6291727d9930b3e4b290267f489dd594e2c4bf6e20729ccb9d2fc545f7400de9

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92cb8b36b1043823a42e9e6843ec3856_JaffaCakes118.html
Size

139KB
MD5

92cb8b36b1043823a42e9e6843ec3856
SHA1

fb032ea5c9a71fbb0340efd3f318434db6c90cb7
SHA256

6291727d9930b3e4b290267f489dd594e2c4bf6e20729ccb9d2fc545f7400de9
SHA512

356070528d17f606c5dcd0e1f09e12315f02c52332cac4e686b64456371d4885b6e86021bc2972e8380568c6bec0f96469f59d4bc18ef53d3a2ec5cc601582b6
SSDEEP

1536:SRbj73lUlAAjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SRD3NQyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DBCC341-21F7-11EF-80DF-F60046394256} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b4072404b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017a384e6175e064a9b08ee4725016cd300000000020000000000106600000001000020000000a6f6dde05a833b1cc7a0dc30d0aa32d25c516dfe2a09cac31f38af05eb56e5d3000000000e800000000200002000000019eb8ee99112904ffb091d8c61b929410c046ad13810d19fce407780f38c291e20000000097ccf92fef1b8e973b38995d41ba76c5bf9598d07c4d2f646360658e4a1a0a640000000184ae52bf08616db176ed680c60fe2f888a0892cd780ddf3eb7574d951db88f1f5064d1311a3ea08d52da7e31c2630608237813c1a842228c3f76b1e840e2cd7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017a384e6175e064a9b08ee4725016cd30000000002000000000010660000000100002000000080e3f5ec07eb72abb3eb40751ebeeb7bcdec56d9cc8ce0c9cfd6d0b9f0d2fc0a000000000e8000000002000020000000b674dca46a636d8f8dd2daf0fc35ba00703af0cfedd4e1143dc50b2eeab738ba90000000d805caae4935eacabd1d682965073661542ba2b1beee7df83ed4b321e3e54e23724a53dcb23b79b1c3321df11883220b40f8dc2280bf4b88bb2380dd91f8afdac0c7f1301e06855f97554d8aff52782f59f73dc4db52d7e96c1a7509259a503c37ce4d390f9b82a2f677644c45b19ffbdef2d94f0faa89c03ddaaac97fc4c64bb6a2633edbc7fa316c76bfe8f6d978ea4000000073d89a8ed98f84b2454b3d363e213eb200e1d560bab38f2b04430eb072ba567533efa5279c11cc4da7179cd13ad3eab4c3ae04642bca0dcb3631d36817eb21c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423614912"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2940	2896	iexplore.exe	28
PID 2896 wrote to memory of 2940	2896	iexplore.exe	28
PID 2896 wrote to memory of 2940	2896	iexplore.exe	28
PID 2896 wrote to memory of 2940	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92cb8b36b1043823a42e9e6843ec3856_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03da6ccddb8ced1d26a96e5a3bf3e203

SHA1
141c564fb49e2641c51cfda92114a215856090b8

SHA256
4ed559c7e697a6c7f80759dca7492fbb4dfbd708e9e025601150c5278115308d

SHA512
ead520ba2304ebf32900ce044e91883c24b1c1fc0c29626fe4f15e75da373ff5fc5a171db835d39da7b2ad356a0d282fa6d36791fc43b97921c7e61252a701d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
600f640d46a5004f3082069d623c5cd2

SHA1
9d84c87a9b8aa38ec4157b7b4f795f8c7341a6b3

SHA256
8e3cc3c9ab3a05a2cc94362951d6bf3db3008deba1dd4fa48261d07616a69ca0

SHA512
604c34412260a124b67fc7dffab4f51498066e2a6bce6b8ea7872399ac136c2ffff9ed992734d7c698f9bdf136da16c77648777395dc7a8de112d61f6ae67a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d48494f545917cf61d592f8cc47dd2c

SHA1
d8e201e104e2670fab3304199cf27e49d07addec

SHA256
985e5d86b08c515acaa78a723eae3aeb5f32b6f28cf9ace042ad0a21dc4219e2

SHA512
8ccbd100b5e8fb5343d7aacb4699c7feb38096b3bf3d5ad475c118b8048d909598c46ed2cc6251b8b2f055587758e64d8a2fd9a0029f77fe65c8c51dbf65fa24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ba209e4ece014aab9643abc0b9c01c0

SHA1
099e4a8478fd3261f2cdc9a9bc0af6b5cae1bfdc

SHA256
78f50b5b77b6b1dac0abc654dc258ca16299480aeabb8788fb203195568c9756

SHA512
57d2e4619280193d5f7b5526b88edf4edc4829f79b29fbfb67642f54c9bd0c9c541936e195ba955090fc1cbffd261a8e5b5bfdc6af2dd9941ecbd7e57b45f2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60def39a1f625b54bf9b1480def3c805

SHA1
334a1ebe3e26d10a2f9d3d3c491879f1b77aedb4

SHA256
0c845b859de60fda88122132fd2405a4490c477b4dfc76187898986919366a81

SHA512
6ea3337ea58279bc90981ee06ce911b625e3f3346aba777c594958c03bbc8940aa46fb0f408a31ca821a21361531797f0f843664e0cb07fe001ac709a292adcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36b483ed3885258675daa7be13336c3c

SHA1
5e14e679d6218a439220c668a9b9b0ae7bc8e671

SHA256
7d07ebf64bfed176f35d108005e97c8350481a91aef8627fdbf9d924a2f5ebe2

SHA512
d32f235a2e6f0b7f4615bf29167fc5a2b2bc4e874b3c2d9269a8b58653549c6feb076bc2142b24b112846d4d56b03511deeed271cdd0e2b2bfde157de71ebd24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e6ac5784adcac5662a3a668d15b0d4a

SHA1
ec56b9583fa7d8b49ba141ac1bd2667f6c619b88

SHA256
87e20a1c8a9368084926db98799445bd51dc8956fffcf3895cfbf048725f99cd

SHA512
5360938c416b88d03f3c5a1e6af2b95e1e33022da76f41b618089a6b29d87615305547233be9af978b293fbdc6e7e20c32c4ff4201002e4644e6ba1c442520ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3c31fc9be117c7baafd94f7d2ce578e

SHA1
e943bc89e4d7003f7e433a7403b3d1f16c6c2eb2

SHA256
2689ce3c3099a1526a7a4b779e5306037be6809a4ed7eba9929a432659672f27

SHA512
351bcf0ffa4b4d79d1d6b873fc2c49438f2ab1b32732059b32f8b918caefe2b743d6a1d6d075f6b4683038c5e3b8f96e87a554b677e6085688e2da9c4efb33a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
707b9a2832b79cb2dd9cebf1ac85549e

SHA1
cf2f5bf8e856b3e27a0e2c012f2e65dcb9fcd476

SHA256
f2bf9c7bd22f4c01f6e05eb6f058efca099f5774e49252772d060309cc8bc298

SHA512
f3fcff1cbe759186e616aac2602aa78aca598ddf6e912582c84e303a78a257cfd55a3afd3747641095729a15265b7c7d161beeceb55d746ff754e6be7def8527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab193D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A3E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit