2cf8e3760202e6227eb32a670318cf7eec41d61299d6296a0af99bba7a581460

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92e7efde81f5850e447cc37ec6589b7a_JaffaCakes118.html
Size

26KB
MD5

92e7efde81f5850e447cc37ec6589b7a
SHA1

853956983a152c669c89fd72ca050a01955d9c59
SHA256

2cf8e3760202e6227eb32a670318cf7eec41d61299d6296a0af99bba7a581460
SHA512

7f022d9cac68710f3de235dd3b7f3cac8726008ca8b93b9f04761b46e1f034cb22738e1f6787df37ea8849de69ca6404955aaaec197481bb1343975e8f82726a
SSDEEP

192:uqCXbgb5n2mnQjxn5Q/9nQie4NnUnQOkEntbbnQTbnRnQiCJVevo7NtbFo+NzQ4t:nAQ/nygcgCic

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E76C771-21FD-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423617517"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2340	3024	iexplore.exe	28
PID 3024 wrote to memory of 2340	3024	iexplore.exe	28
PID 3024 wrote to memory of 2340	3024	iexplore.exe	28
PID 3024 wrote to memory of 2340	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92e7efde81f5850e447cc37ec6589b7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c008a63740d3060171e74d375ede9341

SHA1
f225e6821db1ad337777530ecfe16a33a0be1d80

SHA256
e489095c72b841568719745bc89fbcd467574c35d6cc08eaed5972d456db275f

SHA512
34445e6dca4513d15f2cf4b903b062563e33aeb86d3a8a9217e0eb1fe89f75323185d90615931e47ea165d483d2dcd7b2af0acaca9badca60fffe4b6eccbeb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f8bfaa69e7259194ba15f89a90baa23

SHA1
1c9338e5c6a0afb0adc8725401024e094f457550

SHA256
b1ed9960fe4dd9d9afcdc181c0fa3cad9718ead21135b70a30e16a4b8b1e27b6

SHA512
071dd3b2c6a5de17cebd11a7449ae1fbbf5dff99e4a5db961147ade4cd3ca911978077898c6be0c9e677c235c21594d795f9fd25cfe666a66f1b6154d2ebe25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
493f012dcea155920f81a3db35327209

SHA1
0569cb284f231c832e1cbcc02c7f4ff3031b36c5

SHA256
89cc28257b9af05cbb22f735b8eac19b6eff5645d49210ca7df8de74a7cf7df9

SHA512
a3e804889167dc5779a240a2b9349c61d982f3e65ece16026047996daa171ff170644acbf1efe3008a5235fe4b09f4c0f7966c2413ea6093652c76b77cde7900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9a22102d603e877cc6cdb88dc9d7586

SHA1
d59ce395bac43fc532f55ddacd2829f7f1718119

SHA256
34e601994b9876c3713b2aad0d984e4909805358bc2d94c9f2ca1c65c3a2dce5

SHA512
94c8842ac138a4cf5550f35c54077b479dd54cbfdba1e23f6d5186cbeb7c22d464ccfbf5e38cce3c1cba8183a3a2b3bd3252eed392274750d966f30cb28f0b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e286bde26c25ea50750d1d76c087ca5

SHA1
23f80157855682bf9e585b9ddc16822642d7cb83

SHA256
8bfd866eca2a9b60f36441149afa9178bc78595d48db9a87aacbfb022c733fd5

SHA512
fcaa9f671ff79de2df5898bba2de6f795dcdc6f9beefa3cba890301cc88aafa6020d351dcec681a7ce5058ff277558ed65b9fd85c6bd1aece5d963f80233742d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0189146ec587bc35cf70499d34a9c41d

SHA1
f2d44aab1c80faeea147b65ff96dbc052c4d99fa

SHA256
fa1b125c3fca7abf3f5754404286f5642e5029d3873bc2823e2660c613e8ed6e

SHA512
4dc49d65c8d7f6d40e10b12d7fd6ae43791b94161d88e56c6f4fbaf7a7d3e4b2c18081b13274d0175c007a3e61722f4531a4bf2fd43f63d0b1ef7c3edaa85260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e95855aac7ddb83bf0b2c66aeae92c5c

SHA1
e9002176b35b86c7145f2f0de6bb2b126268bba7

SHA256
c0a735a1d6048bad941462cb7c16ff5ca9c51a145695c36ae3e5b05e88e22227

SHA512
76a164a60eddc82e06151b3970b880afec65b870d5600508c3ed0e37ba0294ce245df61628a40b37e550d9e98d5aea8ce20c63a7f4aaccebb422f59ddab77e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be16c9d3bb64d7ac7d27b107754bbe91

SHA1
e7c123ef8929033f1c1a722a307bcce68c8a9d8b

SHA256
73fee2b4435136cbcb38015e7d5ab18b9326e2bf3bb5ee2c4af8494dda898a09

SHA512
b5faca67491d8e1f561a6a50b5fa80924b870f674a23db21092f5b7588780dbb389da169bfbf69f670c3989d2f741044b5db71fa22bae7bc599de72467778878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
287af89749397d21b3c849894ede5836

SHA1
b4905bb6481b68f739de289091ed77b1cab25a9c

SHA256
2696ff8bb56ab5296f448b5c86cad8924ad1ef77b40a912c7b03cc253fb3439c

SHA512
352bebd6ecceb24453ce5cf60e285a9c4625173d75f901fd316b805a8224f377012873bdf5773726d0dc818bb9f4046216539464ccbef65899ec1222eebfe4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit