d7db7318e4dd9fbbc770a5298e027fc00f46f11497709061aa66a4b1a0071a57

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e5187830fc0c9d6067ca396b935090_JaffaCakes118.html
Size

10KB
MD5

27e5187830fc0c9d6067ca396b935090
SHA1

099b20aeaf7267dd8bbe662f5ba8707cf3665623
SHA256

d7db7318e4dd9fbbc770a5298e027fc00f46f11497709061aa66a4b1a0071a57
SHA512

2bdcb49f5bd16d1b9dd5367207e0af39ffb4cab70919edcbdbc0c132ed1daadf4658f4697fd5638c2510ccad6ab113cb807007a85a6386ad934ebbd82f64d619
SSDEEP

192:2VDlIsr03EV8k/w1wvqLkZgBc3n1wWd5t01/6uBuLbdU8d:sDlIcuEX/gugBc3n1wWd5t0/6guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D6A04D1-3B71-11EF-BDF0-66D8C57E4E43} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426416277"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2840	2772	iexplore.exe	30
PID 2772 wrote to memory of 2840	2772	iexplore.exe	30
PID 2772 wrote to memory of 2840	2772	iexplore.exe	30
PID 2772 wrote to memory of 2840	2772	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27e5187830fc0c9d6067ca396b935090_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d19ebb858fd0ebcd2eaa2e0aa4428ff

SHA1
eeaca44beb1c06fca8a90e08cd845ebe226f78ad

SHA256
24ea4d1e03724c95d0bebd9fdae70b589c711ba0b1e7ce87176e6acf4e57dae4

SHA512
7fa5dd389a9db8786b061c1cbc676a8726602fa2ef4b4fed79155c4872deb5650adc99c6945c183838d95a18b94b1bd097c0c810db838a20ebd58dcb7d51e1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da5803bd9b77153ea937a9c32ba690e0

SHA1
6a1bd0bb51206a67c57f5e1bf5afe8264a5a135a

SHA256
f78ff8980f35d17bf6f13f7136d59d16bcd15c023d10cec2f5da25cf0f4667d1

SHA512
637b2656b87e1abd0c837592dd05dac44f96fa8352caf9782f1145d9ca740cb5e36b3f63c50f8a58c209b05544dc89f47db4088276544c5064951d9e092c1064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d5ed55620b3c1524d2ee27c4169e2e0

SHA1
0bd6924b5aaacb2deef24dda9494542f8d76005d

SHA256
aa8f4b4f286f8c4943ca3a9095759662affb062784e19ba0cb1038f4a98428e7

SHA512
d519b4e83b5723c1c5438234a2898af82a9b9aecfe0d5fa69777cd9ea529644fccb6fb72f547476267b109fcf098395de9d9aeb7e8ad8f5dfd50c513afe0cc20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1682b061c761156959c510e9952da8b

SHA1
7198d253ed602a71c94a7b0f155d3f61820e7ff1

SHA256
0852b863f3762c08c02f5e76c96ba6d4bdfce27e87739dab951c0756e51c52bb

SHA512
03258d196eddc27f147ffbefb5611507351c8908c764e19a73b272a9e80c54e4ee4117a39507aedccd94cad34be348a6f4ef803b1f709d08e9dd6a7ab7c6020b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47209da691ed40e73c5673dd8310b2db

SHA1
a9238256ae3c6a322c69a1dc41baabcb86d7cadf

SHA256
75f75076104ffc1fc01822dbb639e88ac323f0fd95c951eb2cb1143e87051887

SHA512
53c8a496b0d46f3a240bb47ab22c82b7cd66cea37976ae77956d82215a0d428e29469e2ab51d634dc0be0818b2cfd083cf065bc2348962cb90f4b99ed528203d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dda02155ea796403100b605eaf88286

SHA1
de6bcf92b745636375cbb38146942438cce2d062

SHA256
6faab2287c2898318b9c6ad97796ee5aa49be09bcb26763e0675c4143bc334ba

SHA512
11734e834795623297676180a7ef2a1044574f25557e775177d94d08d83fdb7cc5d0dad201e0964463f3443fd51848fa8c93a2bae503471b46cab1fad1aab4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9da02ffb0171e8ce0fd16823d7f820

SHA1
eb6a13df3d8ebcfb89c6991ff847b63677b61c17

SHA256
4de38ba51e943f75e0da1bd58cf1fa008153ef6be40ed88a2ac6b394a687a078

SHA512
57cd8cc012a5250db0ae99ed04f86b3322c21c95933902511e5d450a492e0d0ee1adfb4529c39ab8d8ab603235db82bf1d9837b2074ac8e9a6c5dd0608ee2919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9b91c0226478f8828299295e346c31

SHA1
374c1c2b7149938fc10f8e01f427ae6efdcc3a69

SHA256
d9c6b7f567b4a1ae0e6cebb71cf184acb779a99822e00f41d822924fdee5cc4f

SHA512
d51f21513102361d2eb903eac832f347639431dd9dfe86304bf3b1d7a39625d46cb34e599b118f2fdd647e2427e1b79652345bbadd82f65e47743f11f431bae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78335a778825239c686988933e7683af

SHA1
936210322798cbeaf5a136e7754fad107c91f889

SHA256
1b6d9e537a0ba656cc3d59484a04484dd4ed62ae51b583a548d68d87705b16d8

SHA512
96f37661806300bb6e249ba57e53008b267de23f6afc9f7c695efc8d68de47e18e5e7af9c0725a09e6fd5b9ce010bac383edef4c24aa9266fdcf794f584757ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6CB9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D39.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit