a233895efdf95a27c1353ad4db3bbf9ba4e3c3e023c588759172e6184608f2de

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89fbda3760be4efebccc5dc658288d1e_JaffaCakes118.html
Size

27KB
MD5

89fbda3760be4efebccc5dc658288d1e
SHA1

7278e7a53ca8a6d39ff9c25f91e1c9d62ec530e1
SHA256

a233895efdf95a27c1353ad4db3bbf9ba4e3c3e023c588759172e6184608f2de
SHA512

0ca55586ab923a39f752b34316dc23f5c2bbdef9f02325f33daa0cde4267f38b1faea5e9180634438c2bc04df00e18d091a4ca4cc1afbc889cfaa8f9be44454a
SSDEEP

192:uwzkb5nDSnQjxn5Q/qnQieZNn2bknQOkEntyknQTbnlnQ9e5Bm60bbFQl7MB5qni:6Q/YbwYrwbESPAq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423394753"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74CE4DE1-1FF6-11EF-83C2-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2532	2232	iexplore.exe	28
PID 2232 wrote to memory of 2532	2232	iexplore.exe	28
PID 2232 wrote to memory of 2532	2232	iexplore.exe	28
PID 2232 wrote to memory of 2532	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89fbda3760be4efebccc5dc658288d1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f38ace03a019012e3d0006db2be5c2d2

SHA1
8a13a0b05d8e35e393253c1a13a9eceee0ae0f6d

SHA256
28cecb79c4b9102e5f9c773daccaadf769779618f6f0e049b6c22430f3108634

SHA512
219b5db1d5a2952bc6439da3a11510c26a89d0d3e46abe2089d26e8d1a4f64ecafd641bd2907728d780f28a9b4dcb69d5455564bb402dd4e8f3ae1c0d1c8750c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c9c1111a7cd5433650d9414867ab3ad

SHA1
6a85d919a2d7e83bd4d88e5ae853525a46603e94

SHA256
8e134a8fa7443ce2901a7da7ecc41813baeca0fd49655bff349bf64b7cbe57b5

SHA512
f8a46b723599dfd1fc51f7966ab266159550355d981ab8d8eb1d0d03e8346fbf6890f9b0212deac246b541eba17d1be0716f55c0db6e92bee674da860a2077a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a1c40f2ed60b4ae04a97b8c78fa8311

SHA1
8e0d909ac3a903bfa5a5618e8db56dc49c093d12

SHA256
7ef011f6e59fa2f70ae94221121250d4f2d0020e98e840ab42778495229f882f

SHA512
686670e07cc293970a5b0d344ec0eacce7803e731bfbd057a06ea60ed0b72fc2a29b03d3f018726c57e6f6ffd0394aac9bca20ff3519bbfc2e4d14223490e4fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167459009bb7eebe9fd9ce6b8693bf9e

SHA1
170475f28ad242b254a9e6e7cc0bf41b409753ce

SHA256
aedcedd7adc05bd859d887052a7560de9cce378c505a7ca73f42a34bd3e0fe03

SHA512
b5e76f56cbb4e0a708500b3c32b5bf1554862a7572262511d6126099a62edf7637e0f4d58d1df923914b99401368fabdc463171e00e508f75b1e30804bd9ec34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bc12280fd7b84572caf3d727a43bb26

SHA1
8c76a464be78f71e40e42701cf1f3f73e9c86252

SHA256
a116f863981194849fefc360875d205ab0f70afce5cc88b8495212a9093ebdb6

SHA512
9a25523998c9bad253037eb441fe738f15c242f5eacb894e0581327b229dec0d69ae13b0918553bc8d78eb6ebb5bdd784e934d113ced52c35a4dae87e119a4cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b43a4b980d172ad17db224252e342e

SHA1
4d0bb5a190b0ea0871bbabb64710a82ca7e14866

SHA256
84168d43a7162322163f7e054d0f44fc4efb50e2adc284453232682c0fd6f296

SHA512
60359568d020248f7198e0f70c8936407f33f0dc4dd710918ab5379b9bdd4a3dd3509c8430f8ebb461891c9be2ff6361c23d6b77d6cad4c917e980513ba44bac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59c6dc81e946fb2b4eaac6a0f43548bc

SHA1
b0e77bc006b7fa5d694dc986fb6749ab71368f86

SHA256
156e48da1576c23e0064128a3bfb936f81c50e15510568ce223df05ff2b1db90

SHA512
86ff20311b9b42c9ed3dbb945a4eab783353e481ceddc6165c307713daf214ceef5dd31522843b7ae190f1f2426a184f00e1008cbff0a3387deff4653b6d1f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84acb52f59101ff16bd989db8bd033cf

SHA1
0ea92b47c3cfc2743527cd2e4227f9a0be4c42f6

SHA256
b549d47cae255c7239eb1b42b6dcb959863f28eaac86c3334a082e8b0e91e821

SHA512
0593484454b843f9a526c4ff26dad50f3b357bf4590a13a1adf694269b7f91f86e410337c5cc4d61e19f1c441d0d88958b8910b1a787a8e7013faaf9b6613b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5649f163d022ac12a525fcb601f4f41

SHA1
83cee963b93a409703407274f5a0240ecd6cbcac

SHA256
83e1c9fca8c99aa686b879f7b16e5f50faf7092c759c724c638f0b7fe67f5461

SHA512
e7fccfb0172ff665a84f0230fdb84358cb8c91069cbc962341c3692643abfb463ce25c5d22fb9274ed6d0bae3839d3beb56dcdf94ce7b303879ca7cfd44fabd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DB0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E80.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit