bca01419db83f91113f6f03ff0afe3277a522d44aa058a610f84697828ac4d26

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88c77c74e460a2764890b30416255c2b_JaffaCakes118.html
Size

8KB
MD5

88c77c74e460a2764890b30416255c2b
SHA1

e7ac6a7afa098341e2ca73456784aecd30baa92c
SHA256

bca01419db83f91113f6f03ff0afe3277a522d44aa058a610f84697828ac4d26
SHA512

b811aba27ea3674caf92137f11ae029bf3b420f0ebae4574d73c6cd5f3ef53e554e9d475b95cd4e5b50a24fdf978be4643b7268c6f88eae732f223e2033c9c25
SSDEEP

192:SI6fpye7OFKdyyw10tK6KyLcCJK7WzOjUnQ9YAa661:SIKpye7pyyw10tK6KyLcCJK7NwQ9Yz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7B2ED41-1FA8-11EF-BF0E-72CCAFC2F3F6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423361472"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2068	2924	iexplore.exe	28
PID 2924 wrote to memory of 2068	2924	iexplore.exe	28
PID 2924 wrote to memory of 2068	2924	iexplore.exe	28
PID 2924 wrote to memory of 2068	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88c77c74e460a2764890b30416255c2b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
416cbcad7e7e38f721b27f92b6f7786c

SHA1
6aee9fff79ac672b74dfc75e0f8e136e826968f2

SHA256
ac3b9677298146067ce6f39fb7bdf383bf874e4bd04e89e86c11529c58383d86

SHA512
cdab57d5ddf09ac1b2b3f4b2a4c0b31b97037afdf39b2f2d4a866bc229bf455bdf7ae66268a3914ceab427f683caf97748895e0fb749b14287d80e47d85e5629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c55eca61018929dec5002eb3aa1e2ad

SHA1
0b97c05c2e9929b816423aff71e56e07695367a5

SHA256
401d118d62041432db00396ed5b0b79e620afd4a38bc0bbf7bcf2f3e26cb1f2a

SHA512
0552ab65ff58d4966acb8ab36187f81dd598f27dc43abd5b322067f02b9c6e30f58010f62ee8ac1dfae8cc1dc7236c21afc18dec5dc4f505ea1d4d4ac43077c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e3d57969eea9342cce8159e05e3c6a

SHA1
7384d32f9d02b65faa26fbc7503846939ef21e94

SHA256
7c9f682dafd00108e0aa9a8209d7e6e9dd3838d423e79a9cc28b25fe9eb511e6

SHA512
07786a9e2b32e851572ee62ceedc13b6e9a0e36d24bb005f69d0137738d5c78b56367f6c0aaa0d02655e3f2563329a85fe886bd97ec965001d855398f2097876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15c574f7d89d301098710b2bb82c1f62

SHA1
6f0aa1b8dcdbfe29812dc5bd6a4fc9c34d392100

SHA256
89a2737f186bb51eefcad9c4c1c173b12db451e31dde27d89038341d9e43adb6

SHA512
26bbab8ffa9ee3db7aac863001cce4e41abd743f1066fdfd10e621b145959c3449bc78d38dec92305d6a6a825c391477b6b298c67ce2dddeeffe0ac90f8c188b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17648f7cdd31d9e0663df7d60dd72f6b

SHA1
43ea5fdd2523e6c0adb84693bf4fe500cb7a9a75

SHA256
40211f4dcb3037c21027b46529d80057fd86a0fee8c80b6c89aafc506f1c1220

SHA512
c4621b108dacf9bf526aa11bdf5b74c7098c7539234e9ceb7f2ee790bef27d074d7cf1197ca3c866f54873b414d02f669d1b4c72c72d4638e79186314177df9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c738fac73cc43289ff03934fe31bb29

SHA1
42ff83cefc5a5268ef5b6f81e649c9fc51ba620c

SHA256
046ae1dcc5c911fc81df1c36052e8e805e6537d18614db123ae3bc55416f52d4

SHA512
71cc5fb055633d031cdcc149e652b1f43011247bf57752f746d654def39804bbc703a856ad2f2928675ac1d34cb20dde0b6839cc89a011744cd28203a12d2e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d03ad657fc483c6cc4c1c566adc65f0

SHA1
26d63fbb3d45534471904e7e75c993392af603d6

SHA256
bb25c9ab2f39f721dc44f8cf8ebea1ac72c8ae79a82affc880604ab601de02a1

SHA512
d14d1e0190b0108d59479354fe420c73c89579b50b7f13c1245278ebdca0173b6abb01b886dc45f658262b6dc6c5a65dab91347e42681c31cb55f244643476a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07adc0556eb12172f240f8e286f0e461

SHA1
1f01c545332edec1c216c2f6e7e7bdd4fac99633

SHA256
577a3eff41eb568b32d7d73277a0869d17ee54b3d98745069774fd1c3e7c25ff

SHA512
646d31ef2fb90beb1601b6dd702cc623d750610ec7222eb16aef480e34a5d839f3ebfce33182b38ae7d12199a982e8cf872529ff8bd91bd7be87fe290912bfc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cd048acdad4e0f79ce8bff09d6daca3

SHA1
0dc6921767a5023708295e51e1e49cc52dc42e7b

SHA256
c5db4e572208501e1df84b4d14ff04fe7bb84448effe25e95d3943083ca57b73

SHA512
8fb90a0531717248ff4a791899017da997c1faa0fa8281cfd1e63e662efc16c9099978048074e3eb17b269adc312d6a730574328f3dcfb9bedde10efc017a4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31bd03185e3937e534b1b8150044981b

SHA1
e25f6675c0f06ad6b149f00d81439151455768c5

SHA256
439ec7d0ac1f954ee09d843ce6ce8745f9fd9dd2d1ca7e29222e41e1725a5091

SHA512
2c4a7e93b19457066ce831c817c477a55f91a10176c92412307018c4c90a470e53e65899424ad0992e4241f8a1fcfc0e13e968ecd04fc3c698b478bf9a5dd1cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e8ca3df0926af172e2460900cc54bb71

SHA1
b8dd2bbc79a50c27282af95c1456eb6acf06dddd

SHA256
cd66f9e5f354543ffd18400dc5cc5001d86a7235b91e0390a5950fb400561475

SHA512
7ad1ead6f669ec6e3bc7fe4d82be56f36872b6d43c6799823666055a801d5f252af3a814d1efe23aaaa238b93b5a278a8b43a46f5ac6819afd4c2b21bdb9f639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A25.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B81.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit