b92101d9965c8c61344641040c7c9485304e956690662a0164288bdff458133a

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

739de0855e0af2d4bc9143ca8a11e141_JaffaCakes118.html
Size

23KB
MD5

739de0855e0af2d4bc9143ca8a11e141
SHA1

e88024a3d35537dcbb17a201a791b22f16e5ac4b
SHA256

b92101d9965c8c61344641040c7c9485304e956690662a0164288bdff458133a
SHA512

1299bf91ba0cf0906916a76f6bf84b8f66269ee0a93eced84ea8a3cc9b420d3994e97daff0e256856c7998b9ecf28c10971bd49970ef3e15b84ee6e4f09147c1
SSDEEP

192:uWrMb5nEnWnQjxn5Q/HnQieeNnRnQOkEnt9BnQTbnZnQUCnQtcwMB+qnYnQ7tnqx:JXQ/lQbt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422841819"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E6D9801-1AEF-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28
PID 1712 wrote to memory of 3064	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\739de0855e0af2d4bc9143ca8a11e141_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46847a8f3bdc053663ef2cba4e751358

SHA1
be79c90a0a9e8608d55d1125dad6fa194bb0e74d

SHA256
e33bf60866397a85eb7b10483612aa642fb9f95e13f818311b1da6c546b2b3dc

SHA512
dfd661203dfb4129d37b024c9238d37a75afe1730895627e3a4352dc9eeb609da2baa1fe728f111991d8d4d9287843b19f8dc7fc672eb5e27f21fee1f45b99be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1f1df763906af66cc0ce5b12ce35d4

SHA1
300ab954e6e090e1f84ef0fc8da70f277e97cff2

SHA256
25ddc473aa4684ffa98663e20774092d9e643d0188bdaaa205d6aa13f5ac0a63

SHA512
c86a6a190b6e3927a06d628943c01d466ceb0688d2e29d681f5ecc6fb8bf3162097ec6359a7f0753faf238e9722afaa72f26fc610047e9e3cc475186b4af0298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
795f5197c9a5953cc68acf8fd6d755a5

SHA1
d51ffbd1d9ea4c0e5c9e9d2a7a358fb763b5d772

SHA256
b7a337f46a464bf6474e06759b9a38aaf85c33fb486dce1c18093c7fa7003bd5

SHA512
fa95a349b2bb25d381f66cb5d8508b0db7b0247c23d1c0053f52bdb27119c952fdb4084cba89112943b613345e6627000f1b140ea8bc7a005337c780456ebb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fff1b095daf9ea6c68619d992fa4118

SHA1
1ab983545c841b4782430b2cdee0d5187d22a167

SHA256
99a5f1eaecfe2cd2fbffcf8cea3e592c0b58b8a494471b7f46087a12819a51c3

SHA512
0e35f25854e39620fbda8b618f3272fd85c043d7a7010b3bb0ec89427ebfde840e7a46f967ca519c1fd9576fddaac34fac783311222c60ef86c530d0b5e3c8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c120df4aed2d148f2e85e521d4f43867

SHA1
37c7639f195de91553bc2b0018180afa7e9a2920

SHA256
adceae942e9f7d5289fa9ab639c5b736aa8c12a40337231da0352996eabe88f6

SHA512
d815d381dacf11533df5b5d84516f2151dde37d6819d926544a0283e65815ca74c13400a6b3b00566d60bb7ddde06978705517e75a8495137c17f256dd3c5a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65eb64554ebb3d8139e1eb023202ac18

SHA1
3c78b0eb41d41ad420a0650e31d2878cca807156

SHA256
ccc5eb345af4c3262fc6dbbdb801a55bbe726335f5ed8910c3e994a2563ba602

SHA512
085160ba93a4f8f1de26aa8dd1683b8a0bc55ca6372982a48cbeeeb294e688b8a92d118624ef950d614f46458f72dcfcfc3108a2d2bbb45d902716e5f395a4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdcb87c083b669167dbb487750c23c1f

SHA1
fb47f289f8758f782b3d6aab2d0cebcba907bc5f

SHA256
2a5aa430b690723f81de9e31558b84bb9e1b925b13e93f4b2382428643cf368e

SHA512
e20256f7900d3223b6237e1a9c71db727845b2f626032d8e4dd931f9daeff72b9fc939f1d0267c1f054b6333661e578b84e3ca810e517e34723e7df1d9996ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
022a623398269a373fb03acd29a6c857

SHA1
490ff4f9015ce188316d8d34cab0d2dabad1485b

SHA256
8cc655291bef0833eab2bbff52ba74e1b06722eb7275713af8063b0dab78f03c

SHA512
d3f2a8d63ff14f5e3758e9f1936928bc118aeb8532b05b07f10c2a97512f624eb2073286cfdf902b11cca540b6fb651e279829556378fa21719e66fa0d003b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
419fbc4faefa0ff0c8c14e94e2d52989

SHA1
d0e172dffaf1529ac0bc7d16b40aeaf1e5acc16f

SHA256
a58bb954a9a6f4edc7c46dca17f79df0c9247a9580d165266803ac465b968149

SHA512
300cfb714364f96cebcf7050905b950f4757f38636cb8a90f64737e17179922e2962d1c07cd13595c606a101916158959beffdcd559a5fcac22051b4b6d2f2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1383.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1464.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit