d8ce3e059c482628a7c6056807058735961fdac355a89576c6d7be3c13be3b3c

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89f56d90bf12896ff24b906b63751f1a_JaffaCakes118.html
Size

18KB
MD5

89f56d90bf12896ff24b906b63751f1a
SHA1

450ffc1d9e4634efea8c9818c55e67e84707985b
SHA256

d8ce3e059c482628a7c6056807058735961fdac355a89576c6d7be3c13be3b3c
SHA512

a249a4670b0a328e17bf97e067108aa1657f5fd1f9eff514aa6428caa9cef5477a6caa39bc81ad0ea45fcc61a1b09425cc26f88c9ed40d3666516bffb2cd4c30
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI+4ozUnjBhsm82qDB8:SIMd0I5nvHXsvslxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60D1B761-1FF5-11EF-9BF1-5630532AF2EE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423394290"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1616	iexplore.exe
1616	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2080	1616	iexplore.exe	29
PID 1616 wrote to memory of 2080	1616	iexplore.exe	29
PID 1616 wrote to memory of 2080	1616	iexplore.exe	29
PID 1616 wrote to memory of 2080	1616	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89f56d90bf12896ff24b906b63751f1a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29151d88e9a84ded772242f1ceec167b

SHA1
00f0adb1e02f2acccaaff4a536a5266834ab0c02

SHA256
396a8e7b6a90413ed27224bcad7a8c45a375db8b8e6267d118c8863592ade4b3

SHA512
7b6250ab11b61bb35574f585a9d4e9039e4a56ac7397c7523c1b7e840d761e0384f6c400ea38b042ce6df365e0ef434a54abe0d0981f00c47b56f3f61806667a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa25a35c635824f6441d09eed252573

SHA1
d19ab7e2729240401584bf83bad76ecc4a0c946f

SHA256
c62bbddd3e9e672b3d14507dd6b3ea21768692674d8315be9dce5bf01afba7df

SHA512
fcfb97051c5ed3ec688090cc1c9754c2b817a41306509f4f884b6369efca4645388ff5d8e602e649f76e28485103d61f1cf6d519385f08113cc9c4a9e25c2bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a88c67668a0ac71e378d9fa944758dd

SHA1
964ae6b0fb10133c37365641b69a2fc579cfd3a3

SHA256
8114a3b09038abe7c43fa25a8d8d6a88cb4dd6dd2212910b5208c6913160f2d0

SHA512
b266324111ab686e5dbf00699571ffc88c766084e237a82bf0db414faddf4efe645c92ffc5cf6b5e1f54e29c4542a7b77618ef407d86c3d4c3cb446196cefdd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f04315cf9fabebbf001ff64b81eacd

SHA1
bc892e330fadeece61169b03ed5a721a4f1cc2a2

SHA256
6438ad42902ce5eb94085c0a9ab6c7b85fe77a72bb1a71d3fa1ccef0d3c625bb

SHA512
ad037866e7a4b326a0a4c554c1e1ac50136bac1c7dc53a556681b9a08df0afec76f981a1cee5fb54757dc340179dea16d07519a5b5fa9ae2c5efeadba2bd5895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e753c13fda18c873a357a45cfed159

SHA1
84fe2a0c6990cffdf01fb9b451312fa1693b4feb

SHA256
fbfe9f8ffdc11a24bd417895ee1be39de190b09b355ee3be8201c5dcc7b9dc2c

SHA512
bd0846ca8127da6fb3852bcacf676403586a91feb93953abb12620f2ae1cde867e965ced50abcf15e97a81503c95bb66853b30948700af827e5da86e558fa585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76c103bad251c80475efb1ac2dd29638

SHA1
4cfc68dd3fb0d51912e91d6abdc1f261b8c5f73f

SHA256
0435d7d249d900339c0d59a2a644cf47f718456571c86520f889cf402be8e4f3

SHA512
e0811252c3d40ec8bab4b5ffa50924976b4027eb4e8ad321eb3910970893ce4dbba0776ca1f01e21617cb55cc9b6076a711643f0dc32c84d0de6d2f8137c7afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19ccec1bfafe6fd12794c07d9e54bea2

SHA1
1a2e22c5494bb14bc814b07c12b97533267489ac

SHA256
e23b154bc57a637ec62691a277ad901f4f90e85eff3081f548280329eace130a

SHA512
4a0ecf2a0b805af2a95c21be28fe846ea1564c161260f33b8445d02ba733748f18bd6f1b226587c236bc05df765c22f83aff0f0efbe1f10641d3c229aff3e1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd7adae30112cde27b6a8f04c2db1b1

SHA1
eee45fd75a776d4b3bc0c2701b14980dcc24ea78

SHA256
094ced4976cb9419b396bd73b27fd5e63b34d36d9d7e2e30f9fcfc8fa5bfeb12

SHA512
ac7abc2bc0f77ed3f6ae7e5bfd6ec2ff4da880a6734b0aa423e5b0656295f3511ba6e3089e8317518ebd72ef047001ab909796c9bf4db7eedd3186ded6a8214b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055dd5de2a6bed4fcfd80ab0ac2588e1

SHA1
a0141758050f507ebcbf82c93f9f40253ee9a5dd

SHA256
4966c695c7fc1422b3e0965853b267ac370eddcbfb4120b7b6d8aec42315fe90

SHA512
e7092faabcfc02cbaadc71f8e405a7ccba610b3abbeab3f1f76803fab92ddbcd5a854a172177598237225a4eb0ea5669b80ae62e395fe5e5bb7d8ff2fc4c45e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1586.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1609.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit