7937f9934d67943fe32a9bfd467914e9ea99a851fd3e8c75f969336eb9d35e31

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954c3fa5c55cb44a90fbebfe87484a35_JaffaCakes118.html
Size

34KB
MD5

954c3fa5c55cb44a90fbebfe87484a35
SHA1

5bfcf1791d38f865e9b9aed15e2d9b49714d3cdc
SHA256

7937f9934d67943fe32a9bfd467914e9ea99a851fd3e8c75f969336eb9d35e31
SHA512

fbce933e506a73c5e01109f714fa9d7fcea800045b8980c278239a99773add6c52c7d314634bb0f9f9c23a594918b036604213d004421d09608c8b090247d39f
SSDEEP

192:uwKH5CpM9Degdb5nF+fZ7LIqas8naOXnQjxn5Q/jBnQiePYNn4nlnQOkEntZNQWv:lQ/dlU25qsozoqfFBDKK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0007E6C1-2284-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423675447"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1932	1700	iexplore.exe	28
PID 1700 wrote to memory of 1932	1700	iexplore.exe	28
PID 1700 wrote to memory of 1932	1700	iexplore.exe	28
PID 1700 wrote to memory of 1932	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\954c3fa5c55cb44a90fbebfe87484a35_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af9019a5ca3f833d35008c75d4f27c7

SHA1
ef0b04a6d2f86b3553232ad0bc014101c3245e5d

SHA256
353bf8dcbcdd1433d643800c97d673c2affa3060feaf835addc63a542dfcb706

SHA512
39a5282dc30667aa3e76196e6b04dbc3b0fe6f993739b6f11b36b88a1c58fda1f89ea99492466cb590b6c37e7c5807f23bd5403a6f9e24e3b7afb12abd4e4a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0df1d29717c2883554aca59872958a8d

SHA1
e7797e2a57eda63579a9b9f2d5860ba517e97bd6

SHA256
69f8b4a120570260a4c0996fafd84dc3c7d7306b65a24b23b31588ce244815be

SHA512
a7cf2d711392c1f36342da3da9b404e37aa64148a857eb66e3e534ac69231cdf0e3141309b9f236c160249dead3ab869b3124b223dd230a17420b764e872f267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8accc33316e4908930457eb78c1277

SHA1
e1bfebe0af2d47a2466e6352565ac984b37766fc

SHA256
71531d79f570d38cc436b7aa20051863474b79bb31e81e2b72f4fb1709298ea0

SHA512
38ea34084d80626101b3abb6cdaf134eb08e7a18a8c31cd1e11c1946bc9304120a98c7dceadfb495cf338c958b91cc88031a6250ead780ac6d685d1641cc99a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e7456d6d57988d7d34307cc417e8c4

SHA1
f7415bba0cd5c4415882cfffc0e97e2692886d48

SHA256
3c8136ce205d1d6a0c62f7f50143159a29d32834d83936fcca97b8d6383a82c5

SHA512
a5c26ba50285cc723b470dd22737f6f058503b52ea5ce1faf7d4fc992dbb219e6f35ea6309042f32170e6f23d876f92c30326d2dd7ac8e6b74ad59bb9fb0d5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b1a3aea5a81bbad9573c790b798bb5b

SHA1
e7501e7b32a531b8db968519671fb2bedf23cfb6

SHA256
545ff14926d41e1134aad7ab1ac03f3fa446c5b7551235051f0c5c5d9518df35

SHA512
bc2895c37964fc5a36ef8b98cc2127992b8943192f269fd8effda297041407abf1240892728a644f2c624d50c2873351bdb297fb67ce5a538e24bbb812e0967b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0fd4aa101cf5628be2d5f62e2448927

SHA1
48dc1fe7d9bc7165d2f6e1c25dd10dc3154a316e

SHA256
b4f17a597bf25739a4f6e70c72a35268ef18ff1c554693d9e2fe3a00acc6dd56

SHA512
a338b848b4fad5d144a1a543d2c2642284a5ba24da41745678058506457a0328e4fa87aee63d9f655ceec0b72c6130eb01147e6dd15f9b0ddd38d484f1b402a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f950f280e052fa59f12a7e247c9fa3b1

SHA1
0174fdc0ee26ff745a356066ba52555e5e5aea0b

SHA256
6d7e72e51e5f7c6129b3d1ba14ea9ff9763371d0913d7820d472f2debdd50515

SHA512
3ff51663f1b5a6a549b9522d1e81aab127d9ccb407db4d51169fdba825c50087bdfe6a9471a776d707e5b0e0544e14409b6f8e31386e1a139e4ad445ae25f848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a410e72a60af2dbe7063c6a89306e35f

SHA1
0dbde93cd96c97edc6d641e09d3f810735f7c345

SHA256
54c23cf1a3e667a0ffcc76c340607217a85a3ec6e3be5abfb37c7b904f14c83f

SHA512
5dad071c65975ffbd3caacc6a74473936d778a8a3b49025db5a2a68d42c815e8e73b0bd0a00c5ae55e54bbec9a571eed3c86bd9cef095aab55a373a446a7b406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47d20a0c3c69f700701cd464d14211eb

SHA1
9fff513b76c51c62f4146c5bc73899d86bd544a5

SHA256
7fd9226f10ec12e99bae1866fd831cd0660b4361caece490293cd969ba8eb75a

SHA512
f509fad9f21b491c9413ae340d7738378ffb84e7025a6e035cc0a096a2a21cedd0343892b8ba53c5ca62593cc0f4157daffb2d10a166e860aa050dfac645506d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd3f4f1022b5f0e9b7f6d43dc7c28311

SHA1
74e2dc74f9b275650cdeb9abd6d2e27234a690f4

SHA256
abcb7054a96ffbbd0b3b2b1182cc032acf7548ed303c6d04f7c4a46d90e4f82b

SHA512
31da3d71e1ee84fbbf9863d3051eab5a8637878c00e2c1530feb5edb0d438e094b7dd041ee0b89f607f70efd91b2bf707c82873b824b373162c84b378906fe2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b776f09cd1383fac55d199dc333d0d2

SHA1
31d4114271d4e1d82455f32a0a459b1774bcbbfc

SHA256
59f9946104387b610be9ab91ae64eaafe2bbddc4ba94476885c69dd465e782c5

SHA512
1372a3043142a26943f4a608b4ef77e4706e4a807a94e5de89c7050a7b59a870902a921119191566a1e2af69fbe55ff9baf3888b028c113a7f1ea452ac7c429c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3239.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32CD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit