3bc6159ce454bf6f0af313bc1ac0848a08d3b27c5214d85766af0a2646398204

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

913b0f76c7836e9cdb236a5523d71f99_JaffaCakes118.html
Size

34KB
MD5

913b0f76c7836e9cdb236a5523d71f99
SHA1

22535133f7cf33fa8251fb29dbe1fd373583d7b0
SHA256

3bc6159ce454bf6f0af313bc1ac0848a08d3b27c5214d85766af0a2646398204
SHA512

eddf4d6f3ee21471754c90d73a8b853b1a094aceefc3dd93d4dd9bb04c160fa680ec5f182c78d2dee09885844b6799050b8516a7f58e0409c3792ce11df0071a
SSDEEP

192:uw/Mb5nQtYnQjxn5Q/jnQie6NnKnQOkEnttVnQTbnFnQOg3cwqYScwqYCcwqYQo5:blQ/JfK45ouOBigdvDXgdi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423567554"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAD29551-2188-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\913b0f76c7836e9cdb236a5523d71f99_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b49f90ba2c75e034adac6fa6384107f4

SHA1
9b35136722333b7d5d4f5aaeb1908fbe27a72859

SHA256
5fd176c55aa24b737e21ff44ff046cb1d433b5687598e1715d4bd5e50b4675b5

SHA512
fb961e4e59334e8d4d8f0aed07d3fdbf85d4c9ae01f61415285b9fa155566d3698e60a6af63ad7af2112dc717b941164a39c70650294049e11c90d5617fe41c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
067f888aba56393d74623cfeea51e881

SHA1
5b5c52532206718e583097a8ac39e7a58cc863e2

SHA256
7de03a5b3a0d7d06ebaba6b05baf8a8cb412c7936c878c611581390a5e1ec699

SHA512
c2851c855b87ece03dba742394cc6c6eda2b3fd3eef4a122f8834448048a899a117873e5c3c0adbeadfc067f3085d0128300cb902bacb1d46fb48882ac3b94b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3de6c7ae08ddf4cfd4ac162c6fa4883

SHA1
75a57cad739b847512bf9e6c3f438bd10a661dce

SHA256
42f981e9c08b81fdedfe58e927c3be506b88611185a7afba90dfa3d34b63f897

SHA512
c76c4c0040637a4ed62e21962c1e7ad121dcb1ede81ee30bec5a6a66947caae7faded9e50a05aa21778f66aa6ad0ecb613b97c4598a7e311838e307e3e6fe9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49be27c3ced9b6655d737771435d5b4c

SHA1
7aa5e7e27bd28bb32ec3b7ade54094100c62d1d5

SHA256
246fc403cbc99f30145d6057ea91bad2b7685f512d37c7d163160fb1bc7c6c20

SHA512
38ad8e20fabbd9fcac4e56555045deb5b59846d9928120f2c8b3742053f7764fada274156239221077284d0daef4b8a64d9d33496dba241b877f3dc5949c65e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76814c35ad0ef55ee9bb2e0a29e89281

SHA1
a50e2f981b2608a913e6660a0f0072d9419ad3ad

SHA256
accc0500de2fdd5de02cc45b30aa3538cc875f92ebcba6feafb1a56923ea3c78

SHA512
b60499c9b3afc02743bc03d7013b6768e102c9b03d1ffaaa5fb63f6a811f27c3a11d04b882edae1b37f4f114d0116141eaf1bd8982bcec2589d287b6165106ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b03b3a5124b41ba212830e6fbffcf8

SHA1
ff85f07b93003725b33db7838213bf748360b659

SHA256
332472eafd26a8dbb17b3b928ee2f83c8e8ddfd36e08db3eb4cb9cdd86aade9c

SHA512
cb35bb8ffc868c164bea3d29f3e25a6d5db10a8b972e4bd7b6d05b5fc445497c3da6b941a911c429f61ce28c252695dfa1d83973e1007b4436631610e5e3fc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67aca4ec8db38d1ba11ef3cd645f0919

SHA1
2e0d70d33fc61400de88003ec226bd1e0865642a

SHA256
cb3202d13a0baf1f2acc868ae9699f40533d62e18e97ce6795007c00c3772769

SHA512
41e03cce5ea99b15a61f5bf384fd2adf1b3526519e3fc480e19dbe72dc4697d74ce2a4492c2be278ecdba31143b6d6bf58d4e6f063acf1741929971d1cf0f665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b02de80c102477ff43e421e5c634ea36

SHA1
8b5822f4ad0854b98a73f477426a0bba9792300b

SHA256
9c2524a7f1e0c79dc02ec31be49c0f6d1daf60b6234529b20d7f6cc710f1721b

SHA512
15e810da81c21859118afa9ab9f2e81f497a208050ca5d33d3eb1cabc3e45734f371c8852ee79ef28c6e726d80d042051c6f4b72f6a095f04ca9978588c6aa90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D4A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit