849f8665ec1b0238c2d5c7fb66f441d8c9ac971ca0a0c30768506bcfc4199dc1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84c5e34227ce834e5cee5f1abcf6b226_JaffaCakes118.html
Size

19KB
MD5

84c5e34227ce834e5cee5f1abcf6b226
SHA1

f40d0abeb847842a638bba878e2e166562c28d4b
SHA256

849f8665ec1b0238c2d5c7fb66f441d8c9ac971ca0a0c30768506bcfc4199dc1
SHA512

c4d300ac643060b1975017a770802a1ca5041ec605dcb3c75613274e3b4b05511c46467fe5c907cb48e5dde82016bef70bafd9deecea5c79a22ca539eb8d760a
SSDEEP

192:uw7Rb5nOhIrnQjxn5Q/4nQie7Nn2nQOkEntg6nQTbnFnQmSgHMBbqnYnQ5aNnln+:4Q/Rq9Li

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEDE9D31-1EA0-11EF-BD3E-4EA2EAC189B7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423248071"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2984	2988	iexplore.exe	28
PID 2988 wrote to memory of 2984	2988	iexplore.exe	28
PID 2988 wrote to memory of 2984	2988	iexplore.exe	28
PID 2988 wrote to memory of 2984	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84c5e34227ce834e5cee5f1abcf6b226_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ef8679abaa26acb5ad0dcee6a418890d

SHA1
845e017bcce3f979d3879659bde4ee3a70cfb4ae

SHA256
5275390f1883e832f6b494eb482b72a854a2e65fcbed234bbb43b094587a938b

SHA512
30ce82ff71651bd5e93a8a29aae8a3bd7cfe5d0b685a9534d4379dec09d4c7fff8e6dfb9f61643b3be34fd8fa1696aabd515d9110301628f1a4fdbfc02fd970a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
899d8c9b2cc886971587d1c65da7a1fd

SHA1
383679a1006d673fff2f067dcac948bdd165e720

SHA256
4d0407ed9a92affa896ff2c882951448b0c49f30393c085fc36d2f89c983af2d

SHA512
40e70e8a4aa9b5bdc8f9d223fb72f8846710a077fb5ffa98ebfec1ccc87a276916fa90516245fddb4bd60c55d0327b46f1163690c8d5a5a52eaa4e6a8dc74050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6b6985686fa3c45f26b88bb3b5659e

SHA1
2386c3eec0ff0f1159611157cbccfce711bb95b6

SHA256
4fae49c4067e9665ace09eaa85710c609817c56fe0f15acb24ec78cb0a97eef1

SHA512
a72cc116483bc8eb67d9818f50cd726a2b5b39f6da5ced25a7cc31eb82f0f16842f0cd75f60d0671a68fa6b69520ce17dea4b2388c36a44e07a491d3ea1f18f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b846b5a09e20f9836223922ba1d916c1

SHA1
4ff6125bb9b16dec346c79a12340c5b7cc140620

SHA256
80bf3e2714555e0c0e8dcd8a83539c244e1ad10e3a392aff33f43f571716995f

SHA512
8f7d3002c49a794d9389f8927c9ab48789ed483e151ac8fab1de9e7541cfb1228d437674663825ec61624b83af7ce19161d34631c5a4f2ee9901ee8d654e7d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3468418ea10176ad2b8ad64b531088e

SHA1
c04fb4727bccdd2433dc1cacd14c80546be49338

SHA256
2d470db7cb0287542d7165f1c9fb2e27abd1f6c328225a0189b99fd50a671510

SHA512
c9b5ec85fc2299f98578236665cb1f75824993dc36b12fc661d49175cf688809ab8cff690687fcd360c7702864c20446e722de5de0086ecbbc3b39ff926498da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
756c164ec2a5dce21ca9c4b3d36e8914

SHA1
3cd80ef65a4c240ff035d93034440226aba6b712

SHA256
891618180f3340c45681fcf29c4cfec175393a176dbbae6ead1d179f0f428cee

SHA512
7ff87d2931b1a80fac8e24700fa5d4c4a352f17bc982353987dbbb7433b12f305243f3b370de9b172ab00e5e4a291b9b714cb1f1acf4c6d3635cae5407ca64bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f94722fde50885b34cb4aa7f59cfe32

SHA1
ce318697c89916861c8cf348ccd0580d5c70bdf3

SHA256
50599eb0c5505a0cd42e1191237ff79f28bf99d94ba486ced1aa548e7bf2ff1d

SHA512
f1798fe8fe129e2e4a1f8e95e750fe87f9309293c1e61f8739f5241ad8b1b544e13085883d305442307af01e1d3225ec0f0e28a4cab9eef9a9753255882e0991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3058cafd60893632bd2661f3586cf93

SHA1
03113e74f917665fcf7731ee7920fd7be2cb3dfa

SHA256
13572d56de8569c2830b6ff2c4e517e8dc4f34f00578fdbc566d4e8dff5a8c15

SHA512
3a99cb0230f00e681f9458dd6393092e5f674c516b3c8f4a124b594a323af88f6fccff73e9076652eaf6d4f0c7aad1f2d236d7e8b8afe44cdad769135bd62967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
235cbbfa5e278e8222b8a1bf66f48210

SHA1
2b623f4a380fcb4e165f0941a8f2291456d74496

SHA256
f278cb00947c04bda8d6eac731f35f184b2649e385650202016a475d5cf39718

SHA512
692ac6ae279b1c5ee257b8acf5cf0983fa45ae83e9fa262dc83b769d5a36b18f1da3aca5244d3167d00f807469ff7e2e216abbcf7e0e6b993df56b0497b2f8a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da017f5365360b4abe1b553609714e13

SHA1
016c1ea5ef2069a2ea61018cd45cc28d76fd0c2f

SHA256
83aa2b69c18d1a86c19d5bf253097431fbfec189f974b42375dfb83083379b06

SHA512
5791bb4ca62eb5ccd2c80400afaec0d5a4874b0e8dcd181533bce3f187bd83cad0f682f46c3df62846c8e81854d181a201c0bdbc5d9727d3803a8b6bf61d4a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf37752ddfde30bd4824c7181adfd867

SHA1
44c93efa1d4a6f553630669812d2fe2706153985

SHA256
ce87be76ada851a8ac72207e454463b1869f008025b99d367dda1090ca2dee7d

SHA512
c0314ec26d3733dda69c6e036e46a0154480f07a0574f9025b17d239c45097a9e9e4737f82c8ef4069b8bb5aa2162ff8f2c860e9c8063770d8f764d6ee61aa23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65F9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit