9e475e3cd6b447935dd71ff74e9099f2f181ce303766657ce15a88d83c6c7aae

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b27348ebb6ab929227973973306c2038_JaffaCakes118.html
Size

220KB
MD5

b27348ebb6ab929227973973306c2038
SHA1

2a25390a971ab9d0cc5d692691aa42e6b1fee733
SHA256

9e475e3cd6b447935dd71ff74e9099f2f181ce303766657ce15a88d83c6c7aae
SHA512

04ab4c36abc9f1678e280864da888df6b628596d51e47718831d430e72d580cb3298402e1a962cd3e701030927478e20f3498646053823d6f772f394642375e3
SSDEEP

3072:SMfmc9PTgHdmyfkMY+BES09JXAnyrZalI+YQ:SMtgZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F31F121-2BB5-11EF-917B-C299D158824A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424686322"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1920	2932	iexplore.exe	28
PID 2932 wrote to memory of 1920	2932	iexplore.exe	28
PID 2932 wrote to memory of 1920	2932	iexplore.exe	28
PID 2932 wrote to memory of 1920	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b27348ebb6ab929227973973306c2038_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af802ad3369d68a365393ce769faab9a

SHA1
24e0a707daf171025a6fb6586852f75750ae5036

SHA256
6e2b4db6c4984ce65993e04a00616e95b523899b73e2e4f9f0b8d92a2178bf98

SHA512
e90d4fb3e0b97e5eda81d4ceaf1c2a052eb7970e7eeeab30d241df7a13101f635397f1f9103caef726366ed99ca7721fe8032a8071331b8f17e17a1abf654e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab0213b8c49b8c7e12102b8956c4ca1

SHA1
c58100cbdb71eb92835fa8ed512f137cfa01b602

SHA256
949109ab768824f6d21d1a2876284ea763bbd313136ba13bb22390da9e905a58

SHA512
0efd247f635b7512b48a1532ab7248df9757327777c629d5d2a2aa07d5b7b1ebff312b905a18861f46dc962b96e75242022fbd4384e382f5ff56671104b1b28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
425512283653cf52e1f892b0dcaf389f

SHA1
59ea63f43bc67d02929a03520bc2b862ebc8f3b1

SHA256
a5c3c91a87f80a4d4af736d8fc987446f96fadb15c47894f99a5119abdc1808c

SHA512
3be31562d0b3b43478f15def0e9b6acfd44acaf50a7ce3313ab57431ed13b6807638b48d56134a53728d9e43478ee868d43f416358992835bafbdeb3780d57e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc2d60a05593e8fcd837bdfae02fe7d3

SHA1
d4c1d537e770b59981ce276b9a46a8ff74b44f61

SHA256
fdbe085e964d8f1e0c571f0f66d546340c0382ac513b287714c95330fe4542e1

SHA512
0c94170370e6cd417e8be2bbf4f7443d2c9859d675ccc6451142d6ba6ab549c09aca5f652eb6b148f72ce8fb1ac266159dcd53ee36360c763743a2e94732f561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd6e03906d4126a4aeb5cf24cd15181

SHA1
925d76fcea70f676ca6e54aaaf72ccf7e5f19b51

SHA256
68b23404500938b20f1cea4171d0a325971f3d217822a8d442fad943820a05fc

SHA512
96325ca01dbc058ea056b9a30c74d4ed2befca5d12bcb7c29c79496015a0b1560b1cc6224d9f23eb76b56a646dd7387b206c6b18b03234beaaec1e5acd659bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4580b05f9456c70a88b7dcb8bff40d4

SHA1
31c5181c9fca7e9a33ab7789512507d19e9d554e

SHA256
1d82d77257c6d73a8e87b18be80cf12be506c029c9933ae9160a00e5d4caedff

SHA512
345d7c99b7e81f81eca7fb458e949de1bd722164fc0bcc18ab09a27e44f00b818a09522bf30cea3f7766b2f86578526b5ab35bd8b800e789ff7fbdd3e3001d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2be6e1498a2c633a30efafb3c0807ef

SHA1
bee7d35b4ca0dc847e9109108f0097b4742ecbd6

SHA256
74b3ea44f1e30ff77e7d76ccb06046f79510e3e48206870ef22c6012382c25f4

SHA512
42b51cc2c7ff72695b3b5723a925cdbb47f8d22d1a11d46f8574fc537fdaf4a51cb1df4a9e65ac1ad2efbefa2024d0921b7471a3f6ed653444ca49c77bf66e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51a8c44eb30ece6badf7e202d283f45b

SHA1
fafe55f1e1d1d8b01d3f71e47d9aaae919dd3bbb

SHA256
57da79d5c2402a9e11eee7021706ac1fb22006035b9b8e75b0ad588728c80737

SHA512
20ccd3e5a7bfbae047e027c3b3f67d2d93344b533ff90d5a39dfcaedee301920e0c5c04cf3a29dca5cd8b669a592d8fd1081277c4503f9c5d1aae39cbd015436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73cc7e5c9f2793a8479bee865e8adff4

SHA1
06a005245acece99c123453ec79123bf8c9b28e9

SHA256
cd8b80486a0275bfec6186925313159c100454c3fdb687cdb08b36dedc7575e8

SHA512
d094d9fbab648fc898099bada26152a748c7bb5a661773285f312076ab486223467acca68599b9c1dc1e69c63ec1a15fab9d01dccb69928968027b941decbade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e1fa91852664403e8de1a4b681847f0

SHA1
f44b8ea93fe30a205b94379572517495360a08e0

SHA256
a2375841d030d8a09fdb9e2dc3049f1eedc2143b7c136d9e06b904a9b4217592

SHA512
b96c7e6e48802ad4a538cdf2fa7ade8011dcb69b31197c321260d35dfbc730674064bb2162f5c03171febd7aaa5db467f72641a99ec9e0fe2f191cfcdb21872c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecbd893dffe228d8dac306bf60fcff6a

SHA1
3cf95dfae2416009459ea7b5648440c935157a74

SHA256
8ce3344fcc87c06dd0590a3730aab1b2544c30823cc2f145682613e39913d9e4

SHA512
dc23d46173eeb3e670b3a061423b02db564ef722295dde1f08d3bc2514371a07b8f6be9af6c3289d2c2b739f6eebbc87d5ad0f40ef93c0e19d97621d64fef4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1760a551dfcb40ee9c910bdf0e801186

SHA1
2663743a03d318925c2504c488570afc4877bdae

SHA256
241ecfd06196617ad922e24173abc9d71c8cc6c9af8f6cb87977288719e8ef9a

SHA512
f94e772c44defbed30cc1ab64dfaf01c3880267e60d302334f99c898e50c53c604b09fd5db326d1a9b2b81012cfc04559360876a6cfe74a9ea26a37e5bd51a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7ea89d07387683832bb464e2f35838f

SHA1
5be0a5ffcacfbe73f1dd8e62a3711b75b30853fd

SHA256
ef1823fb2e1d09d47d420ea83d89f73c4689c6fc9bba69b004379b52168dabb3

SHA512
7aa6f37aee1a1c99fa80f7377437bf770667ec2bb154544e931df322752dd796b5cecdb39d8332c5e2f95f29a8a7017aeb4bea9244eaf7e84f5b8e25d3680754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280a219939ba838f35cc04a18242e5e0

SHA1
e775252bb04aca56f4ae2f7c62cbdadbde60f5a2

SHA256
35a84c627e424560cb5ef490090455954ae159b0cd160b824207bcef2ac4cd2e

SHA512
e761b8fbab11e0de01b4cc7403e51843ddc4e92d11dab7094de4709586587a692ad6df8981bf48c92db77fdedff7c81129fb033af31ac620cdbc557ecab2f696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ed15fd1d30348aa4f54f8be8347c91

SHA1
e53063553617d3f1e93b24619b1f0a4860e9a561

SHA256
9d371d2e195dfac4022083c0c133881f270371692c85b11716328d30e9faea1c

SHA512
42baab99be8915c85935e5645f02adcaefdd7b820009096be3e4bdfbe0088a589ce215c763be3794e3ee4ac7a67fc2c6bf9942d34a01f0f378cd3ad992bd45d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7febbef363319a9d6ec74098be918b84

SHA1
24cea0c5bfd46777e05385ca457d7e80024153bb

SHA256
de6977bfbfd45fae6eef59de098a48380f964bda524575d4417e8bbedc5fcf40

SHA512
01aea26e997384c90e0a29903ad607ecd32cba156114af25e1f4a151a8b065ca5e3c913c2e85c3c72f707a0a4b8cd730838b5a63f3eb2334d1c3aad6ce279005

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95AB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar967A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit