7d856ee767672d02d75ff6dfcbf7a5df12ad7ea99dfe44bdd94f2ba7cdedb11e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4327d258752192c2342b36d509b9e04_JaffaCakes118.html
Size

23KB
MD5

a4327d258752192c2342b36d509b9e04
SHA1

f32b1f4f1818480d1a08b4aaeaccfab646ded43d
SHA256

7d856ee767672d02d75ff6dfcbf7a5df12ad7ea99dfe44bdd94f2ba7cdedb11e
SHA512

28d50158eb8ca226d684895b6d64f58ca7ef8e6b807976daee6e4f4de777907908ab0e220a8c79e1f14e5576baedb4ccd5ff5c19464e6c73b83c400a52d6d0b9
SSDEEP

192:uWrkb5n+4KnQjxn5Q/ynQiexNnCnQOkEntScnQTbn9nQxCnQt1wMBRqnYnQ7tn0q:VsQ/QPq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424421908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCD440E1-294D-11EF-BEA9-FE29290FA5F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2180	2820	iexplore.exe	28
PID 2820 wrote to memory of 2180	2820	iexplore.exe	28
PID 2820 wrote to memory of 2180	2820	iexplore.exe	28
PID 2820 wrote to memory of 2180	2820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4327d258752192c2342b36d509b9e04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
34211e9edeb8d88d3f223eee65ffa297

SHA1
325a4f09832f4d54b718fa44e7376abf5e2a4042

SHA256
831ffdaffd0267b1c7c07407b1cc0a47b9e185163162556d9697270c85a64bbf

SHA512
5017784e3f1332614aa0dca5436360104ad1a033439a1f55b721fd62cf9f17b0fcdf6137609b94899b6dadbd84499e2ce3616be85c0dd3e833ae33db5338fb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0857e5c661c8a18aa47e1cc2db4bc40

SHA1
dfd160875185e6a71ea3503d225a907411688294

SHA256
050210d714d3ded30c5b070f6741b0ed2cc210675701b77cb87e8cc8ed22518d

SHA512
6927ff63ee52e8958f3c8e906525512f6718e1f39754da9ce1590991c0a591502a01b43871248d4dc161338893b60963a12622bd5a6cf7c7eedaefcd466cbca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73912381e4f91f367fdb6a2a25528fd4

SHA1
b39fa50e11493a52f60129fa94091f534409c738

SHA256
bd44ce2070d9cf9f4d807bdada8f1921c8ae12a6aa6e831c0feac4b775ae6648

SHA512
c839c8962737714647bb7251d10a00eb3ccb3d6c03d3253cc7441056b0d7b8b28ba1bf4c6caf7d239830e1bc3f97baabc503c9a76901e67bf8aad026e621169a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398dddc2350824af81c4daa7a615f130

SHA1
a4591495eac279af8e596b5085bbcaa824ce9105

SHA256
fa5d439476a4ea4791f79f579cd4af6a08b28ef34a9c1399d220036e32a3db6d

SHA512
98108acfc3743d5a41156799cdc391e9dd86352a54e09ebcb7a664348f41b38697b1f13ff5d3da228116d46bff81e1347df0d7b7d80e5d44f04d62fa8f97b08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fd7567d11b872ac96c6bf52e14469a

SHA1
8ebc959e41e9a1926e54a7ebdf3a6bb08bb73db1

SHA256
b45be0198da19cf52f31b8dcc9570a244e9982f304f341ded9921794c8991366

SHA512
7077263beaeaed528c749fe86fc6d4f98bd98ea71178f9fc1edbe629369945232997a79a6d91a0600bafb82faa595a8966dc6bedf9ee5e810a3661ecfdc8ac16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d321e3b3a515984deb1c8a38fad60c2

SHA1
fc1da2b8a1a39bb29c826bbf7b974d8696e68162

SHA256
ba192006e66453b82579f71fe2eca898a468cb2fe2aa42273a9ddf2d5960de65

SHA512
3d496c9ce63639e464fb20c2729250f0a53b7ec9b5d81026873a8794dfeca3b3904b48338eb551dc0843f58d44a4448017d887b7376fd252660c020cf8428633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cb1649bfbde841862cfcd5894e2b447

SHA1
69c9cd9d855076944a72d99c28c52693f20fcc29

SHA256
8f1401becbd4fa85587a9006e4ae7eaa2dce08782e5c90e6f1ec3961dfe1754c

SHA512
78f2ae2cbb54e6286540590428573f0a998c583923f14c6bdbaa0116bca0aae5b43f04a3670c6adf2cae8d08e0e137aa10443bb81bf33774d0e09e9d8ee53321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
354ebb5869d32cc5a0102ed43eab768a

SHA1
c682c0930406c46d435af15127c37006ac4cc8ca

SHA256
a00aca425d22ccd962cb9ee2bbd5bb2aa28fca1fb870d0570a7e6cdf4ed6f0df

SHA512
d0afc15169ac4ff8aca97974b05c0cebea54d1bc2e9c78ce708fa8313562d3e5110ffd5d5f6956255eb8f2acd8cc71d35b9a25e6b1ad977e4ed2960b8c8e87aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc71e441ab6d4a8260fefbe4efc5baf4

SHA1
d7ce962ca313536ee219c1ae58f66cd2d1461f13

SHA256
c50c933939bc517f8e88967f14f336bac126dbb907ed4642b394463938dbce10

SHA512
17766bfdf0ce48edd3a4dfedf808ee23e5eb921279470681122a3a5e9ee6321b61fba434ac8295defce68e15332536ffb5ad00e7694b2609affb4c0a238f100c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23bd0e8ad095d0f7badfd0e9e3be5ce1

SHA1
f72fdca4666c8f32d49693c6457ee804b5a8e72c

SHA256
3a23407d11cd6157c7caeb258bc045e3a1b347823fc92878aeb2bd68af556ea8

SHA512
08628dcec02db1f00623b77b424745f7c58bc91bdfa6df4da71cc032e94e9e3082e6ff93a1a58b194ea06a6d20420f89f6f2c533cd7d4bddb023a756baf59efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
edae12b8a47ff594d1c60cfc59294edf

SHA1
5d6617bcf2e31739e734a41ef8dd0cba17a699d5

SHA256
b5f9cd0d0c838ece10f63787fa478d4920f59a94daacd389ab05619a128b32ed

SHA512
e3c7633403dfcbcee224e209f183eff69392c56ad8f0dba9ab5b86caa1a05927d44e02cb1643d9ef751c13a80219ca7f51e38c0daea738bc39f550fa203f5678

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit