1891f9f78fa81ddd6ae85c7d3e817d4e6141a539a50612ca32ff59d6499f4622

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

92c66d56edd854a3be510d5b36b1f596_JaffaCakes118.html
Size

19KB
MD5

92c66d56edd854a3be510d5b36b1f596
SHA1

13da3adeb70a2bffa69196d26402ebcc5de7f7df
SHA256

1891f9f78fa81ddd6ae85c7d3e817d4e6141a539a50612ca32ff59d6499f4622
SHA512

895c2f6f5b33a7842d8a5a1daed539c5ab9e72840d700c4480a605f6a3ee5693b15b7e9783a41e5c4d606d796b3bf7ff15d66176d660daf510b9bdf909799527
SSDEEP

192:uwfEb5nlCvbnQjxn5Q/9nQie4NnUnQOkEnt7znQTbnBnQmSgHMBYqnYnQ5lNnln4:YQ/FqBLU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423614537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E3C6C71-21F6-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92c66d56edd854a3be510d5b36b1f596_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc4183a28de5bd5acbac1065e32245f0

SHA1
aa50ab6df8f7f08630aea14f94f7a66faaea5caf

SHA256
9907f124a11d05f7565cbd3129825e0f7f22b8f03f014efdc416bcb3e404464d

SHA512
1724a69856e5e839f76f81ff152df43126b4f7d32e58905325a97606afd0db4b000a2268523523c3ab09a0d963345cb8e0cdc2119f989d885172453f0ec95523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fff1d2e3fa7f6b59833d15c1eafe9d88

SHA1
1adc3dc31713a18c6e9f24ce901d6763a7b7ed24

SHA256
384b53a2db84d41ea0b34536a36650afb6e09d074925b031808ce8d386af6287

SHA512
7d3dc4f2316aed1ae765de1b63a55eb258c45f568b658e1aa5fd2910d32acfc2b06b449eee1b4db6e604f9cb60e143f3a827609a6ed9a1052d1547e9df18175a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64616334b31e458fa0fde24b672bcf3f

SHA1
63d87248d918071e2b4cd4ecc762a0ea1554d63d

SHA256
1810a63e83b4458ade158d49743761c35f9a1bc531c99dc5e71e33d86d604a58

SHA512
2baf9f772ef8f5fe6d83ffa831dbae65268074b31454965dafc64b402a1957d236b478c0877a30cd3b434bb1ea84e78ba4cd8a58d324c761d1e38f141480be77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438fd2669e06b497eaec4f281f0c2250

SHA1
dbc1861c892e96b0ad56ae1a48eb86b8638140f2

SHA256
360c5a9ae9a94e526394525f03dc8fa30dc3c41c74485a6cefc8139b86073b1a

SHA512
2cae13dec61b121c35f604f05590714697918b09f63a7936517f384f198608b9cb4b3f6c88420d21d3fdc122d6d7c852247650ae6e7943337d58f63f69594d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abcb055d44022ef072d9b31a94ab279a

SHA1
d2a82fa0a0de8cb4d1f003bd65b2a38e8068f6bf

SHA256
07d2f33a136d46e9cc1e4d80953f8ef75520d69eb07058d26fd6b85b7fd5cdb6

SHA512
5fd8771729c882ab8c614a68ec6848b149eb9ad860770808ec4e95e2d82eb9832fcb099a16c2d0c06be0751597a05200c87e4ae01d4c3be538434614cf37170d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a29eacec08856ca70589116a2ef5141

SHA1
7de29f89ed41eec25775be38fa8c4f6250a89496

SHA256
1bef32a2aa87b98f91b1f115e433f9577ed652c6a722b7f9990e7f18d45975f8

SHA512
08ad81669ed74b8c1f8b7bfb6bdebfff58cbd03cc875d61c684b0c099399c1b54cd4a1a5d89400395992cde6c214a0fe0f131b5c64d25d3ebc6f7700ddd05d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7187f881847acec112bc55b640287245

SHA1
734f233e8518940a008fcbf222fbe8ba1cb31765

SHA256
97c04418b3b405ad8b3a2cdc9110eb176aa84c02ee02d1c8cc182d3234472eb8

SHA512
8ea67742360a262b01f8b095350eff818bd8833d4eac7c1bf40e163c0950513541103f31241526d9c7389647fd1ba1aff7c70c0f608a1d9ae8b41d43960aecd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893d88c083f214c991dcd8cf111d5f6a

SHA1
83422c5b1b52d039fa80f6df26ee758c3e0f620f

SHA256
a4c7db78e49f2f8e25b5a2deab4e29f88c84007e1a945bc6e63524098db28e93

SHA512
1d5c8ba0b24764d8b5446de2aa57cd79d38c3a60a9a52d72d6719cb9088e2dd56e96c4c50278935cd2d2d0f0d6ea0c95f2f9529ed93958648d7f80335859c22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb0a618abd16ceef8f6e793bca4c902

SHA1
874a26b119541be4b8b3bd01b05f89425e1a7b17

SHA256
de8255e96d252bcf1696c621611a87c39593b5632705ec9ddbc1be9ca89f0271

SHA512
868e6148d5497e78441b3c504df4c273fe785c5f6af2be10522a5fabd3ca1d67654e676edca12615176fd7028ff909d88011bd48f174daede7423342dc18b6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1650.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1713.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit