33f0f63b2cf10e91cb89139ac42eedf9d66e3b9a9537064de754f88fc2f2f709

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e8aaeaa185b1767fc666b0bfc1401b_JaffaCakes118.html
Size

20KB
MD5

83e8aaeaa185b1767fc666b0bfc1401b
SHA1

d83885fc129896d36165629403170839aa27edb8
SHA256

33f0f63b2cf10e91cb89139ac42eedf9d66e3b9a9537064de754f88fc2f2f709
SHA512

7e4decfbb1379aa5379e16fe5e96db3103db8f1ddf9ab4348a17dca4ade1c056c7f578032856f81a95b0d6b2a48001c55a01245759685a5c5610a8948c624ec2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4wzUnjBhgK82qDB8:SIMd0I5nvH9svgJxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423226890"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F346931-1E6F-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1864	1688	iexplore.exe	28
PID 1688 wrote to memory of 1864	1688	iexplore.exe	28
PID 1688 wrote to memory of 1864	1688	iexplore.exe	28
PID 1688 wrote to memory of 1864	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83e8aaeaa185b1767fc666b0bfc1401b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc3ed6800d8ec92d39c24621a0c2b88

SHA1
fab54762d3da07ae23865800d7822534f374303b

SHA256
e5748cc14e2e69d463782ec16e07c6d2e9f862eff8d463afca8a282581f811b7

SHA512
d00f26b96251901bdb706668df1d5e5fd28dc9066c26e3f6d502e4de53a07ad521d5e032a0bca80f9247cf17fdd3311698345129c38dfe9576aa7678f96d4e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7d80ac7b8951f9b06c995ddb63b7eb

SHA1
adbd2167467c0d56e1bb79421ccad4eb84806b4c

SHA256
eec61475c51db214c23ea412793c03ae81625e9441660baf3f13218999229786

SHA512
ca66d7572e0be8e5de50a32d7edfd47481a49c1dd941a9cfc76b2209579b2cdc729d9f6c7b4af381c87910ec87faf115b36e861abb01c13a0416d46a3533758f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
333c6ccacf6ad97205b21603bb834f13

SHA1
f5d20cabc44e799688cb5aae6bdc5451fba343f7

SHA256
f7ce9090c37bf84f93904a8256f3718c146710fe9b202bec7f74ed4f5ba38a8d

SHA512
1e871ecf08a21dfaf482d79e81e1adf497973a9c33cca893f5969cd7f63d1a3fb1a4a49e69d277a2f3f7443e0d242077a9667a51939922d9bef684550ef1bff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe938773ef14790c9dae1385cf998516

SHA1
822fb3d9e772e4655d014e88f1f5a568e160c0ef

SHA256
9fa239ae21b120b7a3229bb53428e024c8963d7d74ad4277ba88f2978794a78c

SHA512
f1e4b2e61d649d8c33220194901be967dcbb6d8a60cb8c93783a737b973af7a826a57cc24f1bd43f54f8be55e8ae7e19685327ec025f5e67c0ec11ec48b461d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5932d90e96344605097130b957df98

SHA1
6df8b10758602ccb840b05a7b7a3183c23cef45f

SHA256
c2eed6a0d54d6a1c9c26ef6a9dc1e9258471af87af4f2284500cd63ba823f29e

SHA512
0f9fe69d191afec5646f16e7bb878addcfdb1c621175325b3b15bf6e9b754bf48269a0d5663a1b86a13c4ceb89a1bd7136b87fd1b6d14d1f900def38e44555ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d355f10b8c59e25ca06d7282bf3390e9

SHA1
330a4c38fb1db6a6a7bf831b8db7ede093816973

SHA256
5c994c39d4043ce54cf2a4c9e8b8371066e53047d7fb90d2ae9bcd387e4abcf0

SHA512
82c0143c4aac3290c18ecf2f20815bb8bd0c103ac19e9afe8782045ffdef9be747363e8572ab289cd295f0e2cfc398bfb1ae51ce155bf37e620436042ba33196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
999734685f8bb31b1f01ef4e99a1ee3d

SHA1
94827861383a63777b24e49a0316716bc24600d9

SHA256
81603f40eec147e7c604171f2b4452061d061340d2a8aff8ceb618463828f6b8

SHA512
9091b9d0833e62cc7216e015c45debe719bebc335fcb81c6540643aab4e5575a653b073f1b36c6c537d3d722353427e7e99acce35e5868086645543ab31f7210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
674aec4ec6fcefd403f4f51d2a500c18

SHA1
912d5e681ddba2febc23dd5a55298ebfc2eb75f8

SHA256
d9aea03c8049829cc5ce1587713555cc6bc0c6ba3fc62619bd9ad2123a0d39a0

SHA512
e2d62c4db61f9168f5e727c2afd2f50eaecdd46d30058ebafc696cbfe3175201c2a119b05938d17d5f2e81f10c77912d88e98067a4c2d5649ce6eb27a64a9adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bfd74543e9a23ff7259fb873e77f1b9

SHA1
5b2c06fed03407e2b6381e7d2675b9de23e43d04

SHA256
a4371119f47a556af062ff9a0b5a6189db70235fa79e15ef1fc1af01db47490d

SHA512
368fbc9c42f03803dca066f5ee9de3abd5916ff65d9f6560487b2ba0f88e2cb09ca1ef4e214b1d8db7451ff5350446e3599ef33d661d1e0def7f3d1979b54801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08476cf2d1e5b73631b6898c56eee9d

SHA1
ea68e0dad2e0090f34a30f4b0c663c6f13c4af31

SHA256
369ab2b6e5ec6268806366ae942cda071ac440bcec898f6452344821c241ce96

SHA512
ccf04448c80e9931a65a7bc2997f59131339b245f8801f0494f2b60d519d8a73d9e8053920839cb84f6f9b800ea9231be029af9c9ab9e76588c323726414d2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dcd616be709735b7bb1788acc85e251

SHA1
5e5389fa87940c5aaf62250d014fc4c9cf3d8221

SHA256
e110809c70bb6db824b5cf4aecec42927eacbc17c927c45d6d0257acdc8ba10f

SHA512
cd73e4bc18f5260f5e87ea399e0294cb02b87d23316e5d3338030c52802e1666672732a24c5be57b7735e3ba38272d7e3677ae5f9cec1f35111fcbf9a8abe592

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30F1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31B4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit