028f13c659e330e5e0984254fa8171e020dbab9a8b05a8b0869d5830b7ef8412

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ec92848b182f970dc0df19d98c13d1_JaffaCakes118.html
Size

27KB
MD5

b7ec92848b182f970dc0df19d98c13d1
SHA1

7efe55b80c8cc7af4387d601da570ef02c63d48a
SHA256

028f13c659e330e5e0984254fa8171e020dbab9a8b05a8b0869d5830b7ef8412
SHA512

b105c808ce2fa92f3c1b2d34a715fbec2a1335ab4217a7e6ffc05ffab3b6619dc73b766166145fc89add66118e82c2c55e03d318311a341b21b4b44ae614d30d
SSDEEP

192:uwzYb5nUHIPBwnQjxn5Q/6nQiehNn2bknQOkEntOAnQTbnNnQ9eB1m6M3b9Ql7Mj:5HGBNQ/sbIEPYbsSfJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424778851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EE12E01-2C8D-11EF-8F1B-D62A3499FE36} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1188	840	iexplore.exe	28
PID 840 wrote to memory of 1188	840	iexplore.exe	28
PID 840 wrote to memory of 1188	840	iexplore.exe	28
PID 840 wrote to memory of 1188	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7ec92848b182f970dc0df19d98c13d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a17aeba443734ffd60edb52c64f5cd3

SHA1
c3a405154baebc6f544dfeff80f5b7794626da2a

SHA256
740aa1ea19783c255301b50b8a6cd6cbc4855ea143de82bfcc5721746271cfff

SHA512
3a8b7ab4902e37968c3fc557a7fa799115e410c601e76fa287f42fb48ad72d95af62a71eeaec2bc1388ee658e0ad8fa7b706bc148b5ca32526b14880c6a6c4b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc0adff2fd1256c3294205418b7b7ecb

SHA1
ddfe03c12bbd9d6601410b834a1f4db07d4e2d14

SHA256
06c79870d1df94367000c7e1f87a4d1e8537a2151f0f781bc087ecf6a78f4293

SHA512
186156d38489c79b6883a312f1e1534156579a83c12e7e7bc71f32060fa4f0507330a16cc443e50712bb901633be1754797876553c8f59d7e9fbb86a0bbaba6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0819e3fa6ccc9557236a725d39120ff1

SHA1
f49b7d2a09c88d362ddf5eac0064298165776ae2

SHA256
2939a972c2c6a421841065b06ecaa84d0fd597126c9b4db01a143886679f64b9

SHA512
151df60b13868e4d84dfc1ef70d49276217a29b6e68e3a7c62aa0c8053eaa9d7c52dda51f67d57d374da54364c87fffe84f2326cf8686703cfc4e16c963068ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9b7e4cfc0d639ab47088c52ebc0932f

SHA1
74dd0e6269073caacb12bd8fec282d5aca2af09b

SHA256
93be4f2c1520ace8a28d9ac6a662002977ccf0d6ae99507fef0f02e335a8c22d

SHA512
b67568ee2dbcca5a4532e45b43db6ed745fd5be4f84426a96d76faf1c62c4caeb2a8fe2c3f21d01d34a54791d942b8b58e1bf54a89c77ad6da64a5cedcc46571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ac0e95378968cce9f2bc76f050dbd8

SHA1
061a89badd4ab7a323fdc77140eab54ded899d83

SHA256
12222fea4de070522ea4e37b594a9a33c2b030f245ae044e9ef51f853f473752

SHA512
ca3faff1063e650632f7036147c4246c8a778238605f90321d67e58a0d507f7a2ebb7e5f3544c705b078bec5408b315718d480da57f5eec4c73e71137ea3cbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0dad500f2e7163e06c593a0a474a5cf

SHA1
a0affd10b0e76fd3c212a08a77a658081e05f199

SHA256
268acc67b046962e2860290d136d5b0fc6e07e0b45bec9dde586fefaa5e8f78c

SHA512
04727294f604c406faa5dfd5aab14213712674aa30e56c7376af589ab565f94e582ca132d94dfadcdd50ad2cd27a4660b8e72b96dd58e7aa303c6644dcfa24f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d56a53c82216afb9790b71d7fda9da4

SHA1
6e6b21536fee6e2f1a80635457364528f2902374

SHA256
43bbb21641e19230aa81480ef46908269f3671a9b6b3d74d25be36802065f346

SHA512
17cdd8b3a3dae4ae111ea46ec1dcd1e84295dae524b49cd49a40fc87d565950f5f5cee26cefd7606f2daf27aad38188d7302d8ffb0d05dc6ee6cf4123961820f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36bd0a30228e96bc61ed49e8e2382349

SHA1
0d621faa381b368475d8585b7f9a603f9d92ee7a

SHA256
52d5d200eccae8e2c44e15849b7df5c7cd151fe1af417b73efc9d7645bc43cc5

SHA512
8b01b59f00c0b6d463027c57df7107b2a28493a71cb591b43b7d20e7728809a793905aa2418c679b2fe250517bd4eb7b3904cf6a313d898a04a3a8d6b5457618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfdc9ce8036b7d3e7c937076c56420c8

SHA1
04fd24211928cd04acd27749eefe109865b41040

SHA256
70084e649e72ac94af3307600c840e6003ef732129e5e9695bf87d4826a0d4d5

SHA512
32629edb899ce8dcd830dc9a67166d569c09d98b0cc3719c0f199cd8e1e2e9f1d006c2ea32a6eb81a183a8456f316bb9088af280ca7d1c33442b153f17a925b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab708E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7170.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit