2784a349a844b86b061297ec96b40d1cc126074472d3d4584a1b7f3e35325dfc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

846f6476631983ac2f5ea1e501034570_JaffaCakes118.html
Size

27KB
MD5

846f6476631983ac2f5ea1e501034570
SHA1

c8e78cb2872da91ca943d19f0976974d9e7c916b
SHA256

2784a349a844b86b061297ec96b40d1cc126074472d3d4584a1b7f3e35325dfc
SHA512

2d162b7025681209c19794192d26e3ec299e2c0ce2bff5ceef43ef08e0493baefa31400ad363e24c20c2326c1cd87174dc824a6e6d4816ce70f2fa475db5eb9d
SSDEEP

192:uwTYb5noynQjxn5Q/PnQiemNn3nQOkEntpVnQTbn1nQ9ecSm6udK4Ql7MBGqnYn2:VQ/x56gKLS0Ps

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10D03D71-1E8F-11EF-A40F-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423240396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28
PID 2992 wrote to memory of 2156	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\846f6476631983ac2f5ea1e501034570_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da7314556fbc564e7494f1899531d43

SHA1
9bafba53b41ee2807c0039c2ba95c3818b7ce0dc

SHA256
c6c846ee5ad0402ce4c27dd46c36f9c5dfa8559188f9b6148222a5fe8e2c33e5

SHA512
65cd616c76c5fba1966c8f43ba34bf6d9ad0d6eeed86510d4784aa27390883aefbf97e504c7a170feedc0ff37ee25887564b41acada38ae13d2f2e092ce8c8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba9e75daaec6fa383247bed3a6bc25c7

SHA1
c0c261863f498cb58fb3c08f068b9d2320a6b9c2

SHA256
f63506a3b9d1753608f240ca8d7b62fc46e7aafa6e77ba1e8c0a106327621274

SHA512
d5c7eef8c12bab436f6350d8e5f3c5276193acd7e9b195fe5f9d5b78448954f3a24e7816277260a0566f1c0f8a43273c1007a9b35842d5c2f7b81e3f71aac974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c04fa10347a6901878f64a1d39c0902

SHA1
3882edc62498e15424d70b37505f871ad73c12b5

SHA256
e806d209928a3976dcaabdffe51558f7a996ec847419b5dc83c88ac8a5bb386d

SHA512
b1f2bb5da39242d8adf964cf86d10cc90115cc13215aba214f3794f0b9b7c3b64b167158093610182dc8455d3ab94828c708904f64e46a3ce96e28dadc1fe7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc18a106eb029d510c34b8847ce6130a

SHA1
6d2d5e1c5ea6f0e368068ac36ba151d53bf3050c

SHA256
aaa7de473351dec694a054344962b39a2eb9bcfbd35d9883d1db3df8de94d80d

SHA512
9e34e96cbb03891402d1833aeb9a7d575402a5ae6f04e48897027dc57efa1b1bd1031170bece4fb5de67481930049526c9fff08ee2e9da17b629d613df77f761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f65100116cfb14856fa4b6fe050035c2

SHA1
e493c8e7cc7024f5d02789ef3e6261492035870e

SHA256
12104509a8e0b0294c2ff74e139c738408a55a503733aa4d49eef3fd3e98bdc6

SHA512
4c944e2aba9fd9155e225d9bf3f23a0f81d62f53b1bc858bf90819b27566599cc4d4d6cca7ddad892819a52c139df67e132bd64eacdf2c80386954666c83d353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
463c5a61b3886923b377fdda167d117c

SHA1
e2efa6b45e63e9907ef2ded05cba93f6069fba39

SHA256
ada4742652a643ba0cc41c5b976cff2f9aa56ed9df0d2096abbe1dbc2a875993

SHA512
1d785138446121c6773264789b2dfb21db09176e6678e917d8c0d223098ff63b8210e65e5351825b476bc35cb09c86aa6904e3e08d3106c7c5db29701aa2a2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ca5fb85c0c3cb009ea0ce7f74a570ba

SHA1
6ac225a3d69bcc662aa88c683e3e744ab93b52ab

SHA256
a4a4c92d5f9d97c71c9441feeffc616fab81dbb51dec4993e1ff3329c913cf36

SHA512
51fe06d47d6c47ac4ff6f5d1b60bcfdd229c946a2a474a44af920e91524b56b266bf0609d198baa0987c2709480c289bd7bd9a9c7ec7972a4a8adafe623ef96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ded7b2b46136065e3109cd1740d6318c

SHA1
d5499dcf7694b172d7ad27f8aaded18eb36ebd3f

SHA256
9920b6c4154f1714442d053d4fe20093e1c650be5c3a7410a95badf165ce20c3

SHA512
947d321d744db357eb8672defadcf141f53ee77e0dec53b1fb2b1e8b81edb3b11d0b5e3b01472da03b762b9f8f2f83b8744d29ba7bef9a7a1ff77af8517a5c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13dcb80819bef3ea8f2514090133641

SHA1
2c18aaa5d13e2e3d7ab4d0ea85a24e87bf959a28

SHA256
bb55c69135d6be638f373d5928e13fe726aef4e3aea4afe7c22bd246e8e8efd1

SHA512
5200d9faddb65665df13be5b6fb87db275c933d464a08dd74b377782b5146efc71847d69cf9b9c7ece480ea8a992b10a93cdfc0348f5761913909866d971eac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2445.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2545.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit