645f01a294a2897a7c750b8aac4162ba0c2dfdc2abc2e73883242f48fc7f18a8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88f342d7e54266fea3d650513226edef_JaffaCakes118.html
Size

29KB
MD5

88f342d7e54266fea3d650513226edef
SHA1

c564d608b4cc9784e3b03a539d1863e6b4328767
SHA256

645f01a294a2897a7c750b8aac4162ba0c2dfdc2abc2e73883242f48fc7f18a8
SHA512

055eee4d31b1bf5a622a80ed544fee0b77e318f4d8785bed8b435776f902a9d33344ec0c22265f2d710afbcd86640e0917b1626af1f58aa17c7b9a02593f9177
SSDEEP

768:SkVfsvqC5Xtfm4xR9YpIj6FNxaIN60SiBsx:SkVfsvqCOiepfM0SMsx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84C01591-1FB4-11EF-ACD5-DECBF2EBC4E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423366434"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
992	iexplore.exe
992	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2252	992	iexplore.exe	28
PID 992 wrote to memory of 2252	992	iexplore.exe	28
PID 992 wrote to memory of 2252	992	iexplore.exe	28
PID 992 wrote to memory of 2252	992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88f342d7e54266fea3d650513226edef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41accb0633eb6ed3599d29b47d7db17b

SHA1
46031fd3380b1b87d7087f30a736e46bbb6748ee

SHA256
00dbef6789d0e02123cc56869680566d9881f07c06af96a462dcaa1cac1a4ebd

SHA512
d81c5af7d4149e314ea281ce740a6c7256bd698618499b8b79ed13cf2285f10542ec3b1dee2a924147d91d1860ae8536e18134066055db03c1dd80a02d36bc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
496b3a7fc63b38ae85c4217ad6d36ff6

SHA1
de3b5f57ce53b5b9cd8f9119e683dfd3942cdab4

SHA256
abbbf173a01b112022d0eb99dffa16f47e7e95a71414f69a456d6da8ba33a300

SHA512
5c5f8b56de9fba488961483ec79f636f22aad67ba26d2f53381218be61b2fc05707346a3a2340fe61094af6afb5797f536c6946b22d3f464b2293468b58aae5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4cf9f252ef72585f45ca61c6a0c5371

SHA1
e737b4d4765a701ada8aa10abd7a52b6bee97e30

SHA256
3af22c553377e35c6259ea0bf861293796d1b0e2f6a292456309de5ace2fe845

SHA512
b87d3143838ca83d8f5dfaabacc2b1e4274e19ab732ba5ad4b8ff50f18caf701f31f0e7b6ba5b2ffb93363a7eb3a33fdbf39546016f3ce068660902f5a697dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf43ff31265f63a44096520bd27c7c9

SHA1
a8eff2ae981d73fac1003fb5c27dcee856537dd5

SHA256
65a801226a21b59a4efb5b69fcadcee3c826b4181647cfd9fd639a207d59e8bd

SHA512
03575208d2ff996d6cd0baf70ee9e6412909225f5e1ada568fbc7fe0ea552aceab87b0d5e849acdcf0e8495df1182e8c040bae41a1863d5f5035d1036bf5909a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
688006b84ac5c784955c7d1d9a8529ce

SHA1
b8be07f60dfdb709bf276a496dce3ba9d885d5c1

SHA256
3cb97cc20a1cbcb5ba9313caae5e3b57f469f55159c2ec173efe5731ce64fd4f

SHA512
d7f55d58dc440493a64cb69bfc06604dd5f4a9e17a2845f0f836929e32bea3f331f5c4bc7aff445d52765c219e47a4e1dce4998cb105c4fba26968e8c56847de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d292a6d6e023ac3845c84d38d84e863

SHA1
49d87939fc8082d9385e1c5978af646a07cccc0b

SHA256
709d94118e11792cb6e54107afecd001c1983464f42a34cd1946ff3e5b28fc41

SHA512
cd63d779d3fae63c55e935219471f32c74485ffe345741b0da727f622900de4fa569de1958d0e81de6af61085f1c89a5c50e6bea491ef8e49735797ffa2d5afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d401caaa5ddc600469d3049f5926941c

SHA1
0f91e429eade01e55c0096e07ac9c0fe984025e0

SHA256
2d7dfc86be6546fb07476a2d7bc5f68d0d5e93b7b8477ded241dcfe7bff41469

SHA512
8a708b7a08fd741c54beb5cdec8712812bd50b8d61fed0eb7615962760b01e817e2dce880053d80dbb881e7ec5af60c024112b8c013d35da24a12d455eb24552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46087790ed7d2da45a2e6da523b2180d

SHA1
8351d773c49a3b798e4e03ec183878f5cbca6e53

SHA256
298845a04dc520d8b683adadc489357e25ce2dfc1e9e1c071280958db03f8b26

SHA512
444173cc3895ac0543a27bb47736eabdfd8718a3372386e8e0c4462e711e3563240c86460a0ef92d0d6bccbc3c3a045e2ccf7b2d3838a429050b194ca431995c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
359938f0864485cba427ec71a4f4bfae

SHA1
0c579eb95d3b3064b6d05f5976475858789a59cf

SHA256
c53a0f8c071a1ada5947fefa746d8354e5adb22ff0e1bef8dfcd31e2f01c458a

SHA512
a4cfffd31c66c4eecfb410d9efc9e7fa306ecdd46bce0d56a817b2a64a2dc84f8d505da597eae8b56ceccec877c3b9da3f663020eebc5b18d7396b1470815fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a3610394947eba8669926d2477e42c

SHA1
8023d08a3d84900ee2892a362ad04687b72a9ebe

SHA256
ca7e2d0ace76cee8c797ed21f5f6c8200de1db051883aea6e480622ac110ad8e

SHA512
a487b56f646fe5a064992fea58a2715ca50e7c7393bda6f1e3fb03927328ce8ce0168b1631c72f702983fa5ad9eb3bde83d8526c0d8c3d905f1e7a249898f635

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A56.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit