18aa473f2a5f1388f3c1f705bbfcf262be49276c5e5989f32256c2dc02c4431130fd2e092b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a56f4a0882d749b3c28a586f2ee2f353

SHA1
987aa08df923bba1a8f0fd55e7bd74de7956497f

SHA256
32da5df2581fc1f7103cae4e9922ba75b7bee46d2cd79a865f3e09fd52bcfbe8

SHA512
2c9082493b6677c9ab8070c3a5442ac8509379d9e1b64e5c7deb15ee061f71611a63859099060226e0d4b625f76994225da82857868f97124860c8b6f25288ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c83da341d272fd489f3acc247f56861

SHA1
3dd04653972c25013d06e6bc502b732f2a7871c9

SHA256
71aa61a115a95fab69b05e7ae02caf0774c98d66346466b7471ccb6397fc45fb

SHA512
f1e562952f8a7c169a2b2aaada1bac21e29ec20779ce27b6d7c42f00d23c3332cfe3259350cedb3ad1a7502fe70ba4737eba6dcf6cfb8b3d7faa9a58f25886d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc48d142e0d36f5dc4f09cdf2851188e

SHA1
0a67d55ba258ab190bf6380bb71d242f737d2fa0

SHA256
2e9c40104b60ab96c869f9313fb0b87734d834034f998936f59fd05b91c9fbef

SHA512
83c6614320467f45d9e0e9a2ed68742d5e45641acf860f4b3d0b94a4c2529bc5405f0595a2ed618e3310ef3ef2381bd79aae83859605d07c49c3533058503fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0169c5743c2f0799d0c283f46d15f259

SHA1
0b92ca4c2ac3db28886f5e7cb522547c6b98f34b

SHA256
44a0bc9478bfdc040ac8799dd18e90fd16ac13e350c007c086a217578b9cde83

SHA512
da4ac6b44fd6be13a794a9f1976301c8b268dac139d9b65563849ca4c44fbeecdbf14b870b6458b4ab1d0b4654439a6b7790533f162a610a03303e1bc38db28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e884435284f760e8ac76ce7f864fd321

SHA1
221df9db862a5f0937db1c77c4a645496ef5ad53

SHA256
725026df652fb3b03f94233a850ceb64579612dbfae2f0055e226b34dfa3f729

SHA512
c47ee4b1843fc64437bd09a9d285f85ac6ef3ec7ea4bbd4b8faa2063635de3d1ef90fa321e505d1650475498a82ec425cb8226488029bb2a202ac8d54a164f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e3fbb794a69d4d8dade59b47a8f5599

SHA1
d84c0bfbbd22b623bff0a505cd283cbac9130e48

SHA256
e24621689cc4d8dc27fdc14531a3a299209a8dfef4540f2be925bd16d78413c1

SHA512
bbce221ecc327e4fefb5a3d8c7c83a84f0bfd712cabaa4e850502ea79188f397b55748002f7c94bedc171f5f6c7e74f13a1b66fd8d8ed9cc4658f956b07674c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aa6f720b3a19f265ec0d98b963fa5c3

SHA1
e074839db718746635883e18d555fda653513cb9

SHA256
a5511f66f667aa1ce2a6ab5db60e3fd12fb0e00412425f7a098323f065121179

SHA512
c54ca60af81d436c495fc4720a4edd24897d138022becf0d85855ef328f559dc0affe0d4b698591f5dbc88f3d5bc926d3bc234eea4cfbd1c9e0f5ff9c3b8b1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
576e21acbf91b540835ca0797ed6674d

SHA1
1d64cc0a47a728c5a56ea254a319ff3a516c22aa

SHA256
edeccf072c8b6c8a3bc39c4fdb06bebaffeffb69bf1a445a80ed34c7e583efc6

SHA512
b1425c17058c589fae1e4e8df249df2fcfefd4387f5ee077d0be8440aee86167a8082b4754d08cf60362bebae23ff6a3a9db0c5829ba7d7bb53936af5326874e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c7ca8bbd716ff0e5cb10db15c5f1fa

SHA1
168b6c9bd3aa2ee67889bdc680d15cc6e5bb7bd6

SHA256
590914bde95d8b7d24a422b58242982d0024d4318ecbdb50c587c8c409f8f07a

SHA512
2fa74f24c5bbe83238394982237c2bdf144cf3023019667f1e825273866aaccf7d9ca35510e8308d712d24e8090c596d6c53049db44e02b343df7870ad215f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
00b5d0bccd063ea4488157ad1859326e

SHA1
594c838a3d77e2705aef2d9eed693dea08f172ed

SHA256
97503b938435145a9aa85498325256fcfe9e0b09daedf887977ec6652d767cdf

SHA512
12ed98f3f1c885fcb24e0ab744b877a573dbc632ecfd5dd98520a612ba59f3217c235c9a62f00fbd8417f9f0c28dfe41d0919115274e033785cba06183eecd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab925.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA91.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit