a6457ef44782482f2e78e8766e87a32646b56b441750d7a6dd410a2668cb8283

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

887274293f05576a1df1bb3c64064955_JaffaCakes118.html
Size

29KB
MD5

887274293f05576a1df1bb3c64064955
SHA1

22f7fe9c2245131f00049b465ca35ab562680797
SHA256

a6457ef44782482f2e78e8766e87a32646b56b441750d7a6dd410a2668cb8283
SHA512

59a7b1e20284406ffbb8693c3ac7fcaf2f8156d609ed4c062bcc096dfb57c2ee67df44ee97f90ae72bef82c6fdb490fd28df39eab5c8eb6231f1748e498b553f
SSDEEP

192:uWjvb5n/3nQjxn5Q/WnQiedNn+nQOkEntGwnQTbndnQEMCyAYH+OhgamdMZR9BLl:CQ/1AX1xZ7BLP9QjfkiscqOe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F6B63F1-1F96-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423353566"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2852	3060	iexplore.exe	28
PID 3060 wrote to memory of 2852	3060	iexplore.exe	28
PID 3060 wrote to memory of 2852	3060	iexplore.exe	28
PID 3060 wrote to memory of 2852	3060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\887274293f05576a1df1bb3c64064955_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cc38daf5e72bfde2696bf539a5a110ac

SHA1
6db6e472d6fa5d16cd410c9370ba6264b59b056a

SHA256
78b360a855de6f0caafffc187320d87563f132a93555806c535877742895fb5c

SHA512
ea117bcb8f4c6a9153a0e94b1effbd8c083b33a8b9e33f7e5a8b73ed731cf05aabd2880a64080dd4d0f2486da318cf0b3630271c1fa51939678ff8c7e6394e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c370a6a219f4d80e5536dd125b0d976c

SHA1
0cb60f96f24a95e670aee5aabd00be0a9d470393

SHA256
d49a11aa47a002f33951f0f2c0f042b2c02cc6ac01e40cc59ad0535074707087

SHA512
bb9cf8b3a3be25b37289307d5d6ede599077aa6f9376d70db38ed042b5df3b030dced6890e956cb57f3a831078ddcd5e8e1fb9d2a1354d427ce097fcb163c159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c045ec40cc8c78a84b51a319371471c3

SHA1
cbfb2b77dde5d926a632394b045b1fdc268b8d0c

SHA256
93a9aacfa1eb66aae54e1ee1e13e464bdf19c71d2e6185e3ae8408eb3f8abc9a

SHA512
f83cc21a8bdd07c39a78a9acddf490a4137c2761be016b28702adaf0f6accf297ad8f2f692a3b1f5cd800bdc9e16d19627d87c8c8c8faff2001e81a31427739e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edcc12855d1f317b2c79d41dcde1f29b

SHA1
cd7c6e2d67c667ebaaad8eaeb4c0f412e2913e81

SHA256
478f7b52a7ceb4c644553d43f52a7a1e98daad9fde0be3f3c64e975a307fb41f

SHA512
0470a81e861f8bc791f0942c0bf885b9b0880c8f04a64cf21dc3b5244d6bb3d1e2aa44089da9c7be81164e3291c62e38cc39b6868700ecb426e00bd0ed9d0faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daa40106fcf2034e729624e1ae0e887e

SHA1
28bd19726371e70815b322f96e60468539aa184e

SHA256
a767f220280186c759c7487fe940c50787c037f209f1e388108641fb1b81883e

SHA512
ad1d00fb296a44c3243fb97534940a20275e91db14c42a578cb952d5335309235ed7cf6c4a465c328f7ee5e9d607cd82767456544af4f6efe8b0556a9669f91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d043498b4da523842cb9a594bb48099

SHA1
434b6ff8b9bc326b3035b515ded6c19475e1a0d9

SHA256
b82b696333bc24651c19ba252b0f8c89b709cfec77e1f6e4915c3d80deaaf16a

SHA512
404bb2dbe7653eb3967eb0931556d104723152251d20607962755d23a380a23408e4b9f623b4fe688280a212b0b29ee25c6e7ae1564f445a0b270f0ca04e9efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ec93284f9b6f4007ec51ceef7874cf8

SHA1
82b28abe0557df00001897fe1576429dc8c768e6

SHA256
9f24bf0c2d376ee4bb80345892c942c508148def8120f7369bc4066a9cdaa427

SHA512
c0a89e92dacf28ef5dfdbd144cf86eb1d7c4936b6f64910f677d6d69d6e423b7d66c5060e69f4e46d50f67afdf53adc9a7f6a53fa26c3a3711cc476fde3d3868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b64272ce19463dcdec434e09e31e300

SHA1
abf70c93ac4851ade03f9f2afcc977d3d65baa55

SHA256
115232dff339d004864774031df0abd249df9c9e901f749a919a632cdf23c161

SHA512
0081885911390b582ff4fefc34135ffc9a7299f360ec23e3004fe75dd7f1ff4de3c7514d9c561b703a639d2008afe11b756a675435292c89019e1c362d86f99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf9a141b29e475c946d2d7ad595eb7df

SHA1
90ab226a98cb35ef6989e7c55262689e9520dae4

SHA256
9f3b00d29c631ad830a13e43744399a91dee2e22a4b404287eb24ae7ea84915d

SHA512
0d2afa40a52b428d469579106a93b7ecdccb286ab4f3422e16f24d00aa09a1d9b4be3aa99bada11d938e1660c2f635542adb554a67e31d197e2f1e35810d83c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2d2f105872969d597c69591184a3a5

SHA1
f5c95a7f743dd641763ca5ee0938c1888e2bcaca

SHA256
0a7e1bba7f8b995a5d2c47148263912ffccd32632250451459458d42093f70c7

SHA512
9b454bc2fa1131161c0f379cda31c56095deefaa9e5cd308545d51f78bd04e0afdda61a233af9c2dfe4435a852d395085665021ba81677e2aee9de86390b1529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
82d9a9998c2b4ce3637fd0e8408c435d

SHA1
1305ab90dfa51285324f1c178c4ef755116fe599

SHA256
e08c1e7b2299665f23508532aca6e9be7287e73f01565aabd9cd5802049e767c

SHA512
516fdedad045382a37f4842090f5540d151cf3ca5eccc41537e94b42ee1e30ca5dd8cc5e7f120a48f8ff21ab8390f4947e14430b1525c793c565a5d23d7c4a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B55.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit