53981e299fd37a0df1488306b0fa0ad31b0f011b77d3e525b6308ec493ab2b0e

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92cf8d81b40b799009427067f0b1137b_JaffaCakes118.html
Size

23KB
MD5

92cf8d81b40b799009427067f0b1137b
SHA1

694fdfd2194d115961167733fcffeffcc836f8fb
SHA256

53981e299fd37a0df1488306b0fa0ad31b0f011b77d3e525b6308ec493ab2b0e
SHA512

1f17c8d1f59dde9f73b32f03c24f758b7ceb809d405fb18a5d720ac0970aa1e7bf64a01f0e8bcd7c186a45cba8ab6fa8d1086879188a7d099c711303d20fd3c1
SSDEEP

192:uWnwb5nHOnQjxn5Q/2nQieNNn9nQOkEntm8nQTbnpnQvCnQtxwMBtqnYnQ7tnQYE:SQ/LPK4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423615269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F7D911-21F7-11EF-8840-6600925E2846} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2856	2264	iexplore.exe	28
PID 2264 wrote to memory of 2856	2264	iexplore.exe	28
PID 2264 wrote to memory of 2856	2264	iexplore.exe	28
PID 2264 wrote to memory of 2856	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92cf8d81b40b799009427067f0b1137b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5ee30f1cf491b3b046280e0e3b4543

SHA1
90e1435c40992445a8be96d5be9686c6a6919e32

SHA256
d37995eff45f7d85c7f2be30bc97a070c9a01ade8269f33202aef31f3ca92b84

SHA512
6a67723ef744c004f4772326b3000ce98f45bdf57fcc027e219554a37f34d16d8485b807a2769d1977a7c6623f222e4887c2000f60b1a261cab6956db580efde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44f9b8c6970b5b605ec1d48c882a9e1f

SHA1
ffa59c432c99cf8efe75848882cb9da86e39771a

SHA256
1da393593f3c85555313f028644e85622adf0cc31724930d514f7c435845b111

SHA512
ec09f5e1c22b86bd94bfd367daa5ad926bf8c2a55f2d92d8a7d3124d7a51b35f6c680b26422d35ed5f2b396303d2ca5b4ed3e63dfff42933020619f1ed91c473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0c651c7729912926a1ee2864e6296f9

SHA1
50c6635ecded7d95b05061fe95f78718061eb09f

SHA256
4d9a4c3fc4fab2a656e8d8f2d8b10a8ff3f3d1081b502b77f69cdb141f8562f4

SHA512
18193c070ac9c7d6737117d41374e2869b4da0983e2a3822844e6c9bb0d884b9d662f65ebb3b155bab5f0874aa150d24ffb76a9d83b6b7c70090703fb8ec4f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21fb69420bb703ddc59762aa3f68932c

SHA1
ba057f266f8c75f0af2e1b47edc33306504fd1c7

SHA256
00ed679906b9c0056c12220eb72edfbcf0ffdcf644c627f3a3c0101c6e43d258

SHA512
83bf1f02cf38c57bebb3ee7df347247a09a18d2f3ebe702e0c7c623408748de80ddd8da9133d921a0b280e035f1dfc72ea77d7ade6e43bb593f69474738798eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b9a6512c8d0a8d1c18b0ff34722de40

SHA1
18f9feae8b55e88ae8572070ee6f4ae530ef8f85

SHA256
033d83d9633739f62b19efe8adfed22df51bf5fd059bd0b71d01aa6a0fa689f2

SHA512
448f297f11cd38c1c06cbf8f1c40ccb37723f134f2475d929acbdc865970e460afe5caa4994eebe2bb0a3bb331031affe7c822ce53eae9a3e9705a3f18dd2f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ea85e6a2835123609e571e20eedb43

SHA1
91667223dc58fc2dcf1e96a884f659017b1d29f2

SHA256
e52e9015036e328f51ed89a7145f1f2fd2b399ff4f0bf7b565c2e12b95dd6362

SHA512
663e8216c15e5051fc64344e78c25072917ee6e44c5b9ec85f8dc5cb8fd20b017ec39aba0fc381b8c8c13e1b182340549a582cc2a355227c7abd19fb79473308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e23b02fdef6a851d05d34999a0e4435

SHA1
38131232e86c0d322efcb1208afb40965b39f362

SHA256
4660a274b71ff5c8342de4500a01fb513266606db78c8f65e9e60855e1845217

SHA512
77bb56ab9aa1b2d64018c67637bb7549dbc7967000c6f3b53cc9b688d112653a39c101c97dfbcd94a1ffe350145d3f164df3c4bce19ebdf45b123ba96bfac893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f315c638dafcc54f17ad6478a59b58a

SHA1
610a1eac942f286fa628adb88702ea660654cdf9

SHA256
c5945e322c0f3be6727fe23da9a065c484e69c0e88b4ce79ff964d628a5647ee

SHA512
67a25a7fe82f5d10c48993369d05d19ecb2e58b03d385ce224a2e8955de1344fe89c749e480d43d77520360db4640ed25a47e733736a919be39adc42d1d04ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acf3ad4a924781997c0b8a477a44cb19

SHA1
281ef51425ab9709f2527674f9804e7a1322b4f8

SHA256
f511f41a920452adae1520c44bd919e9394c0f258de2b7a772120b9c1a818b96

SHA512
66747d42b0ce8a40cc16a611778b4f87a791e1e7c67a6512416b1eed864e8ba026e25a51c0380f4779bc637d9f4a1e22f5c67772d2a680de1c9db640e601097a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1058.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1177.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit