27a47ae881c6600c519f61809a389ccf7ca30d8caa3e76160394802ba5e2afc4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84a014470d2ab7fa62efb6ee0b18a98c_JaffaCakes118.html
Size

18KB
MD5

84a014470d2ab7fa62efb6ee0b18a98c
SHA1

1a5cdeb17c3d280d692673e3591831583d901f12
SHA256

27a47ae881c6600c519f61809a389ccf7ca30d8caa3e76160394802ba5e2afc4
SHA512

5ba19f1810696a93601ff25a5053204b27f078db42fcdb7e0839e7c1a55fe909a9f4f6a4490e0df9126bf4e8bfb88990c32f8173066d1d927816245389e4f1b3
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIKA4FzUnjBhnJ82qDB8:SIMd0I5nvHNsvnixDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F9C1A81-1E98-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423244340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1736	2856	iexplore.exe	28
PID 2856 wrote to memory of 1736	2856	iexplore.exe	28
PID 2856 wrote to memory of 1736	2856	iexplore.exe	28
PID 2856 wrote to memory of 1736	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84a014470d2ab7fa62efb6ee0b18a98c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8667167e98f900b0245c839489ea6dc

SHA1
c743d3b3f52c51232faf306e290492812871330f

SHA256
f91163d03aa5617f64d3f51a5dd527d2189b3b3272552e3fd503da3f7fc75aaa

SHA512
10ce565067ffdf8d259edb8f4bd304ba777cdc08432df3539c899b70d1c872d673ee39c49594d1a08303968d389e44f54ef93efd75e359276109895e07d3a698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ceeb24392ccaf9cc7298ffe667dc5ea

SHA1
05501bd87930413a227fd6dfd94f92aa36c820d8

SHA256
b5039d5d53754f7918efe2a6799bbdcf01df661da5902506c4e2e1d40b307fba

SHA512
940e8637806ad553cec843bed4549f3fc1f53aa2552910c3477728bf65e3b5cd775eb4d20ae7f56f49d55c454413c1a58d9b37312d67f0fd6056000f2bb83466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb29b33b2b18e446066857d646ba346

SHA1
2b7bf796fff0baae1473962dae2c48ad535e86e8

SHA256
a58f583e45217e7525470aa23efdea624e6d9d5039972479e970d48b5b5731a0

SHA512
55f44f5c8db2f98e49c8ce3bfea6769f5f6a15285559f1e17392334a9c399e4b8962c5c817a79e73a2e99c63be2abad9b0948fc7b6747f25f60110134e5a3b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69aadcce102357f025d938d071ae7055

SHA1
39359c0929a289b2f47a5d3fe795211a17cdea37

SHA256
aa446a28ec94a76dd3d2a22fe51845276eb1070b1d00cb217af41b9416982ff5

SHA512
081ae00983c684f2c0c3c310f7606d0b293f34b6140d5fb36734a01e3ea8586df32f208f8218bd3d2f2007597c0a624120b88b86749cc61b4f08ffd71775c1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5b9c859876bb61fef156b9a031ec1c

SHA1
9f57410421871c446d7dffcfdddf1c55d55940a7

SHA256
998fe17af3fad4f3e6fe5adadf6f396a4a08d43a1d30295baff7ecb378f1883f

SHA512
f9ecb7c145500c83d8ca52c9c6a3e97cac7aec98b83240f9bbe968d8ef94e396bed0843f888e15d1a39ea192acfe1ca4e10a90d4bd12b91de0a38623bce7430c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0d6b9437f1fd1921309ded7c8915f1c

SHA1
16622bae5496cd907cf76ce4ae7eb6cb17cdbf2d

SHA256
062b93744e5cc41f8718187adc6a759f251acfa7908f83d496cdc98976b0d8e1

SHA512
129d0de1d25f424d0d00fe19edbb49c98bbf90225463563e305dbb9cc04af13b8b4b22312575c0a5a205ee0ac77e43df9d739197c0b900c9211b9b1f7633ac7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28653d5060cc4a5bd7215d0f72a814b

SHA1
42b0b63f4ad16d5381aa0e783c7c2417ea4efbbf

SHA256
95c2b32e45c1310c527f3c584a9e6776095e0e45bc9c24679675b862f87b8ddc

SHA512
dac370323e8ef3aab78f137ea2fa0264fc87765e5b7aaeb0115f554610198f8c142f91030d227dd200657eb672b5b730af136ea7c63cf1e7d88ccad55a43316f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c959f039ebadea3128025758089c0783

SHA1
ec3bfafcf8af584cf145a1ac31cc40f4b6d5539c

SHA256
3ea9bfacfd3d4fa7d8d1bb357a5d436ce8c7b3b8fbb72ff869dc60cbe3bc00dd

SHA512
51dcfe053be6f03c2f6fa209f3c0f568b111b7196ad1b9650e2028919e0401e5211576926ec4171086e6fa57bc1751cccc6135794cbfc3288e0d16b33f60c715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e10a2d5ccb6f6f676a79140b5d4bbdf

SHA1
d002c92b51304c1e0371b6b41894ea1ab372bbc5

SHA256
cab488cff605ba98706423dfe511dd18d5d79107959fcc01819b040200cadef9

SHA512
9173094b3be3a774e75bea451af2651dd8b3e64f6b72fec8f5d897154f1d67ad9c2aa846f6689e3f421841bb360e98d7d9be0070aae007dcca9a8ab5bf8c4a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43565bee7ea82853bf71b3e2da440c46

SHA1
4179a0327225749fdb013ea50a13034fd2071448

SHA256
24dd5d844f84ef342be3ec203ce2e284a976b9fc639a82218a81e692284bbaff

SHA512
f97637cb746a3901fa57163bd28de1e1242d718469520edd401c59e47a6c9d92d271029af5c77b147364c0bd6f6a3aa0bc8bb931ac834cf4975431846c23a817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c6edb44e0cd64277c71dfbc46b1886f

SHA1
3cb989d3f6e50fb86fa043408bc92e3609a31a64

SHA256
763efae4526ea902094e7ef631a3de8e683d011e2fef4e74fc51ff2a9813386a

SHA512
a4f2adf6ef9b46539aaf7d8d6ff3e1e6919bd6697c52bd8597c9302b4ba515a4a04eddd88c905aa772ef8246feed503f443546326bfa3165c40732f48fb94a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1474.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit