5207ca2c2139520ddefabe40d4361bc9610f79d71c76368b82e520c13020286e

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88e5377f035aa428d41a10d71714b5a3_JaffaCakes118.html
Size

31KB
MD5

88e5377f035aa428d41a10d71714b5a3
SHA1

16760f701ee785a039cd7d4b081624a9619317b0
SHA256

5207ca2c2139520ddefabe40d4361bc9610f79d71c76368b82e520c13020286e
SHA512

267dc6cc9a1ae086fdfbcf6475393da5b3aa2ae42cd59e7aac45c6028762c806556b4ff43aa2ddb63fd593798072109ca4e13b20b359c7698b17104f92b559d6
SSDEEP

768:mave2TvLbPXX9zTTE4lz1u2W/bT1jWSWoqREMK2QWKXix+O6bSdw9fcdcMkAl1z8:maPTE4lHCbT1jqoqREMK2QWKXix+O6bj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82F116F1-1FB0-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423364712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1756	3020	iexplore.exe	28
PID 3020 wrote to memory of 1756	3020	iexplore.exe	28
PID 3020 wrote to memory of 1756	3020	iexplore.exe	28
PID 3020 wrote to memory of 1756	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88e5377f035aa428d41a10d71714b5a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a6f377b0fa8489b68ae13573139b128

SHA1
b7560e8ecc6948f704d2096a36e0e3748cb5aba7

SHA256
4c307f13c51d8f977d1433e89d32e3c62e73cdf87c7e1e9ab511ab77a7d48bff

SHA512
16d63f2cd579d2ae8c2b24f3c6e5805772d7a3d61f08cfce90da7edd7f0b1cdd63e5fc8330fb94e6a7f010acc3f4b8fde5bbb7c29489e71148b3f463298a8ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8a4a262acb38b96985da65492e52736

SHA1
6e982e47c6f1938784a4bf852d2c7f8f3eaa8a09

SHA256
4fcf9f8cc5d14b4f241493d3551b3afa5fa86037a253a998f263e12b37d58235

SHA512
e719cc222be0fd0b9f2c07a652886a6d40647aa765a9ae82f97cc35b61d2154e9a93076cd02a84669480a64457da7e38f1363ee84e8ac9e91c09529d6bb0aba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d920695e57d2b7f8018ce35a3e92d2

SHA1
d37ba6897fedd3fed7bdf2b851b7b74b64eff9f8

SHA256
d7863b4d4fd69c034adee24d928c91752aea9d5cd38c278b7e655094d1863de1

SHA512
60fd8e4de19f15753ad5a244929139f601522d42b7b6cdadc1ea4f09a8eef68d531c692b3e70393fc15b894bcc4bdf1012138f2ad78ddb98a2cbb9456b7da1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed62c424fa2cea68af044d5a027402dd

SHA1
431cdbb9175ad4973471785de62da2e2d4883ec5

SHA256
d98f048992e142ca955f49f309a27b5105a5239b4f6a21bcedce180fbadbe1e7

SHA512
30acc70b9af537fcdd717eb76b7942cf03ebf2571818f54c2e41aa88d1099a3a04f74cb942f95c489f9d627093f33e6112ccd9d0ec6c910260b388cd9e5d1c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bb22b31fdd8fad2e32c03f44c57d580

SHA1
ba44ca80266e7a713d0f1f92e627eaa16cafa60b

SHA256
db175ee37ce3fd4217328efbdfc5a1ca2d00be35a57cc619bc8c0610424a9f33

SHA512
4e21a2f7e692a0d8b8e04ad862287037cd9fabf5887f85ed47677c58ae4b8c04f977f4ec5c397c1fbee9ad9c90f169abde6d6774757ffd0b25b5b9ca208721f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c63784067201421fa59e4a0f3e651d1a

SHA1
5c611cf4e168cbdb856300310284ed9bc3c788cb

SHA256
fb6060e2652ed703cc184ed428abd80079865f14ca1b56515442a95e85d30b27

SHA512
0d1b73b71272916201785ca19329445ffb7ae23f458b6eb65d8473eb864596243dacaf574acf8bf1610962f159cc2010445ace9e35989f4a7818da42b1af1f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840a7ecf75f4b1a310e9f67f2abb8289

SHA1
8495996369e2761db5ecd446654c0bc308ed1c2f

SHA256
9add0f100f5e4d277e9efb30150e6648ceb36050f1b473364e88b36fd0474d07

SHA512
1f11876b72f1e59ee0c9b6175a38b9945688728930da505279c0ae21127587d18186247e77b8da36b76d61f2eac8bc3c8c954b8ac1131c46f198476107296c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3677df1b5e63556082855b8b03d4d0

SHA1
14fb0b6a0737cf59a35c5452b45c72ade333e155

SHA256
8f4d702ae871de37270d583b43daeb5a6607ed951f4db8e6618412244b7142a6

SHA512
76a9e79ee517f0cae984b9c9e0f5a4ab836ae73bfc67dd76854543afa90af3fb0272676a04360a388d4c48869a4b8e3d981da259097d9687fb1e0dd3b5fd3c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77003b46a657eb87b9290c5d3699e4db

SHA1
49998b43c2ebf6f99e23d36ba245fb818a134e13

SHA256
402be0bfbe5fc68ae59bd928c090992f6d250d3c0de2a8efb7a606e4f8a633ec

SHA512
54a0004ba08777dbf032eefaf054cb354e8186d4498d4fa0afe14bfe7303bdc2fda20ed3ada5c50f44985c78c030eecaa66c01404ac4685329bf3e05ba88dcbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebb0900de58d600fd967fc9305f2be2

SHA1
9d665e1f99818aad7d25f4c3e15e8faf3204bf24

SHA256
40477ee4abc6ba67256f2f14391fe444fef7787c468a07fd677ea15ec5cab16c

SHA512
13f69e5d4353b69b4dc1a841aeca5900c1bb282f97368abe66f4874e0a7b377cc3feb8019497874bd4ce009191c69f0e41e0e2379891af7be9a6d8ae8cc06de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
cec85ba6c48a50be363e2347f48a3d77

SHA1
9529495aa0e3b56b71573cfea0145aa3585e11d7

SHA256
5be4fb7243b8cc9d24db85e886c383ffb53d3b6186b03be17cca547053a109b8

SHA512
2ba33314882f7cb58de79c535a55f2000a71c752148444a1a2e6044c28cb285027f513c841e0d572f571c50e04620b2db9b4ef1003daea9e77bd844a6089d035

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit