730170db22516d141b5f0654b6b8c7a393decc58e79b8e6dfb822000ceabc968

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5e0b1964a52271ce38b7807f0e7cc40_JaffaCakes118.html
Size

26KB
MD5

a5e0b1964a52271ce38b7807f0e7cc40
SHA1

f1cefbe09c418fb4fe7a1ae3c4be6bb0abffaf72
SHA256

730170db22516d141b5f0654b6b8c7a393decc58e79b8e6dfb822000ceabc968
SHA512

cd63c6fde4049dc38b5b5855fa2288914626d2459a4ebf0e8081cb40371be52ff60bed1db53870c570a2235a3a86a22d673d2954eb4252823ffe45df534ae965
SSDEEP

192:uq3XtweB17yEjtLpb5nW9AuE8TW9XXoxljnQjxn5Q/w9nQieUMNnj6/nQOkEntCm:nrQ/GygcJRRY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B453D31-298C-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424448561"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 3008	1276	iexplore.exe	28
PID 1276 wrote to memory of 3008	1276	iexplore.exe	28
PID 1276 wrote to memory of 3008	1276	iexplore.exe	28
PID 1276 wrote to memory of 3008	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5e0b1964a52271ce38b7807f0e7cc40_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
43628661a495da26dd953b6c52093acc

SHA1
b86895f9725ea6e34c08522602d367e897b7bb51

SHA256
6e2f94cf34b51b9e5440a46fac549764d79cbd47820dc70b547672abc797abec

SHA512
9ebdfb103b2513c20ee5690af45e5c4aefc72c6c00b456c23d17322f38b9a64776fc7e40e97f3aab0fbe5282e26c1f67e037d3ad2cf579b0a479f60708d47433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ff4e75c744f39dc431cc1fe4dec7e5

SHA1
119eddd11c3cfc704d3255d6b6fb5b7d9469a67c

SHA256
710fdbf009d7f07a75fa29c4b5fd589056d4f8a5bc4b9d9f158351edadf7aa47

SHA512
8e24fb8e914dbda5d096c518555fba409cb01bbf52f12d806ebbf0cefa4ebc3c6ce9e0ecfcbb8d127d842fc35b202f8c39b4cb8e75c17da128b5e4866a34b36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90663c2200e390e66947b9699cac3715

SHA1
5dc1583aa3debf0eab2fdc2bf848f9e80f847b07

SHA256
9a7000b9c0f317ca55e7f7ee6419c43c39dd05aba2a9e37e0376dbd3e41cd87b

SHA512
b6bf5cb80e5c16061dc755a3e17a1d1ea075fd453976a3d2661e60fd810c4f7bf6a09d0cb68acb7eacaeab7a7a7e16ff4287aa814371c4f85b83640c7520e7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
457b3c35a7b0858fcf12aa6f55400d32

SHA1
b3b7574dcc694c2d65ac74b6b939af204ba4db4f

SHA256
154806d1de5be558086230f7efafae499e85685fdc46c3fddf117d70b52bac52

SHA512
14b5c14d9b56afbdcbc79457c88bdbe3210ef257b0897674c776584b3ca9aee02d4d6b958400a5a27854987aae98ba30dfcd9528954666ce54b097dd53eec09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abd5a12460396bb672034e045ae2e330

SHA1
d6f5c14c706c7b94ff366c8d5c9e41e6b7c161ea

SHA256
d8e2effd1d2d61a6a47c9b2d9798c079cd09f5875ca4b7b7a0e8fb7ba1bb30fe

SHA512
4fe41c8a02756c9f76d8699914e44eb1a6c478d0d0416251c06e468307f0a6e57a389bf5aae6a550c015c47815da6c51e6c2386eb2af821bfaa56b0cd160f5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eef3ce8e7ae3e9bd6c5abfa0f29fe259

SHA1
470dc478a3302b9571bc9d9e556ff9f5c704c1ec

SHA256
e552fefdd12a1e858d21a8f8af48db9e073c4c100a53b185b0b5fe83cb3bacbb

SHA512
fcb8bd4e8dd8f70d732dcaad963a9bd263c47e9dc2a52dc627896aabe2627a757bdc3ae98745ac98a18a45c8ddafc9f915b490878e22803bc6a42a627273cd39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
310251582e1117f160a1f3f83750a339

SHA1
8625bbb0683269e786dd4df6e5f6c9f541534dda

SHA256
c6809db560cbe9f5e71e4ea23fa3185824ab8f9d9f55d57d293d72d42bbe0eb6

SHA512
ac1983c3ffb35cb07e19ab46886ba7d6b56f267d9d774f7602ec74433384c68f08ee68a409b2668d02614cd85dca794c62484729b230c0ee00a4cba62993836d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b5552b9441b155f32a029e10222bc87

SHA1
cc714b95e3ad42efd6ece9893a5f61f974b62e95

SHA256
7bc59ad8f1b1dab093341ba4956e5f83d9ced55130bfc882efffe359d46ce9f9

SHA512
7b9e9a3b63d71ad093312f913d1baeb38244bcfc4f377a97ae2d4337ff878e33662f0e15e9a1322a0fb0ac31e00ab4587b6ff8682be1434580167699d2f8835e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4f1d9f16205fff2fff104af943c628

SHA1
a6649d3f2d92b7f373952e6480c5b2c8a2828ea1

SHA256
21eec03eb08a84a5f4b9f6bb1e843573eace6b94284487b321eedc9c706a99a7

SHA512
30069c68f0f1bf7361cd5bf9e6968cf7b24bf38a3d56921f270c5e721efc22b4315fb374b860b4a953a9e29e98faf54109afd845080d4fb15332296713b49a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be7f174ff1092be12908f3066c7f88d

SHA1
b2882e0771f72674dec05f569989f84fc132fd30

SHA256
e6b02a6e7845b4e2e5dfb46d23a00b88801141e62491064dcfea34d9bccb9c03

SHA512
411bbc742a3e45e0bb1a9f2c7569d083bde3fcde4861e5923dfa5865beca2a3096964aef64a251cb66f485b7aa72522e9286d5249a3af0001072de3d1ded1c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
094cf4b22c6b1c136f0df84c1688bc6b

SHA1
0b6ba2b7de34426498b97860143cedeebd858562

SHA256
114c9213506c7f11f3700fe322f21fe406cbbcc2950ccb299bc5e6c1eb259bbf

SHA512
e5575c4386b657b8130210c953ef2226236fb9daea93e6db6e4bb62e8c63788384ee20d7a79b31d75769c0bc321e9a9d34c2f62d9dbc1a166622fd81a70e34c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar154A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit