f30719dad87b2824c0f9fad4ed79e8d33faaeaef7784aa36dd770eda59357c15

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91caa87958228e7b935a0db2f8d057df_JaffaCakes118.html
Size

946B
MD5

91caa87958228e7b935a0db2f8d057df
SHA1

2d467cc144721de837fed7afecd564664951b823
SHA256

f30719dad87b2824c0f9fad4ed79e8d33faaeaef7784aa36dd770eda59357c15
SHA512

b7cf1a2220287695eee71cbdad999bf1fc7faee478f50e04a23b62bb89d26c3488096e9c886597b02d4e511d1362ece317a0f149b59eb05bca1e57089f5165f7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423579748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DC81331-21A5-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2152	1984	iexplore.exe	28
PID 1984 wrote to memory of 2152	1984	iexplore.exe	28
PID 1984 wrote to memory of 2152	1984	iexplore.exe	28
PID 1984 wrote to memory of 2152	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91caa87958228e7b935a0db2f8d057df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1c7bea0f39688570d3ec8dd426ce488

SHA1
dd7aee5b548f9dcc3e456c966d7640ccbd741611

SHA256
278e6b44a8a12200e3789c9e6da5985e35ab581c971816cbb5a1201f34892cdb

SHA512
8ed476882dd2b969ee8b3c8b61844122362fd18ebf26959128d9d36a2fbeea4b8fcb5e7425746160502bf5ecc8629aebc4f7e82256c7da6d67794d9e543d7523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf79828cbf629dc0b24bdfa70c830a6f

SHA1
e38ef5debde53a7d3532d60d3ebf1ae3357f71f7

SHA256
8767fa8cea55002ac37907c1a6428ae600ccf6a1f49881bc1b25508322ccc928

SHA512
cd315e0731e642bcc603e84b50af5412b8fbc7f18bcda2cfd6cb007546b31a3c123fa778ef351c48a2ec4950d9d33e123cecac57a01ff2790520b817ce3241e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0e29875cc194d6ff294c04713f519d6

SHA1
7e94f7541194f9b96a05b9bc5829fac6bcaa1528

SHA256
6856802025490d05a555c33793db50c1d360e6b23dc60e03add7b9eb3e7b193d

SHA512
7a4b6835cb590cd2d74dfbe20471356bbbceeb0c49f99b822b59b435e9cec392dbf510ef38223db4158ad953ce12bc6edda55d7454a80932117692195e07de8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ecee971ecd3d2fc6842da4f69aa165

SHA1
75ea690f7f3b3d259eddf0866de4246ff5b2f3c9

SHA256
f9c0bc0964f521e987e68911bcb2e1587268954b8bafa365716844932aac2029

SHA512
14464e3f12a57714658c7cbd698ab423e8dc0ce7fa72da709274c96126cd8dedcfa8acf83c1445e85bc4aa68094a473535f1ddf44fd45b89bbd3928de0ed8072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
315cd1143c7712161459502fdd5d8a55

SHA1
2eef42c66836a249801115ca5b33edb3575602f4

SHA256
0f7545798ea089bd54f9d7dad3c02deaf0de3fd4be6cf363011082fd473dfac1

SHA512
cea4a7909382641d935f96e2e22fde4b2f9cd97bea8bf9fb7d2c0cbcef8a0c9847c15805f013ba12dbb72b0d96157aae4ec05f2fc52cceb43b6e7c225963c8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15fdf36878a6d7056076d5cdef8e3fd3

SHA1
20a44e5d7b30bfc25c3418691498292eaf9420af

SHA256
4156ec6efa44e521f358b6dc260fb1e765537249f9f3c983dbe3e53824c27e07

SHA512
dcc33348445799ea75e0e3607181eae16df9347da5b4870f8ad98d97ba1b613b14a144646b837aa465451ddfda071094f5098116b82b8c6ce09e20e0f9c88c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43db3a33839c68bb8b8c42dcae960e6f

SHA1
fb8008a0d44d901caed75dcf088250870c2b0908

SHA256
c77210a8f12fc2eb11df859a62527d920204a9072ba263175fc9d75d3733682b

SHA512
e3e9fcaee0d286e02de9ad9ae4d267fa3605a2931661c8618feee662e8b0bb232920c7fb2f04cd605619a132bec18b48c972eec0f244103398ef5e06d51d39b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5355046ef9655683b2860cfdc7e54c2

SHA1
30693b8a83d02c9af6d8793482170c2961084319

SHA256
48ff99408ddb4561d869f8bb84e85e922b2e7665f79f4995c858f5c76a93975d

SHA512
61f621f3f79dbb4a165e4f52716d3f839698dada2744ea18b2f44ae3ea708436e953d0b162b389a86ff949641a71e721b48042be8d3e9bdc61b943d01cc226b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4078366de3843ab3448f02e6a77bd144

SHA1
eb3d739899af2c3c8aba419c9ed4f6fe3afe0878

SHA256
b5a2caee4dd599ffacdd148433d56c3df7749bde44af66adf1b8f81ed2248895

SHA512
5eb31e263395be06e3a11f194b7deb35eaafa7d8f5867f60452d0de2468829c50aa54eb0cc39ddbf65554020cb776dee5ccb5a10b17dddf32c6d174d2177f1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A46.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AF9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit