131c89155bea3f1bdeefae1aa38b6851261e11a3fdfa33a970e5796177dba647

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html
Size

18KB
MD5

14a365604eb14f6f2dc1531512b95b17
SHA1

d5eb2af59ebe8364f1ffc73203c87eebbb61da41
SHA256

131c89155bea3f1bdeefae1aa38b6851261e11a3fdfa33a970e5796177dba647
SHA512

4fff4964c2e1fff356a889726039b539240ad7afd525e9801f756194eaa0281e0ce6966d196288a0ea529cb221fb358ecf14877dbe22c555c5cbd0192cb3acd4
SSDEEP

384:SIMd0I5nvHvN5Z71HHHBPc52Lsvx7pexDB8:SEAN5Z71HHHBPc52L2leA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D54D3DD1-0A60-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421021517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3060	996	iexplore.exe	28
PID 996 wrote to memory of 3060	996	iexplore.exe	28
PID 996 wrote to memory of 3060	996	iexplore.exe	28
PID 996 wrote to memory of 3060	996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8976c12a7035d36dc5b1d1ab6418e0f6

SHA1
1c801edfb92ec106f33b7f18ea75ffb82c501827

SHA256
e9ac4eeab11f10748a669c6cf621171fcd9b604d678b51f33d2e721b9063c5bc

SHA512
14f118ac13000d0f7b7994ee899bc3264031e111b225591e84eadaf01207c08e22694858b991d1058cc63659bd44ef7db353981e7c27f1f5105d09fa19e3ec55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d94ba3222503eb32b7c2d72a92bff4

SHA1
b489811f8a74f5c20954aaad24e8ce0dfe6c06b7

SHA256
24841b557434158d1730e34dcad19594447c7ec61a65b83b4cc3017bfbcf6d4e

SHA512
4e78231c5b2002309d7613c6e750cc1ce9c7b5e6f7436e0d72fb697e3c7505817331689d15e9f3c0ee9a3a735d660346d820e557fc8d952002f4fa7f2fd26da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f171535e1fe73ba323d3108cef74bc

SHA1
6a13089464394a70c908212e178908f9178bdc76

SHA256
2ebc63dd809fb67f3c69ca5e2db3f595510c07d501979a8b148eedb315042572

SHA512
2a169f0aa6c79c7ae6e50258ed21b467ee121f12790e8404d75e2b84626055311a233414fa7ee2e0a38696719a73f1b12c4ed9a26ce6cc6a43dead57a7829602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cca75b410e9b66839421be67d3a75355

SHA1
2b62b250b5ae6a073341102082d53b1d197b9271

SHA256
84dab900555b924cf31b1de95c73977c4f701725bc1a3357bc37e1ca9d56a392

SHA512
442c3a51ea54f9e763c71a94ffb153903154379e2e5139fb293382359bcb10a0415afd9ada3644f1f85c77a0a1184922cadad06ec49ba6186d20cf10bb405bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d5ae18d01f8acfbfbaded68bacd3ef

SHA1
02dcc5a6b05a36a046116afe82dffb73c873ef5e

SHA256
a50f285888dfbecc9c21f58f00aa3bc4dc7a55cbb13927bd76814ba576bef326

SHA512
d23a0b06e30322ebf6377870aade7fe7f1d87a612ce786a883ede7e341390c9a92db12bffaa3ea75780911e8c2c1aec422cea08d80634246f6ed03192b0a2889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1f6f5b2481a82b9cf6c84f34df7385b

SHA1
3af0f60b93a01803ecb7ac35b7c2b437efaef661

SHA256
0b6e9dbff385f2b83b914f275a2d86bd3239a93754847d4fda0aad5962db3a69

SHA512
05639aa1353aeeb1f6956793bebaa9f423289f5b3a10c5cd9dcf8e3b08a8c816d5a7a47c729e99491090776b3c6167b5b988f6d6adcd76b1f21a2938ff37b037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfa65347049b3d6f82c1059f95a83af2

SHA1
06b8bd5de5b383981b1c902026fb4007da4425fe

SHA256
d36ad410da6527dd93e7f1a57a2a501b8f337638bb588bb8c0e72c7cc6b63707

SHA512
3260984327189a304ef1110256ceeb5dfa0c0d3b67fc8303cbf61a30f9e411bf227c0cc9e6f4577b5b502ea69a7ce9667863737b08ef734a50bd1d7a9b743594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef614a475e6652ef954978925db266a6

SHA1
0d8ba782e028072e5265f76cd30e506cb0c2dded

SHA256
253f0b8411dc14270600fb75e35c048983a1fb66a426a0f6a26d9512e541d59b

SHA512
ea90aa83ee1e51b8dc152e4a1b0e230829d361e2d6b2117983629700f2ee2aa7ddc22cab1b11fd7e1245b5c464b95a5f84dc682a561ccdf54c23eaaacc1b7424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5775611edd9b3d0326d76b35f0733ef0

SHA1
f61b2c54d7913be64d2ee63a9dea24708055ccf0

SHA256
b7b33738e3c913b4887c90835cc01594fc5c7ac940649c5e89c932dca587643e

SHA512
29723083d3153fe0e3ee07ffcfca38044821aca01ac597f31ba5d11db552a59e9873f34b73ea460dc537e3dae316ca1ca04c8107f04d7b9fed43a59e47394c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2932.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A25.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit