b10e7f4fe2192a9acc5a0027f9ecd609d534d0bbb9752a08bbd390ffbf8ed584

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87191ef8c6e40b608484b3a584d505fa_JaffaCakes118.html
Size

37KB
MD5

87191ef8c6e40b608484b3a584d505fa
SHA1

d0751f9679cc18f2947741469a9f6d738c4ffdda
SHA256

b10e7f4fe2192a9acc5a0027f9ecd609d534d0bbb9752a08bbd390ffbf8ed584
SHA512

c83e0be83caddc3d14b6f6b06d356747ba6e6ef4bb2fd573555d08559f03845fb5b4999354f553c2c9439a824a9360414ae10ab6dd6b645739bf34b3f257cce5
SSDEEP

192:uwLRQgb5n7nQjxn5Q/QnQieDNndnQOkEntA6nQTbndnQOgLcwqYWrcwqYFcwqYmv:qrQ/GnfmRceGYolculk15FpMSCKt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423322421"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B140411-1F4E-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE
1244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1244	1700	iexplore.exe	28
PID 1700 wrote to memory of 1244	1700	iexplore.exe	28
PID 1700 wrote to memory of 1244	1700	iexplore.exe	28
PID 1700 wrote to memory of 1244	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87191ef8c6e40b608484b3a584d505fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
292bee418957a75a4e1790ea37aa8473

SHA1
2708a9bb19c38da6d87fcd17c718fc40d975beba

SHA256
e3ddb213a5efeb47f63d1ed0dea353fce66f3a05e3d174060d5ce1a510924d25

SHA512
21400ea7d0abc7f3bd4b4bcd7017fcdc86a8aa790d0cfa113ad2c1305f160970a31e44246822aad86e5c9f39608f2ec02bf01e2c2848b67491b81985075af4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a5dcb2e70cd00389a25e8fb033a5fe8

SHA1
49204f34689d3284cf8560e93d0ef1c776ecb762

SHA256
bfff004aebd26ce98630773c9f4a6dce5639cab581353462ed64e99543259040

SHA512
13d8a02a834dfcf37f114bcee7d4bea18ace461a7337f95e0a0e51051111590814aaffc565d9765ac999f7c9eeb02e556f12c4c7c43cba5fb23eadc891f120d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97fb71e33fa434074e5c72e3708d4d9

SHA1
bd4a8b53a43ab21539d3eaae6b9c331ee863493c

SHA256
30ff81025775a7ef20982b93ed732db24b13764297dc40821763470ab4b2fcf4

SHA512
d623d060d48a2c19e3779be19fd5618170cd70dd2f32aae3a3b8ea3e6eb4a0688c71333b012e94501f0eb3ffb51dfa63c9f43e7cca3f362d5e9f666efc7af3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6cf9594a127a3cf33b4273c313bb94a

SHA1
8ce9394afff2a4a2f69f378745f7e27ea8b5eb29

SHA256
db684cceb5c449fcf6917f6413e619f3f710d475e6abdea21d7523645aef8cab

SHA512
ef35f59b4adf26776411da8284600d0ebbc8e200407e6b30f78a500fe13cc809ac804b61103a2cd893a77d670c01b318325c680f7de2709796cdef8561b29be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ad6fa243fccd62a628454cb6a082d4

SHA1
f0ea0bca137519cb9e41fbc5743f995330ee2649

SHA256
b4537e8c8fb4293a9e6234fb7042d6a7fe07ccd3de35d41b8153a92cbbcd62cd

SHA512
d892dd842f90521957a4587edf05b4840f15278b35e789e19565de73ced3cf80d72223e824a350775021b0e74a00924e668522ca432d2c128976e7b442fb499a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d72809a638c6b2424f78db90d407e3c6

SHA1
0e0bd369283aa785b781dc0bad66d9d194f1917f

SHA256
a90732fe9268c598589eb8506c9b146987bb34e147d7e1d807c98611965eb357

SHA512
38f2847c80c3ae2a16f51ed63fc473d44aa2401b589e841e91ee12722a987f30f9676de209168ff5854a04c65ef583ed51cfd228f86f5c4e6fc2d3ae9e66e44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
497be0e98677035d62241d5f28204214

SHA1
39eff6384ad2a8bb316f8e2d4742fc9a527a18cc

SHA256
f4a6ce31f8a89af3a698d9e18b5e7701977076be4d4ee0c10f72682d45fc5ff9

SHA512
22d63b42625352b3a580103d723c70842d3d625f18427512b01e4adee44eca433b2217809f4951fafd4cf1de1e53b881a4265a5f9c39fdc58d97ffcee6d8ed2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcbae776b5cae10d8976953f941629d6

SHA1
6a51ce79abbfacea5e40ea177d81ba02d715de84

SHA256
b59c4dc6d296bd886b299092fb4c185a1a58457653426586f548d2e65c6b647c

SHA512
74dc1267b3512b2459127cc8ad836166bddaad40ee8f3e3f3bdc91783757b836173640407d8d70c1150ef0121aca0c6749891ed20a9e0b5408799df55c004c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f33cc5b38b30681adae272ebc968d1d4

SHA1
b25ac939c3e84504607bfe26f8f96f7dc9217b75

SHA256
e4713bff1284e4b6a3e27264a2950a0e438272d4da0a34f9d8410a645b89657d

SHA512
594857633cf2656007f175a24ba1d7a7d656d35dc673e302c6fae32f634cac9fbd240cd93d3f323202bf71b0c08306b0d55e27a27e0c6a7f6ff2a31912c6eacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87688c7bef601bde0be09e5df548c6b7

SHA1
53045768ccc67d702bf546de4481f2be338f69b5

SHA256
7146d29e76101abcbc52d9d4f9cc4815f4c340eed2af463dbf184155fec32c79

SHA512
d6395b6fbb6dde77d9ec52c8b104f1cea558b7928bda27d8f4ef24601d6909ad59b5e4052c96ee812be8aa44df19734b54c5c24e24e3077eedc82d8631c684ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4586789bf49c5313946d5e8895c348d2

SHA1
8c6e965fa4c34b293384598faf667c1e143bd0be

SHA256
ead928e5b4bcb8e4aff4ec008aebb740ae9679a906ef64ee1c3320cef464cd06

SHA512
58ca370a10fa9b55fa7b4790cb2c569b954ac62cb81cea6c7e0ebec42f77cb88b192036a02c066d32fadefcba0f3a33c52433b9519e765f7066a8fa5798ddc68

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit