9e82fdad3da0a3b3122859314bd1067b05afb94679a9483529f4cd7ef4e28ed5

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84ab33acb8a8f155e70813000bee7756_JaffaCakes118.html
Size

32KB
MD5

84ab33acb8a8f155e70813000bee7756
SHA1

d813779d0b2055e6cd4c8af81be1d919b9dc2ec6
SHA256

9e82fdad3da0a3b3122859314bd1067b05afb94679a9483529f4cd7ef4e28ed5
SHA512

822f282e6ed05e0a46e554c09e35580f5254a4845559ed7bd2197d003115c496a4cadb76541e58c57d0ff67ab7b3424ff86910e32e27023871fd9a5aac3bdd8f
SSDEEP

192:uW31b5nwxXnQjxn5Q/7nQieKNn2CrnQOkEntdlnQTbntnQQMC/ADYLWPY6NJokyv:LQ/ECSFP6P9NQt3jyOCo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A322CB11-1E9A-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423245366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2432	1728	iexplore.exe	28
PID 1728 wrote to memory of 2432	1728	iexplore.exe	28
PID 1728 wrote to memory of 2432	1728	iexplore.exe	28
PID 1728 wrote to memory of 2432	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84ab33acb8a8f155e70813000bee7756_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280d7b428fe5b3a43b528b07bd1e35d2

SHA1
0f2802ada0be704446aee9234a9c7a9c597518b1

SHA256
56fdaa5b3ada72cef59cb0e240d183852830dc602c115b91ad9834c2a90dc0d3

SHA512
3070b85d2c68c6be9df04c47eec00155d52a624f5c0e0d86d2f7460cf41113ff0d438052551d7463dc9a174a35b6037f48629be307fc949f709abf3d4e04f240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37da45c72df6647e121226b62bf30d08

SHA1
bbe51cad76e43105d34f3bb9ba8540f8cdee0f36

SHA256
808a31d051fa1f3860fb941b9783fdac6e23ec2977d87dd1a57d4696ef6eaf89

SHA512
3e82571707f09d3bd50717c0ca8c9ff336757ee09a92609d0d253c903e1b4136530a497fa1dcd62bc9efba8f33e7bbb524fea933dd0a5d685429afbac35f7260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcd9097aec9547de9e27a23e10131243

SHA1
12138c73136be8a35a3c3ed19a620cb857097e5a

SHA256
c90d706da78efac011f0054cfe0aa128c88e1f1d2a0e6c7818d9ac817327f80f

SHA512
b2405ceecb4dbd98191216d38a8cb861c4980d24914b4ef466aeb9af10bfc9d6c847c54e4303b433ae63eb3c344e190cc49542c0f42b9637e4f885585ea66d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
987cf8c877ed9e65b885343d109d613c

SHA1
a4bc598f4a004e8d1cd4c9693b032598c2a8e0cc

SHA256
2c3f0e8eb272196d0996a43202b04d39d14291044eb6d2a682d117dbf90f4ef6

SHA512
f7e539253404d749aa9459f811edd259444def459e8677c99912f601aeadafa52c537a505ead7c424aee8d2943afbbd1ff00eb5d92576355ac090808d469d73e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d436127b75fc03351ec9688acfa15fd

SHA1
764d78306d5da0483dfcaedb394851cd4fa7cb24

SHA256
c5e18c01f471659ac66fdd4f614064c05582b0bd08f764a3461cf9fcc4f3f85e

SHA512
98afa70855f06a13640727d146af7e555f397783bdf36264da78fd6c1d2af475fa4386c2c5ca32ec013aca3eb59da5aa087e8bd5bd812fbf92f2b9620da03ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c58a386a5f794e38d57e0ebe63a0143b

SHA1
72c5a73668202ace76efb3f5920972574565135d

SHA256
a30556092bdeacdf62e6e7a9614bb61142ab6c3eb4892361a2e5a323f6d814f2

SHA512
2e87668d63a6fb9a6218f67884c2c9c6676252950fa2d7d0da21efc5f78c516749ba88f16327722841812e6c2c9bdfc367136f0e64255ea36cdb1fe117de64ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61589a7a8a2eda90573ef57984067464

SHA1
6cac02a0b3a3a2e1204666ed108d363a0b30f4ae

SHA256
2639cdbd53a6b356167b4cd7719ffd34c9bdb251b20c1ff360a588c21d353775

SHA512
fd89da1a8d381aba2164f671c246551657901fbf009e34a33a585ca4e75884e21d438bd1fda1fdb7baad0e465be2e820da1deeff9ca088fe574dbd5c7df43c2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
488af2c6c198f1a183985c0e05e4d4c5

SHA1
ed9d73b02e3a9a53c80c5fd66dfe4c82989a6397

SHA256
44607ad4cd5aa4bd621a0e06bbcf9ccb2a86d58b99e4ff41bd88248056fcf623

SHA512
ebcef975166ef1b957863d631b00f325c349d5901dd78cffafb8039da01b66f7c6c70511bbb441a8055827171dc4a397651c2d38419ea8b16c6396d52c4e019f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f7eb9bee968cd67f1c9aee3cbcef38a

SHA1
b3651bbbae8b650f31ad3db2e78c32a11774daa8

SHA256
d312a205e15e3e6a691f44b0aa0942b22f02ad6a5d2f98b77051b4756cfad59a

SHA512
c3c975acbfc1400e8dd7c930d4f5b4d866b76cfd1c533947760774cadaac79b2b30fe2f4c6313b850d4b21c71cbc07743f188eb0214d53375e327b72508c0f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1354.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1445.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit