1531a168a45081aaf35a37c99c379f08503e4cba54ad01f0fda3bf312a24ae39

Analysis

max time kernel
144s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

930d0434f043632f51e8ba16ab019270_JaffaCakes118.html
Size

101KB
MD5

930d0434f043632f51e8ba16ab019270
SHA1

23d17ce9d1ceb3345fc4c481f92229045cc93ab4
SHA256

1531a168a45081aaf35a37c99c379f08503e4cba54ad01f0fda3bf312a24ae39
SHA512

c8362812edc28cba280721fcbbe4a1ef26d69074f003ff08c183bc6950e5eceef80364d7179c09bf1b3799221c39194475df2c217c7d4814dab0170517fb5372
SSDEEP

3072:xsCXf3uTlHIwVslTQ9kEWzbjfQ8Fkn5XV3e5R5F6n9DKKDpnSQDBjkcilRQ:tlTQ9ce

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423621011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DEF71D1-2205-11EF-8706-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2080	1612	iexplore.exe	28
PID 1612 wrote to memory of 2080	1612	iexplore.exe	28
PID 1612 wrote to memory of 2080	1612	iexplore.exe	28
PID 1612 wrote to memory of 2080	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\930d0434f043632f51e8ba16ab019270_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
92e81688a353ed7ef6c85fe82001f21a

SHA1
22d1ad2eaf407a6a23cd0abc296d43af9c77f713

SHA256
08e1b732c3d2c3fcfe35c1971cb01cba898098cca48fd48aeb5ac86fdc86362e

SHA512
ef567936c53a7e327e1737184b5fc7bf45bdcbab629f169d98050bad204336ee42ac5541c6b5017cc585e1fa07f72df57919c7e5c7986a997ee0239a96fcf785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
28fbf92bd561be42e317d8c30de9b0f7

SHA1
cd4d07d4dfdec69028450e987c1c2d0a4132715d

SHA256
e6517a1cfe824ebc044087e88ee0a35d144a4b4fe73e69f6dd1df47a9103959d

SHA512
40e77cb1037cd738477f3afc1e3c00ed1f4292237524efe0ccd1f709347710faae486794180cd57158e58d891304374daa819ffec7756a99866d3fb1269406a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
499e9145b066e6bc50e763aa70be1cde

SHA1
f9980e85583a618990a0a6be409881d08374f6e0

SHA256
7c64a781c172845cfc073f8faddf6b4a37c2c256fe80c4c267a1a49fb9eb7fb1

SHA512
8317010a9ae7a5a248ca0fe655ca6114e5eef557ad53fe76453ff528e2e7af830aabf8503e49a00e3b09bef2f4711b37bb754a6dde556782a3de292f17bf06af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
9438eaae0cf8727fac389d49923d2e51

SHA1
2789b69b341f0da642fd33bf03c47ceda52573b6

SHA256
3f85fcfffa671227563273b362ba9c218c103e44a382c1010b3ea68584da3fcd

SHA512
e77674fe514d3b8046694ddbb4d4fd84a7a213f692ef646a122aa1736e75392ac8b7a07196a03268273b60fd45f8f5599561f2a0686e43408d44da5cdbb1c69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ecc5cb7b84ee3259ba03dd6bd186a036

SHA1
539c47f1302f1e8eedf1ac5a96fc7cfc9787a92e

SHA256
3a1ea6d8b31aea44c3b407c92d74e546520d91fb2c6ac42ccdbcb1573d7fe4a2

SHA512
eeebe6dbaef054bc5d8d3e1825fc6777d52e3bfdfecc2a3b1aa94ac5485d570e4381ffa21eb0673e7e17e5d4a052ecdebfda63f2f23f8acb6d1989d743bf589e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
45ad06a1ac67fea9e18b427b69a50690

SHA1
623339482cf63ce222596d774b4a7084462c5fe1

SHA256
2477c173214dc3cde795653da4c9c73a37d27a9c0f3ee9f9eb15814de933c20e

SHA512
e3a9086964ff67c56f2d35cdeb78c603f1bccbffcf4063706b9c1d7a2e8f2989c7529d5c02c6656f532ce8d2d94bf1ab2966afa1642670f9e59b0421b1828f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\css[1].css

Filesize
1KB

MD5
24db0cc20ba2dea78aaaa2c634eec6a0

SHA1
17341609cb72e12ee5b50974a2382fea78c9596f

SHA256
d04e5e707b79c12f3a303746144b9b261e8ed4b3343f8c98d0067e8f74c9d31a

SHA512
3d043cc467e3beec086e9668f5a01a00d36eb029a7be3bf1d3c4471630dfd50212f796638cabab1235b43cb6de4807054f4465cb94b5c53b76b25f953d892242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\api[1].js

Filesize
884B

MD5
6c70a42410295cf720bf7f3775f304e1

SHA1
31af2a94e210dde9406f340bc3e92fe0128f5535

SHA256
f12205aafc7b1c8a444b2b6280201434b3d13b677ae353ee7d8577dae1a096e0

SHA512
0ebbf0d582a67fcee3fd6d522639b7d89b48efdb0c40b321ca49999c3cbaf0f82ef773e1d17bfc4a24704e57f952b679079108bfa068f415011caa8a4ac35f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\css[1].css

Filesize
412B

MD5
a832de91713634db948aade72006123a

SHA1
508c4637f28aace88a51a2d91d44a62796d148a7

SHA256
9177f667e9cf8c8f89291760353c04047926a3eca7ca7ccdd49ec882b2ce271d

SHA512
702381ef3e6627e9fb7846345e5448d5dbfb3ad09c4069cd5945e1e00de9e993d3b215f762ab0b12dca4fc926c5841edf16319f3534d5fb10f21fcb032907630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B09.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B1C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DE0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit