229c22191e677a5490727695d1c90afd214d3101180c48f6f23128c329d497b3

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

133104902841935e7abcbad35627a0c6_JaffaCakes118.html
Size

20KB
MD5

133104902841935e7abcbad35627a0c6
SHA1

69a5c190b49aaa02a884da4655603383b077f051
SHA256

229c22191e677a5490727695d1c90afd214d3101180c48f6f23128c329d497b3
SHA512

1bce48f283eae58fa4dc3b99fb4dc9e47ca9b0b35b002e727879910ee8f0aad565eb44e93065188fba84ebffd319b8443950b8a3c4f8220aef38feb57b76b97d
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84OzUnjBhC082qDB8:SIMd0I5nvHPsvC3xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420995985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63999521-0A25-11EF-8356-E61A8C993A67} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3016	2972	iexplore.exe	28
PID 2972 wrote to memory of 3016	2972	iexplore.exe	28
PID 2972 wrote to memory of 3016	2972	iexplore.exe	28
PID 2972 wrote to memory of 3016	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\133104902841935e7abcbad35627a0c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fb7cc870619e5a0f94d95cb7e5768b

SHA1
c411e1ec3da60d702c41dec616e084f32f3b05b3

SHA256
f080ca7f4ff91a0fe43b94fe74b104489f4329b871a0a559a5d56b162f52ea27

SHA512
3de8b8c9c1f2688f04c3599297d81b5739e7d9ab5cd3b16f1bf5b2b2e6fd876991907a3284f0cff6b53dcc0f01371e9796d5a9b3583b04beb511c0323ff589f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7420686b3eae2855c3eeb2ecc685794

SHA1
e5a640123bd544b90774a362cb2151c00f17edef

SHA256
a5f7640e30acf786ec645c1904ea717ee6b5d7f78d53d3832e51798d3cbd2175

SHA512
f6568ac4ffa3995a49298d433bcd99cc4826ea46d584fe68e189b8f84f98507030ea9175facadd2508ed676de6f89b33458dc91d5a9ff64e5b211b1d35a7550a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2965131eb9b9de465db17a5c8470f810

SHA1
dde6d9d2348fefcd6b81edc25d3312e7bfcab5d3

SHA256
584553c24472b91c8ab0a59f907de1fca8a9798c0445a9a0b52edc4531b4eca9

SHA512
f20277c4f03d973aedccd7b992be82a95d3f4d0b5632b594613a6dbad788005551680afa21ac60bf2a22c648ad35e6ede87884e173d81905773ecdd3e5b79d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1f0c22c8479993aa9dccfdd334221a

SHA1
34142ce0087896575d337e01a58a4757acbede5f

SHA256
ad0910fcb712b960b870987171e9afce25d99520997ec62542b7031c92e95b3c

SHA512
b509409bbc05476a0c5f48c7f6dfad4e675fef8746fceded1c76485572efaf2d2bb6fa9389754c25881383314ce8392688e7deb3c99d7a3e7c74b63588b46645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9053987d7f1499f68ade45e8f7c3342

SHA1
043f72294c7f4f990c3c6cb3005be77fba078c7d

SHA256
f76285fb5e632a4bfda36a28c53ce8a330e880013f1b28c19ed23c6f669ad5ca

SHA512
248ef292cc8bfc3b0da2e1f98a42aac59f730e6f56a5b295153e6bc2ede23676b2c5b36232f4a9b3e49acc0493de467bdce620788d6cd4a1851df3ca1987dc41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8cfcbabe7146f9231ac93736a23781

SHA1
462a2855418e7cb8155bf9b8e005a2becfd4c8a0

SHA256
db0bd3f061a851fbc952aa41b04f80121f44ce03080fd56ccac7e9d199209614

SHA512
a2a2a86875b3528864770652033689665f8c4f125a826f3a23d66e60d17e2f48097f4bfaf8c6be64c501d742991210383d23823ebd3405d166b71ce9439d731e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6b5fd5c59e68f2c97cc11449bc9890

SHA1
7fdd6d2d65cdf5e5616360b68ee71a0ba44283d2

SHA256
e7fdcc33bbd49f00eabea6622e1a381ade4dc0a1fa001147db0fb29ed3b64f18

SHA512
5b4cc58ffa974a9fe0f940fea179d4cd2b1773ec45056dbda2bb679cc8e8499b5397ffefb3d9b54584002e2b4a2aed4ce8a92bf63f32a71c9a7b2c38cd694fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48576d338dea8b22808c1d1886a25dda

SHA1
e8a9cfae0216d083ba624bd271c246346896e053

SHA256
d4bfb8eec40292fefab8b0d5b61819ac3c5512ba77669e3760f821ddae015d20

SHA512
a5a047250ddd903de501fb2a9721cb46a60e21a68a66ad772310225365ca024a2e6ef0f09b8221b91385c80bafdbc3484662bedf24dcd7285271b9a1542bebfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit