b6c6ab43746f413f930646576bd61929a287a071d68a58ec469cada20ad57293

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85ef84161e75538d4c51ff2031d801f5_JaffaCakes118.html
Size

23KB
MD5

85ef84161e75538d4c51ff2031d801f5
SHA1

55b22066960f5aaf04ebe9132cdf33c3072680d0
SHA256

b6c6ab43746f413f930646576bd61929a287a071d68a58ec469cada20ad57293
SHA512

2b4def91bf465acf7f522930d0fd1fe1dd46f9634bc957dd09b0fc7ca5562c5862f560c0c20c6104e264626eb10934e5e89cfb239e04fa390a12f003ab05e672
SSDEEP

192:uWj4b5nRenQjxn5Q/0nQiePNnGnQOkEntwanQTbn24nQRCnQtXwMBvqnYnQ7tnQJ:kQ/GRZVn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E599A51-1F03-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423290455"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2920	2256	iexplore.exe	28
PID 2256 wrote to memory of 2920	2256	iexplore.exe	28
PID 2256 wrote to memory of 2920	2256	iexplore.exe	28
PID 2256 wrote to memory of 2920	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85ef84161e75538d4c51ff2031d801f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99aa503c59c58cfb18bba8e2824abbf7

SHA1
5b3253f1cd5c8a0ac19ff209ec48f413bd6b94c4

SHA256
dad0dbff29db57757bb6e03ec101d0ad554c71dba1e8dc36cd71ed5184cd5fc2

SHA512
e53704b6e0f0519b0efffba9a348e8cba2161fb480d00cd71d3d9576f5d77a376c0a5a499571d6c6e5201457e75be04648278286924e9344751af34143cf2847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b825e56430792918d779c68fed0e7f08

SHA1
196b654adef6e4eb07b9a11de30822d48a46b6d2

SHA256
167eb51c1db65096cce13b2534f11b018ffb1a642f64f4ec9f2367b42829605b

SHA512
0874201e1118f677c88b51857b94e389a76690de9b09036f66b92d783a3940769ebc83025fd7b02dc8b9609339b9dcf5d95654eea989520b5e8bb87a6462eccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f66c828cb74d61cdf4a7bd13fb1abb52

SHA1
45db36f3466f846bb5f1ab0febcf294c95b8758a

SHA256
4b091f096ac0cd7995545936dede0d37fbb57193187fadbef19fbb14acb1c129

SHA512
afeef257ae5bfb4a1b45105dbb360ee8678011c86a83f4b3f8528ebf324957ebf47992408dd30314bc0e51d6d935fe5d565ef5607a2ca613bdccbe3c3eff6715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27b28fe5f7591d57014b9ea27c9f9040

SHA1
8bb7568e6750a677fe1821a7a6db48042aa1aba0

SHA256
b4e3520a9f6842f8e665ae30bb991d253eb8e243bf240a9b3452db0b7522e19d

SHA512
278689eef9447663f947c86e45627563f7d9d31bc339439d52d3866b3dffe6a409275cd86ba9a0a8310fce8ac4ece52017237751f326477c30037b3d6e530a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15a9a981b3a3e31fc575e9f984f2db90

SHA1
d50ba61c879b0e400650998aebfa52791f6b5772

SHA256
2c578a050c61372569071c7a37cc09b00d14384ad064b25ced50af7a0cd9aa3a

SHA512
242c78a9e725d36510171b1375b959e43b21ea1b3b6a759a8109dd26f97075fe5dcb4de7b7bbad3503a24b99654042ed83dd5333c2bf4603b9b5d552df78f346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05bb495a51990e6de4db0d25f61b4755

SHA1
17ad9770937fb51e999722d1fc7975960d023a88

SHA256
c46d2dc09db58da78eba418d1fb6ac3dae2616f2be386264049ed07fe4455ddb

SHA512
7c35d585521a63efcf0e47c97dc7cb60bb97c012a0e293ae9b4e7cd24ac3844b29ef944baf770cf5513a9262fd12ff84c7c933e8106fbc5ea741ec2b3dc5b847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67068ffd15a7689403e3942c4782c8d1

SHA1
cf2d5daf2423aab514ef05b35147f1347162833a

SHA256
f863aac550d3a02b555b4ca7c5776584d8edb569ee7464d8182efafe437a2b76

SHA512
a2a9162bf93540be8f9b728e0c1a18ca831252d2aec2d030d5ee58c342b98cb614d9b7a49f1add8763bde205e2a7712a6dc76c1baafb7a123cebfc63441b66d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e212178531b86485e91431d9352fd25a

SHA1
e8fbe9a864e07828e9903e62dae4f91396d7ed14

SHA256
76ebfaeb0f35e50adea66050b5f3f36d3cd1eb7996253f08599adad4577727de

SHA512
22adc747b7e00d44bb2ba5f0dd328354884e61ac3d39c9452e1496dbb82fc8dab75922361b013f4ff499aa6e9062574c1625bbea9181f5f977da6001b99e6cf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a989c28564b5c2b30034a57578b4d3ae

SHA1
04a5e91dea01a180cf33766c5be5448089f35429

SHA256
6e2b6514ab7f6981a04e39b7037140bc74d646555daa80ada216b48c1adbb117

SHA512
1ee1300c22c4186cbaee42e7b63cb8e6aaa88e162854187120b718f8f2899c0d63ffafaae798386f5f328a3f641a388ea2d7b9f1166af17ffcc30ff3cc29564c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E0C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit