23ec25d22fefee9037e070e3357dd5c7d83973cba6bd4575a0f7a87f267a5ce2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89ed85dfd5b057009581ad6a2cffb874_JaffaCakes118.html
Size

37KB
MD5

89ed85dfd5b057009581ad6a2cffb874
SHA1

7a3aa5cebe51621e4b0b5f211196b5dac13f2ea9
SHA256

23ec25d22fefee9037e070e3357dd5c7d83973cba6bd4575a0f7a87f267a5ce2
SHA512

764b119d9e0c6dadfe331cf48221fba9e8a1c5f4de65f8c60fb3f759b2a37961aaaa7fe0382cf49c19848dd703679af68dbbcd06bf27f1bd815df5691f6d9688
SSDEEP

384:3Q/CPL0zLmZCv+2H6uV/OOhXKkCnz96ROmw:mLmZC5KkCnR6RW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B86AED41-1FF3-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423393578"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28
PID 2164 wrote to memory of 3060	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89ed85dfd5b057009581ad6a2cffb874_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
182b60303bab2e630be05a0d49b5bcd0

SHA1
23c61ecbecaa97b0e3a90788836aff67fda2b4e9

SHA256
4ab05449a439535be08e706e71ee1b4f187aad19f1f8ee3df672e8656418e05f

SHA512
5bcf2334aecf8ca1cc547780ff60d77d83ca799d17711e76bac1fc5cf7929cda3a0481c0fb98ef3818204f8111ccc06b253892afca3cba4b3298b1ffea39bf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65cc86f94ea073c9a8602ea1d28dd9ca

SHA1
932ec4d4b5acbb06375f4eb429b1e512fc6a55f1

SHA256
870bd60656e39bb407edc41eee716f253446f466b7116b1158c98c035195b0cd

SHA512
f07fa3db468c250734344ab3bd68d3ed1a29bf9e33ca247b066fd03c860d10b084217224c4d8c63190a7dd056b7131e015fb9aedc9729269529b31045b4e4606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00dbbcfc78781965dc96df600e4eaaee

SHA1
7f0f4f17f562976521201eb09821f24095decf0c

SHA256
180ded99f8f806b034617d5d20e544d4d9d6c4a5bb9f423682ccedb2be521fd4

SHA512
48c954f93f6bb4d196818ac30f766111cc409e6c5e4ca6830cf2a46d4ed0c19ec81477115511a57ffad3a8692b51f7d9ace820ee33a21ba2dba734256455c928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5546cb92bbd0466521b32bd01a5ff75

SHA1
072f9296b94945bad20ea496b947e3185b3f8517

SHA256
a288956efefca50e0c549d6a9d817d25a7d60bbb63c41cf20cbdf7120c8046fd

SHA512
120aeaf09a0603b3ce29d31dbdf5ddaecfe9ca86a913bca2bc27033f1445fb76f49d33a2aabdd3f364d08c88abf303796e955ede3c855e33b6fc299747e921b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e51f79d4f5b30e4bb7220a10e6501f45

SHA1
9433a32c1b5097a0f9f6d3dc9dff610786b1cae3

SHA256
f83101bf09ae03792bdf138d89421767eea529af70fb61d5879c8b23343833fe

SHA512
5c68cfd603ea78608cfc941eb6ccdb229b34ccba613857b910cee33b241c34040bd8f7d4a53df07b931b490256b1d9b37e1d601cf5445d2d1bce728207bd6997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
905521cbb9c402c6a9e8e18b531c7071

SHA1
251c8d7e816e9a73da9c18d71603b3b3d6c17fd2

SHA256
48d54a08aeca303b2f3f6ec2174a0a156257bc9b82078720e9568d9da5e874d3

SHA512
2ed1689194e3c3dbe7140b909712ca3ec7f2ec912b2a6dc95c43f6aed933e35cea1fb8ab3e0429329b7f13129fc7fc2e18dae9d3c0b11ffa4d82f538fa499247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c75e1486729f069a469c77eddb52525

SHA1
2fa5b7693574c7add90e543cc023e65e2a0b4ca7

SHA256
49e3fb7ceeb5431def94276e5935a4f10b00bd098b6ddf8ec30fbc73423d8c47

SHA512
4787abf2ee1ede1875b86152072c0000f1570583cc35b276b1f316963c417d755a50e205b0f7c4fde8b4075c6131fc14078413831051775645da070a0a0b83a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e3dff15928794bb1ce2cb8c69be38a2

SHA1
080c9af1868f98d3866d4ea3a6c22ee9d9a1fddf

SHA256
bc50f025e34d8ddb0ba44ff280c9a00708ca92b750d6be3c8e1a44c7778e6c1f

SHA512
4dab6897854a2151376c9c72b2a2bfb91bfd3450d366d5d052a6621af6623ca42292f1d07f3a947abb2a80491b37b2432387364c5b26d2d6491c5998edc8257b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8dd2707fadf1b5bd503191a2ea9893e

SHA1
ae494ccc88afd5d4c4de10561666231ebccea5fa

SHA256
7b4a7ee376f8f139d0b444a27941b64eddf6efbb9921ac4d7c5fb9a9b58c18b3

SHA512
5dc88f1e31ea48e0e4568bfb8156c60b29a6db2c1c72e5406bf880691e2293a24172d3cb1f824f29a9f7c0477659f8b046132b602542658a2bfcdcd503b8df88

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit