16b944a4934be30d403c67adccda5b98f3845aa4453b3315f76c358d4ba307f3

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28f859f03f7d1a610f83ddf97d18af18_JaffaCakes118.html
Size

99KB
MD5

28f859f03f7d1a610f83ddf97d18af18
SHA1

a206fecb7b0387d7a5d5a8db72ae0f3943784fd5
SHA256

16b944a4934be30d403c67adccda5b98f3845aa4453b3315f76c358d4ba307f3
SHA512

0430a32d2f6d21520ce67977285f9356ca4ae465e836b176f3f963c84e484283a7432dd173d764b4a55009fe8061695a7c5831fc6b515295c8b1393e3e171b73
SSDEEP

1536:dp0NClJQ3dTq61o1QXFbZOXgExZVCgXGXoK8CnSMg3RZk/AUzRGR:EClJQUDQZZOe8+zRGR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B44A021-0DD7-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421402303"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28f859f03f7d1a610f83ddf97d18af18_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
364feadee4f452f153926dd125130264

SHA1
137fda8125322371914fa299859fc19ca5239c31

SHA256
1cd4c280876b8d201203d917e2050d781aeb2aed0b53dd5e47812a33becfbaba

SHA512
bc572611926f0c302d17fced177a0f3b2dd06fe482027731b38d1674f15d5887681ff30d02f819153481274df19c116d8001f357445ccc9fde2846b2a0c562ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e70f7e53834cc55d23a84852a3822279

SHA1
9e680a1cbf240a0dd0f8ff5610dd010cc3f835b0

SHA256
3d29864a941d69842123f511344881d0d39b426d33e7c5d69f244c749103644f

SHA512
da0ebc5ece0379330f3a0fdc3e203432cc709c9fe022dc777d44aa37ea6a150c9f8055a577771d4d15787ebcae2b3442de012250ab78aad5d0ef235d5cccd7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e108afca9683ecb63e038d7c07fd3899

SHA1
0c000151c4ed4a3bfea00c6c92b490b3eb450b40

SHA256
b266c398cd445c35820f45bb0183c15476e6f35174f6ccdcbdb2c6c0433d1aef

SHA512
0164ccfc079ea9920484c908019d5e81c9373a5d79fa29fd90848cebceff149f25127b6b77c9fedac8be94d5bc3fd004f88e653ead68a56bbe953d5eae0cbc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b480b0146c0ce580dc79d28ab4999a9

SHA1
84539c21d8e79e487e199167c1e0da258735a93a

SHA256
d0268aeed3c277bc8a756051411d1f06522340090a822481f8940efd830a6d48

SHA512
84246362bafd770682a7a6d1b9709ce2be0cdb6c63932a86f68f8ce3a63790e40891862ee1edbf9525239689a827acd9672193b9239368573ce2c96a0d04b0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c89e30266c506ea5314fe9f843d46221

SHA1
24f0909353800d7c296b64f698bae83fa47df172

SHA256
e4a7255adb2768399a99e5da293abc2ee54f6c3df2da73d318edd66214c391d6

SHA512
ac2558d1ea6e27d23d81adaf72b48fa8a8f08986c8531cc8131fd5ff438a881d6c9a85238e6ad03621659945b57dd644f9f8f9fd3decdbeb517d1fafaa2c49f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c82869b7123091d970a1e6ba000c50c

SHA1
e73a7c53a90fcf83a07d4c93c78c7d1d666c0dfe

SHA256
f5a5c1b43000d4c025770398bf01cf70e5e6e61a0a79d2721db6ed034d7987cb

SHA512
ce116492cde12d756f6b2a75b72d97cf5e366df35cbce0fff57b86ac4a7c538e26bb30c733cfb2cf0565b91f8b0cc42035e5a07066102aa1de60ace2fa4eb1bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d07e20c4e7a5f5a5c28bb5fc5d072518

SHA1
386774c88dd03f4117c74a701f6eafa1cd3d1d54

SHA256
1f25ff655c912a84eab6eb3ba6850527e875becbdd7dfd79742e098170ec6158

SHA512
2fa6d759ec3f0c45a9aef883b3bde7d500e7ccbe494418175b353db4e43e5acac7704a95d0729c0b82b09370a4317b8c632f849a42c7df85af78f24253055f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a421606c2958d95d72654760e69329c

SHA1
3e3f8dd48961a9a3da4a4e65730cbc24ce9f6e87

SHA256
dea5cdf6b8e1d9135bfc52d23fb499fb2d1879aff18567f76ff5631f13e5b4f8

SHA512
ac7007d9adccd055a461104b7ebb16ebbf332603db7569bbffe2cafa326d16692444634dd79ab9a7ba0b031ecc12179426101560c4c2922cf8f5c0ebc3e00d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6845.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6942.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69A5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit