428aca87d5492e902ee9a35dc36e70b5fc203ec72b3e748258c3efc60cbe3f50

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90a473adda84a2e2bc1165c2517c1bf3_JaffaCakes118.html
Size

214KB
MD5

90a473adda84a2e2bc1165c2517c1bf3
SHA1

0cd4a60de3a9cd29fea31311786ac9840aed2b30
SHA256

428aca87d5492e902ee9a35dc36e70b5fc203ec72b3e748258c3efc60cbe3f50
SHA512

f5ed8de41cf767f0c654d8c64527b150c67ceeb2d5ad3e3cf5969e4edcf4f74eb76a1a2c326a578f56655c9945209db306df9442743f18eceb4160aaac4be509
SSDEEP

3072:5rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJp:9z9VxLY7iAVLTBQJlp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBE9F281-2167-11EF-B0DE-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423553464"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2120	1932	iexplore.exe	28
PID 1932 wrote to memory of 2120	1932	iexplore.exe	28
PID 1932 wrote to memory of 2120	1932	iexplore.exe	28
PID 1932 wrote to memory of 2120	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\90a473adda84a2e2bc1165c2517c1bf3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a44f4c1ac5464c089f0b7dd4a055519

SHA1
e525408c554e37fd83dd5676eab8b5320c736dd8

SHA256
50b22f8dbfdb177d5e3872b0b49e74df98502db2db66222f57598577b9cb82ed

SHA512
c5a4630bcadf9704c17c2ddc74d3459e533c27f14b9d3139f9d2968d870fe94226922bdf6cf8bc9fd50fa6da37e20981e0ff6320c3cc7414bfe32275fc5d5ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc3feaa25df78856bfb472579e19430

SHA1
b06cb01baf4df4122625637e6c3ddc0cfe5f269e

SHA256
f098cfc15a95c745f3fc6ca7a3fe675fd831d2802d98b2a05782ea4c9773dd1a

SHA512
cd51af14ea78fac7cbe3b3558c50d555d20e8066cb19eacf6e61acb1e8cc2db25ff636ab04e91a70617990d5cf1ca6db658b85384b1059da14ecb1ba08338af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdd156fc68b415eb850f106fb1b6b57e

SHA1
9073c1e56bf24cd85c152e3707bf60103df619cf

SHA256
48c3bf938f396ae77c3dca40f63def7a1974031f4d1a7a39917f1cde921f7238

SHA512
feef28eb34893f860d66b9c884cb20f0c6580310ae7ca85480d968e046e2c54d566afdaef2efcd6d8484932d2dd12595930305a32af234e5835c8565379f69d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb5a3a768801ff49123ca3d7276b155

SHA1
9557a372f910a3a903b4e8ec2b1d601459cbd213

SHA256
4a394d632035916bbc02850ba7b93b3e3dfd845089b26c04129241c884f1b209

SHA512
ed31992141072293a310c3da95db10b553df8384e126ae59b1ab5d3edeb70d4d183fa1a911a886c693c9f22698fdcbf8af814b952f8a326990d81b015a312c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44d56a819ecd47c535514539357ffb15

SHA1
6ee1a5d41a2a9a495858f733289118f5ee28321c

SHA256
417120269f1df18f6343f0e383f4ec4afd51ded6963fc4bf82d712adec2f949a

SHA512
ee9ec5f868efdb9eca5e087f7c88d5339e18f03c1e3e24f13d74d9ad55736e1477c7b8168c5fc86b39ff0ec63390caa9a1f579356dc725015cd3e42eaae1d275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823fbabb43481f44345b72286997714a

SHA1
c16b4728340ef8002de72e0d85414c663bb9e1af

SHA256
641d3ba86c1618c1f0c2ee7e39b697f7b7ce6733977b57736a48bf0073a3014b

SHA512
213870f40cb7db01fd821b8fa50e12873093c04dc7b3cb5f8aa028e76a12144b84fbfdfd238a6eb6e524471b6dfff33c5a1ba958d4e65b096ecedc9785045aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f24f5d7dd539448cbf3db87577cf27b2

SHA1
a4fe7990fa35d1ce03d44cdcc22c357d0485ebd0

SHA256
27d1f9f2cd45c5884902c6f8d675711d02ae743f839ee428404a9c3f4d92bff8

SHA512
285962541f19b6d8e1b895504ef509f81c680b3c02ed87c84c2f77ef999e0c7fc60cfaa40a818fa22ab66a20e942f3f75756daf14dbdb0c964440b16c960278b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae492f25958202204a54e0f2dfde70f

SHA1
8ea97b0f09e74dd0eaf6a2b74b5f6570504fea23

SHA256
64da57a2568c3f395b12d442c70d7517b4d458814d34b47b231a5cc3b9f020e9

SHA512
f67f103f58b077a09f0ee57b2eb46cb72d174cd0c56b964415889e1634409438c08d5dd4c7927a5d56f418339f71feecbed34d53e93f72657a5c42deb763edc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8daee8ccbe783be5e33e4343bdf581c

SHA1
83a179d9c06ffdaa339c3abaf1e8cfd0b4f0753e

SHA256
d3711919178f86d7da00c349c965d4b265decd17cd749918303d3eb133977ff1

SHA512
d25b4dda4e1a4be57f3862efbdd9801ce00625e4b864123d298efddd3314d1a063b784a2bac755cfc28e36dce731704a2778a0262c7511d785fc6de103d7d55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab193B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit