98b3a4ec659b8eea85a0d724e817bc2b143141319e7639dc67ae5701fcbc45a2

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e9031a4fb1a03bad26ff88384b131a4_JaffaCakes118.html
Size

23KB
MD5

7e9031a4fb1a03bad26ff88384b131a4
SHA1

c9aa5ce383db8e1e477ea32bdba4536e2ddff0b8
SHA256

98b3a4ec659b8eea85a0d724e817bc2b143141319e7639dc67ae5701fcbc45a2
SHA512

e148728797ff87c5908a37b3060b227ec80960e2491b9409c334dbf0a510b92b601e63d604a6510c2ec1d9331a595bb200e523e2507f4d427c08ad7a0deafbbc
SSDEEP

192:uwj9b5nrinQjxn5Q/qnQiepNnenQOkEntOonQTbntnQcGLnLnQtZqMBJqnYnQ7tj:bQ/PGmPY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B15F66A1-1D3E-11EF-9AB8-560090747152} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423095925"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1384	2824	iexplore.exe	28
PID 2824 wrote to memory of 1384	2824	iexplore.exe	28
PID 2824 wrote to memory of 1384	2824	iexplore.exe	28
PID 2824 wrote to memory of 1384	2824	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e9031a4fb1a03bad26ff88384b131a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c870c625849a45c644da56ed07e9005

SHA1
607ba5495c9100045469d31b3a853c1bf08f4880

SHA256
ebfa990c6f09efbd99814428f876c1007eacb030590f02a14283935367e79a0a

SHA512
cb11aca27f4e42fd76bf4c421bfefe3bba22381b42b37730ef896c160bd79ef7b8a2f6c57310834e9c080079d45ad6fc8072750619854e591d04310c5c8232d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d680f9722e1576d98772a62e42bde9b9

SHA1
a901a8b6fefbb364d7d41e391c91354a98b3ebed

SHA256
737375be2b9b44ebf8c10b5b28d7c77591ca1b50c28637b2bd7ad3dca876d49e

SHA512
63bb131dee0b9fcd6dce1e5d8733fa2c85561efa0c842217d8c1898615dcb4f20fb6d20665029143d860b4820664c4f6f77c9bd85f7539b670ce1b2df29f67a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f07c80796b1e78fa3d25d01f2846a7

SHA1
5658d96a200822a36a4a5577548b013b3e85a160

SHA256
0e7197079e8f66980ca06bef91f63a0a68b2eaf0853ded0cd1bdda180bfd8f65

SHA512
03256b9ab61d40425c60b2ec928b8a2a5ae3f6d78e111c8e0a9da4cdebe42a861e5393a3be1e29231e463b4b96505e4516b4c4b7942d8edb1b3fdc2194322c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da3eb533bbfc5987aa986819dc8f0ccb

SHA1
93ffb6ec63a489f625aeae062cc48024d9675c5e

SHA256
c0e8694d33147bc6bee1da420d88c62e5ea50c24fb67f30474c766504e6e75b4

SHA512
f06eaa1edf4f8de442e4baf274a7d5525de159074147c8acd2d6408959e5bbbb5668e402a99eb071f7ac795ff4a496277ab4ae6a60fc8a2bce70ab19c82d39f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f16df68103f3a76890d29ca37a0f1246

SHA1
b3679888ee173657b77aa8da72f011c9f8608b01

SHA256
a547b0eefc185d5a58b4a2a55fd7752d19f02d7e427e62f2b2850e31e32dd42d

SHA512
f711e6eb1fa6aeeaa8a25a0e77c79e98c580663392583e541bbbbdf2d42e1df972f13b746dc940412d41cb7960d233ae0f3b3dd1b26b2344d550d0cf1344e469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdb0953510a0626d8e1bce5edfd53708

SHA1
579f49f26f7cb9feef0b4c40b11568d67c6dbd4b

SHA256
461a09314ba191d4dcfdae725077dca7b1931c28dfb4ca7dbc79e6b2150bdfe2

SHA512
fcf9567d1e093e82b3d233fc2430df2e7b292bcbcccba9a85038f381ccbf2e0766799670c0bcf956be6f42055e5ef2971ef6f4b500a1e0a238d6e730e633a9ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54d77ed37f27174606f4cad1bf2a23e6

SHA1
903ceab637e4528f3ff403bf3a5e71732884faef

SHA256
c3903084eed5842dd3654568fb2c92250a2d0930bcd371eb8f853109ba11f3f0

SHA512
7d79c221cd6977751c4b20de19f37b73b85a380794f45a946789a0da626ee25132ea62d822135802e7bb5ead0e48a5f1183df8c5c8bfb81f23368c8e0d7ae1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64b9b0e8cdd9dad17abc8c8dcc569db9

SHA1
d6262c0995b5575b9a761f9132eea8fab7bba9ca

SHA256
4014e4d51ea2754f69c35727608b9512db843d8e5b1a8bcb06318d698429741d

SHA512
dc2d75f8cf061592f66291cbdfa6f7c303e50987f477da2f7da45251d0ac403c3fd7c0888017cc5f996fa986e8bad0310b525df76ee5cc0aa1e768b447addd0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
900edc8bbc8038d251f7cf1efed9a525

SHA1
9d51482cfc2a914860c0dba24e04321d8756027a

SHA256
c2575ecaad65954ccbfb55cfc5e3f5b692b50f9ff16333366dc3e732947d7e49

SHA512
b6999d308e558c4d2cae797e61e8f8a05b0304406f72b15b2dd7c288eab10acd4620a20b0beb6ef9d937483a8f8a1b4c09a886fa3dfa9105ce6d39c061b22c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1075.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1169.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit