f77cb8728586af4b2b80ca49b71ddc7488778ef80bf89f2a935142392b50b5b4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89971beac29a8f56dd5290e6e197fa5c_JaffaCakes118.html
Size

27KB
MD5

89971beac29a8f56dd5290e6e197fa5c
SHA1

80a1b393a8aed7f3a49bf2d300e925c25c2e1cd3
SHA256

f77cb8728586af4b2b80ca49b71ddc7488778ef80bf89f2a935142392b50b5b4
SHA512

0ca6405980eec9681be3fd66ba95cc06bc8a1f86f49d435474c1ed15979021f6d28465519905737cb37ac60603cd4a498a7c9f780f63ffba5651f6eb97b3c7be
SSDEEP

192:uwD0b5n9W3nQjxn5Q/8nQiefNnHnQOkEntMmnQTbnNnQ9eHjm6u/p7Ql7MB/qnYa:0Q/riFOpCStmJf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04F45441-1FDF-11EF-A3F8-62949D229D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423384687"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2116	1992	iexplore.exe	28
PID 1992 wrote to memory of 2116	1992	iexplore.exe	28
PID 1992 wrote to memory of 2116	1992	iexplore.exe	28
PID 1992 wrote to memory of 2116	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89971beac29a8f56dd5290e6e197fa5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38ad577b391a37819032f1efd7948a46

SHA1
60491f8c007bc78e43b8615e6df124f4987ff967

SHA256
6c53d1616c7e05a9cb9c05e5450055c7ee7f7182f644901ae6d29f35799984f9

SHA512
d015973e2c3f8734e57bf95d6a2b6e6d32fb8ac18f127c4deeda37cc35b2463ae5ccb6d9e17c8dada0a58c82a85bc539f5b50267ba35920f57a148f5f949a2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9a907ea622c8e41c495862a10078c64

SHA1
66798b1f918fecf708e68a298fefb972a52c40a4

SHA256
1f0d17152630030e61b0a8fcbca13e6912e4406416ccae9ff40137e814ccc139

SHA512
c080229bf31df71519bed42aed0f53ff8c5c651bd27de7e1b473a989f32d1c187f17d77cce10b7b6f30699077abe7c221814c41408eaad24b8235cea86638fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43ab1f0946da9fe865528da5f135f67f

SHA1
cb2d07cdbf07a5dc2ba7fc0a2eb40a99242e7c80

SHA256
a0526b2a666442bc8be2d533b37575ddd5d75dce8de836942b147e89eab5539b

SHA512
b5508d3b8c02780ccaeedd21c58767703e1e774fbfd3f677f9ff2533d5ff85527c098ee3ef23d2af7c715647d4f232c5550137f63f14b7588059cf07dcc9e6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9f4bb8059964def9411d48a4bf82b17

SHA1
63f512e81529c04203c5ec4dfcab70c752b1a03f

SHA256
c7d13d734b80ecb6503c9086b21e8d1fafba00f8ce326ead1246c79783550386

SHA512
a4dc9fdceecaf35d817037df01a9da960a6441e41beab8cbac23ea5caf7e2bcfea135f78c0db1c3b188c8effc02606658a4a0d4cdfb6a0374fea5fde7c6ef601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12ce29327503960d423f338adc93cd4e

SHA1
e48f67ca81f18f0e83e172e5026cb618f27f6e0c

SHA256
e621448a661ac59d21d27e565d3ec3fdd22a83ac453918e1372daba05f36a40f

SHA512
9a96e957266799a90b49d7f41d87ddd623300ca5cc41468f8736afd933f2a1e78f7dbb01c56e8eab7e659576f07a894ac36deede64ee3b9eedc85912013cf0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abce20d225fcec91699879df5eaa6196

SHA1
ef7feb73bccf36550a248ae664ae842072194485

SHA256
93e01d5a2804eb92586a4d4140d732568fc1be9caa1d0742b9d814a6c985d77e

SHA512
7d88d58326bacb6a761eddecadd9a192fe6b307d6f5692438c26b6ffcc59c4bc4e95ae9b415884ddae631ac665f91f7bdb7f6e09edc9fd371e6f5b130034c4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
828f86331f96d36d13460dedb99c39e5

SHA1
962894389061527b17705a171f4538d4c6e8e195

SHA256
fdb9770f432dd9d4a3c2ce255b063a858a0a8ed091a16c39c692ed9843cc9dad

SHA512
1320ce222cc0e962ab442b8d15b3ef15ce4e5d58298b152724cd447febccca06babaa392881f9b7cdabbbaa690f3e791015ce54f85048b550d17193469947da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac9987984fa451e5b6bd46e04c369b60

SHA1
f573db99182ab5226b5373aa68a5f49eb42c37ed

SHA256
3c757696375e56419ab1cdc53c77dd2ab9c9a312aea53fd26b97410f96390f71

SHA512
6ba976aa513335ed29b3d08e82487b9be881dcfaa0fcdaa08f1340ea29a504c75ab4f3b5b66f87ee14dfbb79d1b495f01e879bd6b34c53d63bb84c1f81d29ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit