d4ddf17f2477a483648183ffab65dd500552e7bdf6cd4c66dd9949f257f126a3

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84bc9ea25531a665cefd660d3849a4b5_JaffaCakes118.html
Size

42KB
MD5

84bc9ea25531a665cefd660d3849a4b5
SHA1

70c183b42fb9461bde1238d2762935374f554a70
SHA256

d4ddf17f2477a483648183ffab65dd500552e7bdf6cd4c66dd9949f257f126a3
SHA512

a3dbe8e0a8df7f4148b939001d03f1a8f1a9dedd2611e2eafc98b9a3701808481e3afc74a06e1d2da47080c78b5fa225b16c687331001a85d94d418d58471578
SSDEEP

192:uwr+b5nHjqnQjxn5Q/TnQieSNnPnQOkEntRlnQTbnJnQmSW/ExI/QXc2XQdXZWXj:4DQ/6ixqVbjGvDuQn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A94CA21-1E9E-11EF-B459-56A82BE80DF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423246828"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2748	2868	iexplore.exe	28
PID 2868 wrote to memory of 2748	2868	iexplore.exe	28
PID 2868 wrote to memory of 2748	2868	iexplore.exe	28
PID 2868 wrote to memory of 2748	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84bc9ea25531a665cefd660d3849a4b5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4bc7e419c32d0e97a861abe05e18bba7

SHA1
0fdcd8e5fd080d29bda782974fb2a3e1eeaee941

SHA256
4e3737c907cd54a8385be746603dbc9825a08d54c5da7c83dd77b56dc26a1c66

SHA512
b0a982b047d21cfc3333a2182295e791434d4fb284e2667d3064e4a2dc005dbca853d26dd04db0779e95397784166e5e6dd0e87742b5ccba96b20f54c21c8cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d30af21cb6ac62e3a7e540edcdab2aa5

SHA1
93fbd6dde25e50b2436f2d67d888b6eee838a7ad

SHA256
a270039ff959b4a0062d3e235c7519b4e81516079ee8c439dc543ed36ba585e4

SHA512
65c57d2c66902adb0473205b89b055aa172af03fedd01e3680021c5626d5c87d99dd96ef2b76fa42e539993f75c91588dda17b7aaf64ffc06d17c40f1e3cd03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa2e6d94c9b3e76bd47dc363114e5b13

SHA1
47795b810ac750b7a36bee6f4b46ea481745eecf

SHA256
86431cadcc71e6929f6892a38544ad37db1214d8e660529df5fad01869ce5166

SHA512
224502d6a322b8d52863e62c7683da511d2a8c115d09008b3ccb55054454092220d6e0f5291e6c0d968d4947baa1d730a116e5ff346dae728b9223c1c1b69a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01cede08a63935888a8028032154b9fa

SHA1
d3b021cd9176122e057cd7951cda2a6183b91665

SHA256
f1612bef170b822388f478b453cc07e24f1711cd6e447a1463bfefa00e5b5e6e

SHA512
c7fb1e6e3d1fa421d9e4e47d045e047edf2e780fcfbf711a4f241f6c6f3909bff4bbec5078460a5f6660f037d9969d783eb078eebdd2ddd30c7995f14a22269d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d53b5234fa647697d67dfbbbd49307e9

SHA1
44f68c39a32ac2736143e04a2ae282bc57970771

SHA256
9bdd3f5761577f2b10cd989ac02b07e190b7caf54d4b1ed7eb70627a0951d556

SHA512
7dd6a26e305c98bea77c49376238abb651cf19596a7faece2820a53b2636e9fb24559209f075b02d0c7320e6a3b9e345b16f380867e74fb9ccfdb19a1c23759e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62d0c0c66fac1eae76ef4bb3bbd07d2e

SHA1
f1bd92fa74d25d004392be7bfef5f7a3c132a95d

SHA256
44e45b894803cd2cd73cc20e65d68aee704eacde1156c1f2292bbea596a95586

SHA512
0dcc097cf99818a0187964c3663fde54f8d441646262adc5ba5c26a0492062b6eacf00a3cc45c75072b180d34809b3dac4f13c57262e346166a9edcfacc36422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
565e00282a52024eab1fa2a7c51ce8ae

SHA1
d3a455f81a49da111c013bfe0f0cbe8a4cd4a316

SHA256
33ef830c8d6b7b04663d49f7de94a3c578f52b89e5e8bf3c209461b90fb3b6db

SHA512
6bf23d097ad6c1e36aea9eaea7a0f2120292d12c319d30b44951f166d498de935360f617de972cadf59d921f3873a7fffd06e4c66f37ccd0ef94c84fa25b5a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00bd14c7ec7f043f349ef0febca260ca

SHA1
667c0dce20660c9762711eb431ba27cf07b15e0a

SHA256
c53545d0943e43899d9db0b59b69cc309e60e1f0d8be1017d013f3693aed2a89

SHA512
bc891f07f7bef4d6a5196403b71d3bd38994da238389f9611f4fe54d4a832905768bd4867670ed14b2dd3ead10bcbc863aab6b35157fd686179537a9793fac7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0292743bd7f30809a30dd7911f760f9a

SHA1
e7ae6f251962aefc3f716f2ca9e64a26adce70ae

SHA256
c667772ba803e777aecb4a38fbc9f8386646d6b38612654a2765077e849d770c

SHA512
cc40abca42e60ed58309c1b70397c49d521a2dbd2fa11d48b61b30b6b42070b803a7ef6d3b0457310e7db9dc5c7c03f3c8c6ed59eb4009d1b701eb0d2825053f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29eb9ca85dc4f945c4429752dd7d7786

SHA1
c3318a7d6297a188fb093be3e5c360a0bc6f3c9c

SHA256
02cf7d1f224d3f770b532ef2fa28119520dad6a5ad73a3e8fdbfc73d4bd30af3

SHA512
5dccb718e78c45e33c68d26268582d4537602db2432a275e744d520bba7bf5b06f527c76774a378ab66e25e81109f8d8b9950284c0e0b02819a1394f745cbe9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
643a01de9aa9870bda7ccc725575396b

SHA1
b776df4821e2aef09a410922642f7450e78c4ae4

SHA256
bc949873a47bdfe19aa8cc40ee0b396dc223e0692bde9c118094d9c6d6a711e3

SHA512
3eb28a40d6ec5d5041c86c94ee278f41d1fc3f9a45597039ba9aa23c28227933d0d25bef1f8ecb498630c3c9b6f78148bd2067d03726acbb0b23f7586171986e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1673.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit