700cd3607c6d93dcc0b118a3ebdf7dc7cf92084da60e11bc6ebc0283391bd22f

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a54315ca13241d050af113a3f0878e14_JaffaCakes118.html
Size

23KB
MD5

a54315ca13241d050af113a3f0878e14
SHA1

4b44393c168d2c6b56b047b3f9906038d7b054bc
SHA256

700cd3607c6d93dcc0b118a3ebdf7dc7cf92084da60e11bc6ebc0283391bd22f
SHA512

b32bf7a4e7c9010a8bd9dce6a13abe23ffc755d616e6dbb1efadbac1ce85c2a55678775a22702c3dd042850dfe3bd94abb61e0986f8ec0e4679d04681a7ee7ce
SSDEEP

192:uW7Ib5nd2nQjxn5Q/4nQieDNnVBnQOkEntcenQTbnhnQVCnQtjwMBjqnYnQ7tnIJ:IQ/ZVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0BE5561-2976-11EF-8857-46361BFF2467} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424439498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2964	2884	iexplore.exe	28
PID 2884 wrote to memory of 2964	2884	iexplore.exe	28
PID 2884 wrote to memory of 2964	2884	iexplore.exe	28
PID 2884 wrote to memory of 2964	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a54315ca13241d050af113a3f0878e14_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
799c40c119463922c287a3b493d1cd94

SHA1
bd9669e1ff0cf8d53c4648fbff27ec1160b6c63d

SHA256
306df3f04df625485edafeee99169f2162432d73db5786bd8443b2ad77015f40

SHA512
d51fca3cf9b3756e992b0fdde8e6ce34cb7dcb53f29335c35cb587ffae1844eea28875de2b1ce5cf9fda22635cef71a3c789e7a4ba41ced196d41187def126a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e5fe87c12670ad0c02133201f7de65

SHA1
501c0b17945a7a58c1d5354d9cad4663f0943d8b

SHA256
65b8299296b738b9e60108d37903d7b7c94b01eeb1d41cc50e0ee9a647bf8591

SHA512
7a3cacd553b038228fba2dd0aa678b99a3aac553ad5727126b943acac48ee75700d567a39f14b1797d00f4b98e9b5bb5b3e5bf2c51783a5e8f93334d9fd05ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdbd762b5815eff30e356348e169a86b

SHA1
0cf05d970b44f4969d0fc1a8329a71b1d046c52f

SHA256
0a6701533c63bf54506b75e1b3cb9811577b97e7dfca37251d3b8c2109861a02

SHA512
c351349dee8aae971de29f41ce365ac5c274bd386194fd73f0b4d705207b451d368f1395a0710cef0430a2358503abf7391b62a5d6e850d4cb259a14bf01f63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aee0dcc7e111ab598ae368904096a84

SHA1
84ac5893b0aa37ab2ec8ed2571f8a9a2ec6d00e1

SHA256
6a8661a1d9201137f73c0a209ff60d8aa1675634489bfb9962173c7e6cce4dbb

SHA512
39013034a7d2a83e6280d29bd0fdc39e30f0c157cc805b99d1cd5d27cd35c104f23a6e99ddc566b073da173a1bb0089adde46d288fd79bef85f41050c8915a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1190f4a3c026281f808628d199daf96

SHA1
a819a42af1f4bad72eebb199a98e4be8c6d7b92b

SHA256
dae68c62d94ddd57a01b48b7ee588da49bdc387a4d504d99774a34977562d093

SHA512
3a437c662a569626cf4d9d7e4dab09dffab3cf79cebbc38bf7712ccea3a4caa2388b9bb24cd8e481df9286983e9ac8b12e47f28e4e145c621790c0a643496550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7cb3d0c6e94be8a29ad595fc34665be

SHA1
cdd33a3a3fda594aee6d2821dfee79356b0dd62b

SHA256
ced3619334d2053d3fd90593a081ab926b21e3f02521915889ca9fc11fbdba7e

SHA512
09473ddece15314bd11c4c181d99206b7390cde8fdc9d77fa5784aafd164bc010197bb5844faa4d523de695a8e5785c662a9a9f9eef3ee849b99ebc15250f513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
612ef94a7d7d52e363fef33e3d559ee5

SHA1
53bd5afe13c0c7b0a40f00a0b30800aeea5b8a4e

SHA256
10ee784fff04f9171580dc1ca362782256db4dc845243d80efd52188fcb8bc97

SHA512
a13abbcf90e7ee4d69e235df5d41c7b5d9f9c4f2735ed53a89402b8267258efd5330ddf52f373d314bad4d420630691b8e67eaa0277e9bbb2c6ea96a73524366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fae6e8321df4e234767dfdc83a56c1a1

SHA1
f885f55e2d0be85329b359a09eb1cbb1142eb557

SHA256
5911d51af47550e0ecee4a3606b8ed7379e8626efc06cf5399fd9519f678af73

SHA512
6fdad48efdd42544859cbc660f3079339d7b5a13e9391de4aaff9dcfbd1a5ca26ebd483835030bf26c22ca60808c3c9947767dcd1b85fb2982f1822651b54fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bbf47aca22ef7b58d337e09eb7b6137

SHA1
7c8892ec8c5adc7df695fcac0a8240fd6a1e1461

SHA256
50f2025f3f18e26ed44c72f1561226d24cf314adf63d5491cbfc0960d3e31598

SHA512
bdc24c5643d0cc8440ff4f2228d5de9376af70d27a0059f696e736160fc690bb40d1ed8ca4b9c103f331e63fad54ac82ddfa4d273879f430c2f344d562535429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aaf07d13eae6908e44fc5bbef644f8c

SHA1
67b316a4d791bd0f5d650054fa7e4feaa39b200a

SHA256
2e87e52da8ea48e6d4bb56e438e820f9db1deefbc862c966b7a173196a3ba000

SHA512
fdbc2e1ae9fcce094630e8f34a236822a122e0059897f4157bd6d052a0471ec9a02534efdbab14586cc7098bc6b38fb0d1d38dd06651fc201d61822925457e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
23ef38c655f71512d2fe3a6d6c41f08f

SHA1
49c9481d3629321e3ceda9cce3c80f46a049ed93

SHA256
ae4de53a99b6aef12e9d6df918159bc9888baf37884df18831def0b9e46729f5

SHA512
80e214d20be295eced909a3ec078fdd2509b5813af4e2471d1690c2fba2906a94f7cb38c5281f7212567776749a0b79b19644ead1cc7c8dfd952936fa879af0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit