999c3d1b89c97b29ee9e9601524702ba628b41a2c1becb9d6ad3b6ba691d7769

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13eb83e00a99d32bc92836a9940f48c0_JaffaCakes118.html
Size

182KB
MD5

13eb83e00a99d32bc92836a9940f48c0
SHA1

237efb069a3fae221d922cf3b55c7a15f354a1b2
SHA256

999c3d1b89c97b29ee9e9601524702ba628b41a2c1becb9d6ad3b6ba691d7769
SHA512

4cc34b264f5c8c4a727189907c3a23ed96079a620f8b46a1e292997b15d390711e9f7519d6f54787ae9a32a9ed6ab895be2faac88dd37e6beb7a2b32bdcb7f57
SSDEEP

3072:7UbmHIEqyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:7UbmHIEPsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421008705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{010B8711-0A43-11EF-9911-62ABD1C114F0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2076	2028	iexplore.exe	28
PID 2028 wrote to memory of 2076	2028	iexplore.exe	28
PID 2028 wrote to memory of 2076	2028	iexplore.exe	28
PID 2028 wrote to memory of 2076	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13eb83e00a99d32bc92836a9940f48c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b68c2b6f17ad2d9d218331a243ae0979

SHA1
e0df837218d277bfe7dbf79cf29b1b2b6d1fa6fd

SHA256
5e4ffd5d44f56a7a35d2f5d5d53e3f3c047bbb03ac7f385e8ed691975d4d74be

SHA512
8495ede9ee4a5b39591b0b7a4b7de0487b4b67e5af522631470047d65bc0ed964538d821cb52a702fe3381026377fb687e83bd587e96a82c6d21c64a791a4df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e89e88c1a906e9bf2fc0bae5a12607ab

SHA1
eb1d7710ab718b101682a8ea71b40b1c986a2a80

SHA256
f6d249106c1079b62a922ecc2e86539cb99a9abcb5b53a4a24ba054bd070d583

SHA512
a67c4c3e70ee40a3a0fd0fe7a2cae14316d4df1d293dbb1a88c056d4feccc77a9db55f11e993eada63ac75290ae0035d45028d01ddf22cf8bc6db757ca50a4e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311c3270f4f029f151a50d0b7dddd3b9

SHA1
191c99a97a51b42e2c3a79ff1e01c68ae680c332

SHA256
f788b9ff42a4daede41bdddb37b681d96e80ac24ece53033939ae9517c3cd0ed

SHA512
71bd01c8c11ab90b822dd4e361ac84c53621799c88dc0e68bfa8202f14c360f57ae8ef0059e63f05c64cb32802566d39e8096f0eef6722286829f766e0ccb6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b93f628305790d652e9fecb01d3f04

SHA1
1b18b2eb1d0d338101d93bd08dac9584b7f97a1c

SHA256
7bff6b9606bb46bf25a6e683481b722fc2f90118f492bd1593a4ee87302959c0

SHA512
e8327b535c0ed26b642bcabd89af56590af40247bfc0f5bc6f16c6c21d3fb4c6fd6ff5d9eb344d7c38519997df62b44a4bde7754ac5be0b46ea5cc9606129486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d51721cc171dc6a193e1b2fb52af600

SHA1
2c440b7ff6da6d0ed6e1d1b39babddfb3bc4dd06

SHA256
8d0e1909956bfc34ade5ff445d642df799023898ef8bc6771625be16a13a4bcc

SHA512
1631d8cdc95592736b3032d50c444dab845295719840ddfa10124f624e90587ffd7b648fe373ee233acccb8f816bf6b8a782c92433715970c7a2949cfc8b4aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1cfe93dba35a4ed98031e5ed3d17f3b

SHA1
12b5f3e66f838aa548f1bed1dd7b2ffe5187ff52

SHA256
070dfef3fdeb61a6ad0dac7594574ec2de213a84bce65362508146e81cddf3f4

SHA512
0c4fcd6a02778b271f0d04ac0adba9ce2224cb72c395bf8a72945103a687f10be4ca72aa80c65682d8e2a20eaf635b4bf6646c88a53b23dafc33df07551e90a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e707da726d5634d73030b8f047ca41d

SHA1
e18f961b3f726ea5d838ce96aa6be73431663526

SHA256
e133405b1dbc841a52b5c79d37870b73ca46ed2abd5958188665a5d082cf4a70

SHA512
48227244b24e6c7df118b96bc42dfd5e17f12c05825f0ce2be4cb933f6781d9d1e71a84af26845baf0d288a9d1ea9b08afaaadac5fbb464e40ff5a73b4c8c253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
408857fca183fa33aa4c50637b729f7d

SHA1
3b1f99278453a02e7cb8c0bca4802c1b7ed1af32

SHA256
09990ddafd03a0eae63f01de0dc7443457e8597cbcdab86aaf5f3171d61d76ca

SHA512
8204c5a622ea5fa2e0506be932d31ac1eb9df429210627e8a8c54e34d909025443acd7f243b7d990425956daefe89248fb0c7891c9d75f017de81efd4d6a0166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f769940f289f4241f6a686d1e893cd10

SHA1
6c9168b0ccb4fdfe3fac3fc27bdcce6c7c7bc16b

SHA256
ed34b8bd8c35ed53906295ff08172288ed107f51e13717fa49bb9dee8eff02b9

SHA512
bd67ad47cc0899ac1fe067fde748c2bc381c6f58ef06b9bf452b128b96d20c3bc56e2a2d9fc2f8dd6e3a99097eb9b91676e5bd44113f4110730bde3e6406e0b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d9782f5bae881ad1af5c8331df7808f4

SHA1
5467bdfe95844bd8749b6cf763faf35b028f04fc

SHA256
30e99f7d3e7143df2a04ff1772f74ba0ac6fbb08a88268878b2d2cdc6eccc4be

SHA512
ab1baa0c4082b8b7e35b6c5991c97e82e3764560360feee11a8b913bec42bfa18133565c3ee9453c5a4612e38a34f82775250a04bfd62a8f3d3992652655dd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit