11f04b7bcf7449d005965e28202660f74566959ff9ca851d5034c830416340c8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc871f55bf856e053f358aa634543bb_JaffaCakes118.html
Size

27KB
MD5

acc871f55bf856e053f358aa634543bb
SHA1

be0bc896f73abafade862842e7cc13a30dad45b4
SHA256

11f04b7bcf7449d005965e28202660f74566959ff9ca851d5034c830416340c8
SHA512

73492a229e3dcf87bc00e8d092627914d6a86908e694d5a151a4836fc154578a579a89d5b416c9d9967e4c9152d7110e0f26827520a424d5d6b0877a3bd86dc3
SSDEEP

192:uw1xNw4P/wA0b5nW01BF1g5lAOJgssnQjxn5Q/EwnQie4vNnyT2nQOkEntC67vna:LQ/9HIgMhS6l

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424585012"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE6899F1-2AC9-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acc871f55bf856e053f358aa634543bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85c23d673a285156fd948115a33fd7a1

SHA1
1fd996545e677461c04d91a8c70f3b1dc0fafef3

SHA256
b332e75672b70e097bef4adc53404f50aef57f50888a660b15c5ae9bc5aa4a08

SHA512
50506da18390cb9a3cf41ea119373e012cbb567e6fcc8b2a3f4e754d96f0fef137fa215332fde2d2b3fae11796e5fb46172b1df021201065caf109a43a1cb2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4dfebdeed7875c6109c947cb4c4ffc

SHA1
81d0032ba2ceda28959f91433b6aadfaa641f817

SHA256
5aa9416c3e109b2fa397c98183b91e98868d9c94cf69d7eb9163a3c6782cd947

SHA512
6520c4f2416155ac1f041c1cf7dd0b113ae6e9e0ad96e38c1f68b62c18616ae1c1037b2b7bb6faf6c56fe8e5d233d426700e9de00673b333a1f53c24e080686e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
530c7dd73f4983352854b38311affaed

SHA1
dfe4c5ffa488b4e78569a9430ee9e425e1f8b3a2

SHA256
23ded58a5b2188fc05f5946f441d155c12c87c434190df0f0beaaaae78dd9c27

SHA512
8113963868385d3e20d54dc7333f041c859d5152749a11c8d2150624fa35a51853912d5ef7cf68df17c5812ca8a632304bc57a3d0a4e5aaa063bd1e36be25636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
246b054dffd4a0a4fdab4b9767771283

SHA1
99ccf6726042d87d7c669e433df888de2087cc50

SHA256
07cfcaa9314538ec0a78a6f2f3efe1e1ac0bbf9cd7411560cb962765787d57dc

SHA512
39b020da7b17792447c557aed6bd35a2b65cf08163404ced6dfd01f9835e75bc3bf30f2d254240c3102321a02cba7c6c29aedae8ceec9b603c1b28bdc16c75ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
362191b7510923ce55475b8ef4274d11

SHA1
93e4e7d320b96507339d74271182d4f6a1031a7a

SHA256
22654559751e1c799f21a156f7d841a54c2977956b8b92cec328012470de19b3

SHA512
af5dbf326f83330f0b9682871352769ac67903ed5a51c64d84a98a66e999c13b1882a9a01888820d6369d63721c5aa2d9cd8ab728cb2fac0aaf49973355ede8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834b4373f61ddbc9bcec86a94beb9771

SHA1
e27ca2d67726ffca85e1f0f7c0991cd465571f3e

SHA256
c6d8a73a84a97f1d97d63fc8db29ff0f66a0244440faf96105d41f8249db84de

SHA512
baec4e5368b4bbb17a97f2de13fbdaf14e5e32bc152dc5d2291d6947bfede5779f15a9d8e8f6324377f5742f9a28509d703cb036c534891efc8b52d646378e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c97c3a17011594dbab45d57cdff421e3

SHA1
f8bc1c520ae9bd4328591886e7127be44feba9a6

SHA256
b4b93083db09ba0b9b7f9ba0b8cae6d7b1607987762e2aeda430f43f0d091e4f

SHA512
f633085cf8fd82a0265bd7857be92ded4007b181fbd8e7b1cdb12d7c16764b5c1eb3bc12c4b607606f8e6081688af1a4d5cf896d8585b00578883c39227b8f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da5878c82edb0662d38f263eebd1f4e1

SHA1
190db5ddfa271d04b088d67c9bf5e82b087ad941

SHA256
426e6140c7b9d0b68fa258d0a541a4fb6ef8fbe7263555cd19d84a09c9fb65c6

SHA512
9a3c1dd3df7c0c7ed8b8a52b69320b5231a9f2d17048b4c7e17fbfbac77616260a4dcb51cf9455157137dd931a1a27a1300397e5ab2d00cababdc0252b84cfb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca3bf18adc92e45de272427fe3a4b9fc

SHA1
38b44ca9d41215b2daf1bb1a1c480666c1740c8e

SHA256
b14e6889b476d41d451d11f21926304588d0bd28c060e4a25e93b686dc9f1f37

SHA512
cd5bcb9a88a7ac023c4b2ef93fa16cf1f3e4e57f7dc33e61758061d6f50b6c1331a3b787e0a7c389861ecffe616338fa4554105df9a6814f204693be6faee8bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
205bf57e568524b6d6e3a25eeb83a539

SHA1
1d7f6e9bd700ddad8889fa508d75b26ebfd31bd8

SHA256
f3ffcc217fe30ef7c6917c1895c6868daadb5b949c7c0a61b3ae78eb6c9e4409

SHA512
199be58fd169714fd5e2c7000106f7b6bb2f433fc703113d24757166e9350d6f66b7eb49072e219ec46cdd9d95aaf170842c6bc36077fb22b1bb0faa8885b49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4825d19d4f36c17824ac9cfbf7970af8

SHA1
46bd5e1b8aeb0a89df8951fa8b825982bc94b232

SHA256
8b6a9247d8ac3b9a5a7e5d99f3155d267a585de32489570c35366488ebeb7e44

SHA512
88729e0fe4c7c01d516d4dc64bc83e6d4ef6ed0f9e7f3a6d9c2cd7b37a51493805f3679621e46354eba6b4a155d0472193498ba34abeb850fb953d6545150caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF00.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit