7ce66ccf88397b72d95f83f27f112995756a6128ac4b596573dde5cdaf6d9160

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a954976d2459fe66267390fcc7fb02f6_JaffaCakes118.html
Size

41KB
MD5

a954976d2459fe66267390fcc7fb02f6
SHA1

bfda69b9db21798cadafd781efef6ebc2bf89ab4
SHA256

7ce66ccf88397b72d95f83f27f112995756a6128ac4b596573dde5cdaf6d9160
SHA512

c6257f7a1ceabaadd98dad3e3eaf1642e59b2852c96e2bd00b10e15e0bba98dd015c3318148559fe79e049d38a801f94206a26a5c2a645859fe46625dde99987
SSDEEP

192:uwXVb5nn5nQjxn5Q/2nQielNn4nQOkEnt+8nQTbnBnQmShxpeNPycQflnPJDQsBF:iQ/jmxB7qK3+9mAxdDeycQD+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{989722A1-2A3D-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424524819"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2508	1656	iexplore.exe	28
PID 1656 wrote to memory of 2508	1656	iexplore.exe	28
PID 1656 wrote to memory of 2508	1656	iexplore.exe	28
PID 1656 wrote to memory of 2508	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a954976d2459fe66267390fcc7fb02f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6e8e725807ee1744f2a419ed78b9ece

SHA1
98c6e8b3efe2f421e5f65518f95123c70b3f7392

SHA256
a498523ee46aa5a9d4a6166dca7fb35794c2063221a02b5ca0d26692ccf409f7

SHA512
bed80013ad6083e9f3f705b9145aa9909715eb4d10953fd39444a8400c7b0cc04696a81a3d2c7cab15ec1e4b775a100d7d4bc820ac56c31f892db15e635c98c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e48cf4ca087eb8b083b474b1b12dae9e

SHA1
9e1c9218b21843b09aaadc8a6a550856da8df2cd

SHA256
063ff7d95994bef836a3e040ad34330f46dd2736582d4a8acb8d28680dacf515

SHA512
1fac1756c538f17d4d68a20e8a1ddf8ea464b3d98bddaf91b3c053d06cd6414d521bed769eea1a4fa825dd5892f41c9fd1cf1e4dfc4b863e7feeea3e1c7f85ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a87332785b12574852d40a087bd51a7e

SHA1
76cfd1250415421534ef6cd5b56e25fb0b6ff029

SHA256
324d43a8c19789a632f1916e98ce427ef548053972d4bfbceaaa78a1bfbc5928

SHA512
cf6c366f5d5a3d0db767f528a7f040588362fed1edc03e5e20df5a2e63724bf1357dd54ace65a0db85fd16a946eea86ee627cc972de2b93177fbc10ac0bff954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
970c4d96d6699150bbe01fdef9fd2773

SHA1
55700b8fd93216704cb7a0617baa546fa5a3f33e

SHA256
eb64ddc9ee3c746cc56d0e8c823d9d306e714ad0ccece51057dbdbd7a62ec8bb

SHA512
62a28338340483ded16799ab5f220381017ded96af3025fa6fdd1481098af5e398dbc3aebb82b4d06ddf8b9ad0e43bfa57dee1aa0a01ca53292d1c26ef05364b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad74c49c7be1c3c3b501f1a3aa3114e3

SHA1
88f772ba343e0e29b04e6324db65edc70866c68f

SHA256
e2925b37b864bc50478050fadf298c88a7d37269169494f3ef16dc2cba6394e0

SHA512
bd2d99048ebc456625316b94396bd92c6c0ff6ffa250a2c966191944d2b7b6129585235ca9a68d29939f461ebb00ee027b5713c55193ca03365e7dfc51bc0831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6ae50c9baa45a158757a87940ed9140

SHA1
7148ff2548774e7eeca955b6428cb7d837e412af

SHA256
162ee5871ca95d93670bdb3425a0bd113320f742ce5f59532bd35cdb856b276b

SHA512
d55bb26d7ea1e7e049f80ef602a368b6c20d55147c4f179f94b404fb174d621c5afc40bfc744ef3f0ec407e8212c1c0e076e6b4597c7ec29aa9220d769cb0a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7791dbd7b8a8e49719d66d583e1d2896

SHA1
8f11b4d9ce8c91c1a437903725f01300328937f4

SHA256
b708c44d57e5831760f3293d5aab74040b11df812105fd70b2f658d711952984

SHA512
512f342a3a1a6e95bf7f9a95e1aaac6856938ca56167983822f8252bf3d78a189594e06b71772c1bdc3f19142055b82ecbc8d07886fb36fba03862f7cc722a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2db919423fece7f73bb5c0d3f13ddefe

SHA1
551c23fc6469d6bb7f33f7a2dc926547be0e9e23

SHA256
44d13d75e6a990667656521e62c625576248aa403f85738609f2ffb287a528a5

SHA512
f18c21279d87d186053730f23accacb8cc2350969dc108e757c92150a145c8dc245e8fbbb5d396dfff66d4f6fdf599f07e2ca03f4275ba24cac588765137f96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70f1ebb83b0535a6338c113b800395cc

SHA1
d51feefe79e7464a22d04c61dadcf69219acd7de

SHA256
d27e3eea0dd305918f79e77ab31a3c897c58dcc0f0a933ec7734cac7dff348ec

SHA512
26a6816ab3575337dd49d4d675c60e9ffa1d8c27458eb7e3ee193667de6c61d259e3e0e48e370680a1a4e2a3dfdfba54751c370b26acc42e4f82921cce0a8dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1299.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit