c8a2a33c72fd5c367964b54a5950f390324057a8432762730f4e354dfe881fc0

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91589542ad840b8c97ffe5393e6361fc_JaffaCakes118.html
Size

23KB
MD5

91589542ad840b8c97ffe5393e6361fc
SHA1

3812cfb3ea165cccbf9f3f86f7029077654aec01
SHA256

c8a2a33c72fd5c367964b54a5950f390324057a8432762730f4e354dfe881fc0
SHA512

3de54d66b9e3436ed274d53eef7ea406162d9471e2255abfb302f28ff187a1c053ae986a44613e9a228914acc75e6cfcb25af46e91b539f35a46bec2579778b1
SSDEEP

192:uWDAb5ndunQjxn5Q/4nQieDNnGnQOkEntMWnQTbnJnQFCnQtjwMBjqnYnQ7tnQYd:4Q/ude

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423570226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02DF8E21-218F-11EF-A1DE-66A5A0AB388F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28
PID 1644 wrote to memory of 3016	1644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91589542ad840b8c97ffe5393e6361fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7501505139e4ea7135c968ed4868e9ba

SHA1
0b2ecbfa1fd159924870183db04e4bd34400eed0

SHA256
36227366d34a32634fa48c8c8e48b4c8b9907a159312721f5c07b8b4f1d9f105

SHA512
775a2a97ad10f3cc1a8fa3fe71f21268cafa00834c0430076550228858095f1bbe1f887042d0e887620480e7109861481ab8fb6c1d30650ebf6483b416fe90a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dfc8b5ccd9b25b58b20dc7785bea471

SHA1
55a9e999df4b8d63a532f2edc761b44f7e3c566e

SHA256
68aab8847af20a8e03412e7f2bcabf57dc6384470c2c04d237a9a4247d2c9bec

SHA512
ca58fc95d60ee024c067151e29d9ff89dd18000ff902979d7631a1f0cde136e27973eab0882f175454d503cdb00ebeaf7a049b44da7b1c5b896e0cddd1346334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5e4f2f281646371bc67e219c41c5906

SHA1
bdf7fc216c6f1e1acff963fd4690df178797a215

SHA256
d5d2a7c354fe9500ef39006c3d1ff6f504bec6a6cb4d3ecbe19c28f183b7912a

SHA512
adfc32c58f97e0c978f9043f216e93b504902740555380f4e9f6470714393b4259b2d3744aa6fa23f4f8e4b9e92bb6f8a27fd191c64697dd960766124953af10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0b1108e3683eaffc9ca80c805c5b91c

SHA1
24a6fdc8cc7f181ca655580b802a7f82d0f025bd

SHA256
94671686c0f4e78021edbd254f5a0298b22ad291302f354313e37fc65cafa1bf

SHA512
9546cca7909363b01008032e588309515def95325d4302072191a3de2928872785d1cd6bdac56f8bf6567600590e22d039c68671c58203a64fdf1553de199716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64753b3294c9e3f9f89ca1b7b29889e8

SHA1
7f091bb2e670f5ee9d9fabd8baff52389f2ee3c8

SHA256
193eba27183b4af5f01118373999cfc650eb1f89845d295de9f2e86273cbc21c

SHA512
3da3dd493508d2f4ace6f283fc8b8e97666a481c68f89b40b2361e334ce4af171e642ed4cdac62aa86761d02885dbe40dd850ca42137dc30b648a21637d85bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40d0b40b0525c5d0a508e68f020decc6

SHA1
514a2d20ccd53360ec10998f7ff23d8c2a549cf4

SHA256
c4c59f4b61b1a2aede9ba1681408d635f9d55af4cf70ecf724a2cab68d5e2587

SHA512
d317cd0f858e24acda61d1c9564689c9dafe9b3a0d7bddaf9c5b7ef6ebf1144735f54e736bbdf32e4df75b3919010b55ce66b76e5431909ebe25ac067c6298ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b2ce1ae24c121d8e58ec4fdc029ff9c

SHA1
fcbf1a909f2f2d5e57bed56d2ea1b6f7e225978c

SHA256
a90a7c533313dc69c402809bff317bb38e3cc60cbd447a87a02ce9580cfab5d6

SHA512
5aa7494dd00a55b158ac95df39942ed3da30595e0d54ebb53b867629b76a34587fa796b1c2de052ac3b0f5efef6b584a7c555c27618c9c009599356c48a058d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6980d3515b14e5992e18467b72be45

SHA1
cea7e81f41a5bee483676d4e82a3346a8d856a37

SHA256
865c341915abe2dcb1a9017d15309bda91b4bf259cac1fd760e654b6ad2aa30e

SHA512
e5ea475d9d0b554c8f1886097c3d84694617d303356e99b53514a7fd0217ceea5bc41eab218333bb41b68a06b5b66970c91cde4768262172d567189341c1be9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106e8e83240a2242ffa6671e96558301

SHA1
3a1ed646cb5dbd457c59df5af235dd311cd52950

SHA256
c789098c35f51506886a681d63a0c1c22b3759453cf2c10c7936121f6747dbc9

SHA512
6e65a22ec56e3c05c15679c241b853802b6dfe989bf4df6bdc140a409b790190c1b32c4a01e2a46778a7b3095e39696dfc747ef57a318a0b5ea92f83fa7938c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33EC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab347C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3491.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit