46de5349d55b349ef9cfa86a5ceea7d54c95a21159a9fdc8c7b8d540295e2001

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90c89f3ba141e09711cd49cb6b1b1947_JaffaCakes118.html
Size

28KB
MD5

90c89f3ba141e09711cd49cb6b1b1947
SHA1

b99c53c1b04e35f3d8384ad3d21f18a2c858a9a2
SHA256

46de5349d55b349ef9cfa86a5ceea7d54c95a21159a9fdc8c7b8d540295e2001
SHA512

a54cbae78b9a5c2c48c371ab4939df66371b64b26be773d25e63a481a050fe95abc60921594d1e6263eb9695927d1a33af211638b493e3d34eca7da91ca9f53c
SSDEEP

192:uwfIb5nids6nQjxn5Q/knQievNnvnQOkEntsanQTbns8nQ9er/m63fvm4RQl7MBP:6Q/PihvvmlSJh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0FE9B41-216F-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423556827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28
PID 2020 wrote to memory of 2600	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\90c89f3ba141e09711cd49cb6b1b1947_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cb507e2bb761ef21962c4a5edde40da

SHA1
aef6c39f8f23a5da553dd2fe7a9c09cf2042ea97

SHA256
951b369e57915ebfe5f55b0cf5c9ce8ebc1cc91d5503156263e5874b1afee0b2

SHA512
aab8d6c42c4a676f345fccea858b814feffdf29b26db6a3b7d02ef4878053349eaa9e713c23cef27f2a0fcbe9443744017419c4fbc0afb98ed30bf2a97eefbdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2dacd81b47ad12ff47e5c268523657

SHA1
cd831a18ad4bfcf98805e032f8674dc3b63197fd

SHA256
29b5d3fb6da31341733ec30f2d19bdca402659a055e0531693092a4d6bcb0856

SHA512
2c271df9ffe0a9456032cfa6ffa97667f5a34ee3807be6325156132c1fd324849bc7585c5e956a5c95b24ed59005085e077cf126ebf6f8a3979fb570e9158214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8612276dabc2ca83b6080333321dea87

SHA1
1ab19dc2a368289477dfe689138779168942e4d1

SHA256
1cc683067aa7bc9bd31095dc5d6991f0a8a2f40e7f0cccff183b0d33cd7196d3

SHA512
e5240a44fe73d15d3202f3abb062cf6afaceafb31c4fec18444c481a66b132f148e728afde37aec396302047db7d7d11c07b5df364894909128ae3208f5fab58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4245ad67760ec4518eb92711e2d92c27

SHA1
46cfccbfb335ca4d871a31036ae473abc0fc1f5d

SHA256
b15cfafce9a31a82e8692fb1d913744e24aec7abc05e3fdb7b7b5aeac369a9b9

SHA512
2d189fc455b288556c5014ec88aeddcfa16acdde672809da6365aaacb7d91929e24005b69e60f7b5099dbe2cb711f3c2e7dae30ebdc3d08ccf5948a72bf85fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9928bfc11be28eed801af0c12b71bafd

SHA1
3cb8d7ffb8423c53254f5ca195412ec43e7c3e67

SHA256
d6e09234fc41f052d9e0887717ceb261b30e663596685b3b50884a5cc936db35

SHA512
6227f7bf81656a48379d5f0654fdf32b8bb1c5539dba6c324950d0f4cec4ff19ab96504a5fff0441ad72763de16f7e5eed366413e0978193737b7a9e8ef780d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ac50c86eb0a7202d86a0321b7b96a58

SHA1
5184ac142cdcbb18777a4786bcd7e2dec5044384

SHA256
e852727cea23651bd735820a4f8d502cc02b7d1ea95531d42bb97e482c06b4e5

SHA512
0f6fdf9cc761fa8c7d0ac91b805f8fbdbbbb567863b726ca0c0490006196c84a8aad6cb943dd9b919e117d4cade5e269ac6d7c7a45530f5fa32aa81847cab911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bd3e69de8138db12b85e553e23134c2

SHA1
e998a6fac1b821235571488eac44814530aae389

SHA256
4b93ad587a36b84b2de219b81e49fbe12ad4bee3fe7fd102006235486cc9ab5e

SHA512
054a7227b1f1b94959988b956d6bb95f0b88a23d07f0fa3a2240fccf6591a6445963026a45eb3a2457693109fe7aff0a59639926ab9c5e713acfcd16f7a31ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f0c3809a561d5d8b399ec60fbd213f

SHA1
c85ac6b657941bc332e582856c0750a14117ab52

SHA256
b81d4c28f2b6f9e799ea953dac50ce2e9b54ab3c2adf8f69aed0f92028004240

SHA512
ce80871f6c469d68bebda8c6cb61bae0eaae33ec80256a5e7138a2516ea240e47bcaddcea43f98718d2048fbc2fcd2afbaff322a8596c011bc0eb98872a2cbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25BB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab262A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit