a96a924bb947fbfe922124952baff4089f81164c3773fd97e60e3e46809cba12

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88c4922918de0b78ac54cad7608d1da7_JaffaCakes118.html
Size

28KB
MD5

88c4922918de0b78ac54cad7608d1da7
SHA1

b5621ef42646bec18dbd0c9ceef2b3bff2cc8e0e
SHA256

a96a924bb947fbfe922124952baff4089f81164c3773fd97e60e3e46809cba12
SHA512

1f33339702c5c205a57d10895a32a659bd544e4cbe12d3c85de8ce64b49aed4b1613844b98a62349e4e279c0165e6a3ec98856bce943c5d743c84ffc26ae3a9a
SSDEEP

192:uwjkb5nJOPsnQjxn5Q/xnQie8NnUnQOkEnt/DnQTbnRnQ9eaAm6/V6SDLQl7MBcN:tQ/gv4N6SuS0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423361207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A6CCFB1-1FA8-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2168	3008	iexplore.exe	28
PID 3008 wrote to memory of 2168	3008	iexplore.exe	28
PID 3008 wrote to memory of 2168	3008	iexplore.exe	28
PID 3008 wrote to memory of 2168	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88c4922918de0b78ac54cad7608d1da7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5891659057e0eb0d7d033452b334c50a

SHA1
f1bd503588002aacadb338687afd80cf2428ad45

SHA256
d0938e7eb77f67f99f4c329710ebe378491feb5fe6910580c61faac1c91d3293

SHA512
e175baf9c113ff49c5b8de84b427c2b5a47a43faad1ea8c0ecc1f42f74cce2269a88875b1a295d5db58d285d1df35493ad2ec052d11c9104db64c858ab3e6a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0989d2874184b43a0a1f7cfe9c68b10

SHA1
bfb11d120b1ca9241253cb394f6a1442d2f0ab0c

SHA256
b42796b7822ba054bd7611108e063436b3020ce489709131b3db7ee78421e017

SHA512
110fd50f32c799a9e972b6d55e2ba4ab8b99fb2bdd2336dd9413da75f61cabe41ab4c99267e25d7f133470417baad4ae541d809b06a7c7a555a9cc8b88cddb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b580506b65de4f498e811618d47e61

SHA1
d3ec7fa7f0ae9ac6f5c1166beb3c08a4e734c91d

SHA256
23f581bbdf05bc9f5b497821e1fa5693ccdff3d5a15779508ea20aeac6537057

SHA512
1339cfc5e36409e6b75a9db934fbc5b5ab02b5d45fa8504f33f75dd2bed77b0dccb92258d76fe6495d10ca954e5b30b804de64cd1305e86859ac640f2140f50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4a1ed404790e109e136503830d3df10

SHA1
812854d5054878123c44affc6fa1af1a25be4ebd

SHA256
2a4fc5309c7ba60beeabc12d96c5ef52c97aee56382b313f22b93040470b38a5

SHA512
03e0d4ce26172dba7c71b8696f138baf5204a04eafb06c4eaa06a8db80c1064576fba48854782804bfe06e11a3f90e633a1a85dcbdc5a71c974e070c224fc7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85f5a621f551593ba522df2a8825d1ad

SHA1
f7b4d70dbba717c38569b9be2e9d9996f19e9ce4

SHA256
d926703e3ce6b498c8e2d30245ed6d9e7e18182acb2c4da80930758965064e98

SHA512
85f183be3424b7deb77c626b0d91b451d0988a2945c43b8dc768bf4095aefa78d78ae2ba35f17a78f345d27dbc8442375ffd00332c292e7eff5cfd5ee30d6642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47a1da1c8364ebb50ff90527e4a045c7

SHA1
9e14522ecc4e4582b8da30176a75163d23dce570

SHA256
9e7f227f2bd5412b91c4b48e41ed51479cda7870a212453096d93d53b9145897

SHA512
cd710b97accaeddbdb5e5e2c9d5dde86de7ae09a1fcb7a1cfc987e0ed8edf442ba1dc468fc0ec012428b4336ea6bd0152d02c9502e900c752ed614e8f3b4966c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b73749f6783680fadad8552e3a278365

SHA1
6f8b5ab0c94266984cc2dd05c1e1add575ff2aaf

SHA256
51624d2561ba611035ab507ae4687152fc8ff305071d4de701f15f7a66f9112a

SHA512
fe6abab198dbbc80455c80db37b7ce2e53df9ae6b46c792feeee3d27ccddebe89e3b4a34ed6e2d6a81c8c8f3f6388fb5009c130305180c4a6fafd29a64213b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b09d2ea1c08f5eec686ae22f032ff2e

SHA1
6fc5f8e7959e2478a9406e9ab646c00f7767a805

SHA256
7b25fb095a202a25961d854fe2136c65f12a8ea784e6455763610baea0a75568

SHA512
d44cb1d2d60552748af2cf6bff1f794e093a1db4bcd91f10d06878d1ba80566f53bd6bd8c1724b9568efd40426871f728df8e030f44d352318e97ae459a509b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31f247b9fe9e2c645fa911bcc0b486d6

SHA1
2e913f95f3ab9e02203cc598a2ba22bdfef89e75

SHA256
918d2f01f8a42137ec678ef06c38d2cbb06d2d898bd99b497f828b157e410eea

SHA512
35d22ccef628f3dd3124996666dfe18c16bc50218198885f4fdd24df8e4a1d8c42b1ace609944648c4a9d26525b7da40eb57035bbe7a8ffb0ae91ae0b2ebfd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e795c4abed0b5c79d287c139e9e098d

SHA1
310bb1ae11ae08e206b099b8c226a0d337877c96

SHA256
472df474632b3713ced08e04a5b4675f51fd58d8fb304f90bfb62efc2a67b0fe

SHA512
05fa63a1020a4eaeedd93cb1c87d82abc57431d43bbcf114e49adea8297cb345c6ee4d49bebde02099660d0e495dcf0315d1d2f4cf1cbdffda0d81fd9d795a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2696.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2728.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit