c807e42dbda08e5e45efe3625e0aac8117db162abaa347fc1ab78583ead247fd

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90d3c11dc7080690d70f8ad8743417b4_JaffaCakes118.html
Size

27KB
MD5

90d3c11dc7080690d70f8ad8743417b4
SHA1

38f269251629a3e2112b4020333b25628572c5b1
SHA256

c807e42dbda08e5e45efe3625e0aac8117db162abaa347fc1ab78583ead247fd
SHA512

43b9a5a0b410a534b6224bb80739f6d68943331eb4f8c800be8dc2d54a0e03dacd091a56c6edfe34cda1b7067630867edc9f82f12852080f7b7d508be4a11de1
SSDEEP

192:uwD4b5n5unQjxn5Q/cnQieHNnnnQOkEntoinQTbnxnQ9e3Hm6unBvQl7MBnqnYnY:oQ/z+5SBuSxFEH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423558012"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9355C9A1-2172-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1700	2944	iexplore.exe	28
PID 2944 wrote to memory of 1700	2944	iexplore.exe	28
PID 2944 wrote to memory of 1700	2944	iexplore.exe	28
PID 2944 wrote to memory of 1700	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\90d3c11dc7080690d70f8ad8743417b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5474df410a7c4f93f035920f0b0c2a6e

SHA1
b122adf1e6d901d1bf3ca7ff0c95a7185eecc98c

SHA256
06d12c7b4196fb14c220e3054a32706b4493e6ef1dd2855b5337c45b7fccfd01

SHA512
4b81e2378f79551ee6024cd0e0bec99e3a5901b911bf6e8f8e358fb35df46fa42dbaf4393e46835a227ef227d0d0e268252e5ea1447e824ae2d2374820ba69ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7673fc9bd836fa695f7494a4755ad50f

SHA1
91a7005d639073bff5c574b33e393c69ae47e9db

SHA256
5be1711ad20efa193e3168313f313d242bac013eb88645ad5a4fd19c0e2d78f8

SHA512
92b6be287e0be1baaf58bb073006e032c4f95fe98950f6d5c6dc36bdf911dc763e4c371b6268c8558606e44417739cd997029f831f44ae45e6d1251b4129eb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
308a07c438d2cfc7ef65d220d9595ad3

SHA1
a2438a613f3bbf8aa935b5ec2e15853274e3765c

SHA256
a3057012a2d41d81fcb2b17dcd0902e972b706a3c7104f43ca1458c441b3240a

SHA512
6d42e9cc302591231ae298c49414aa69c4ce027efe7d2b07addd62155aedb45fca9b2272e7398dc64891513255d773aa807c599e8079899bdf708bf80b8858f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
846ebecf27d1468007b6aee69732dde4

SHA1
52a2c19e5e5332db368bb245e66e3751c3078b32

SHA256
270e6414b045ae236bda3add0c077aa65622e0674d06fac6b515bd4a0f6aae51

SHA512
01e823345a04fc57e63404ebe589729f5e0f7d4ef51be32dd1ba2efb667dd170c235b4cb08fcc098b0ade33c3eee2659cd8b83d3e94a3c1d10087dd0ec14b1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59378482830b9e8ca82ac599b83acdaa

SHA1
301850521019b4bd58f284293e4e4828e75931a4

SHA256
907350c32dd75ab7338dd9e94fd87f0eb0f52ed79675d7a4270416cbbc8a206f

SHA512
a37518ae238e1987f6dcfb8c4690973ee4c1dc72e0b1c3e70a5959d10d4195b5bdb11ab4b8033b8f9bb47eaa5914259db0ead4a1247e912e93a26ca156e92574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b520603977b4980de3bdd2acc409365

SHA1
10abef2a4590150ac4735507969dd8b579cc1474

SHA256
be404ca87f4537a5155e9896c8422309e132adc3dc35b3eeb58dd83c8867a14c

SHA512
7659dfbd89a3246346b49d9395f2959ff325e532aabd3b02b78065f24ed6ae8a61108b950d20df7753578a651a84418e0f612dbe5d91574dec6e57af9d1f32f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ec89959a92107599fd06a2ccd2d713c

SHA1
02216f6d4680eef02d23a90636b5d40a5f2f45bb

SHA256
7211ced95edbcc79cf25d8d27eb8692f463246f48c2af9b704feda5f83d8347b

SHA512
6f041e896d8f3a55466a2ba3ff398f3396bcff14e9bf4048483c50c4bcda4ae69744edbf0ddd547c4d2babb7a3d4a70c61c281926f7387f4d4ad019e1e98d787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1321c8d93ce8ce7bc839970f9ef93287

SHA1
14f74f7903d5c19dc8809d75c42aade25599d7c0

SHA256
4429d28a5c31f4d062c58dd863b9763769db87a3ae305a1deae8c73063a9d630

SHA512
6f6139e3d512f4a1efac4e4f3270045875479a34ca0051e1bbaf47e564380c9ff999958daec6bf41d3c4e54978fa5b2ebbf257b7b4096b72956e9270851ff2b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
226b39d05090a71013ab6c7622e62fdd

SHA1
c818418ef46d995244659e1e65e2f48c6e421088

SHA256
2199e3d5b5138d41a73020cd52d0f55b4beda0be0239b20306d13b438cef12f2

SHA512
99b097627c425ac3af2b5b9cafff259a003c3cccc5c1f2673416283dea644f5132d6f699246206481d9f9d28dcb2fbcdbe9afe42d7d27292b49e94a4ee2e7fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1612.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16A5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit