5358b948676cda8420d5ee9a676ec1d1bcb8e3f79d63caa6f6d1f57b6988536c

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9211fe1b99b5e8d5bc69bc7a40dd6a83_JaffaCakes118.html
Size

33KB
MD5

9211fe1b99b5e8d5bc69bc7a40dd6a83
SHA1

cf14fe0a720fd1035e48dcbc80069b0893d4ffbb
SHA256

5358b948676cda8420d5ee9a676ec1d1bcb8e3f79d63caa6f6d1f57b6988536c
SHA512

e12a8ab6a38e7e67da67740617680315b2a1a0668725909429c2a0b141beedc18050e7e90f3a93fff5bbb4d831aff5c91ab64f5e03b657372b0758ad18a16684
SSDEEP

192:uWvI+b5neanQjxn5Q/MnQievNnvnQOkEntIunQTbnVnQ3WMCTA2Bc4eQqZjxT5YU:QzQ/5WFIFZOAjqb2BHKBrjNOyTMgn2N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423585780"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37773AB1-21B3-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1756	1740	iexplore.exe	28
PID 1740 wrote to memory of 1756	1740	iexplore.exe	28
PID 1740 wrote to memory of 1756	1740	iexplore.exe	28
PID 1740 wrote to memory of 1756	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9211fe1b99b5e8d5bc69bc7a40dd6a83_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e5f5ddacb91d3939910ada8ce679985

SHA1
429d8bc196c6f5a4ccf294bfda1514857791a7c2

SHA256
7b4f371d1dc7877ebd256a00dd3bc299378b4de18215b6ef58b498d6b3f1f0a2

SHA512
ff36709974594564bd369ae7de37054115849d5446dc1edf0f5173a5ffbdcf6231162f52f7262744642125d5eb994729cd6ad92785b1513b9dd140b80a55b832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18048a7f89e18fd32bf9b4d75596b439

SHA1
556f30ea24c8ff8cd1fe00faf4a1d05fc335af68

SHA256
fb2d0e656e3e15196820b99c7fe368ef78f7ddaa0935a02f7f7c1526b21fdc01

SHA512
190674ba45d68ac5bc0bcdc184f724ffc7c1939ace9c61b30168c7007afde02cbbfb68c531fddd7cc0b0565405409ef58a6da2b8acfbcb61e0d43751da287794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f595945ef996b1ee53f70fefffffd99

SHA1
23fdb73d9709fe2e954af4547fa9a79fcf97b3ee

SHA256
f0e85e0124e4244531524fecd039665feaef3b23a8e0e1ac14c41c95652b4cdf

SHA512
5a3ef4aab7c563db7e7dc73989e08b9d7146ff5fde3ef29783828d1514983fe86876daa9f6c8c4cb941c160963208ca05bd8f31ab7d8f448d7346a2070f4fab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
003121a9ddba6f7a2c5544b5fecc3141

SHA1
dc5bb2fc9c164ae60b597ceaf957f64bda180419

SHA256
ee705f9155ba68fd1b4769f61ea7dd513fb499338f13ab638f1488c61fc76802

SHA512
5f781a819ee72e98c92c2b974ff3a595dde44363919ab0adb1878dabd50a0f42425895d5d8aa98fbd519240172b2a5d8c7a231619ad3716eec93f644820c57a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd09c1fa7b84747332972709c10534ff

SHA1
f91df82acaa98cc99b4051a27c6e2d03eb993002

SHA256
ca5ec8bc1b3329ed8ea26c1db669cb335433d171fe13d2f19a343097526548d6

SHA512
3294f21612ab8368929c275d12cf7f709697f13741c94040b406cfd7b319f3bdbc30340ba3d7a3765bb8796b915f579b38c9413188fa80ef5e6689929e5e18f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5e91e65413907b3d9e485dd3b1f730a

SHA1
d0a4cd9392f7afeab23ed82c1d27379de21ac56f

SHA256
b700d0209712c19bcdad509cf61ef780215587b7b818ae3906edb0c66eee6f3d

SHA512
1a8b5c5d22e6b2512b36247ffd72540b02fd8bd7148cb352eec707149efc4e1c5001c28cd4880c88a12f6f49eae85d50c75602fa425829d4e1c3c57436ae80ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c45b607e42897b7cd22faf9cb5d08567

SHA1
695041fd9cdfeda06f6938830dfd26ad222506a8

SHA256
9251f7ed861650fda44062ccb3df764ca4bfd16c95e6e09161c1b9bc2c99821a

SHA512
3fd110dced06cc4e0094b0d9ab0c52b4dc5491fcc77d1e8d1ddc45d63896ba4f10a8edbb223a2a37fdb051fbbf4c276e81b4ffc9b43cb79a2ae3f2e4a84e6828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d806c068a4bacfa9e6ea0f3eeea5aa56

SHA1
940a686a8ba8b8e6957f1ed80da9be3897781db4

SHA256
6f2ca19c98e5f143669ced9690a513cc3adf1801abe3a7fc7d3d198f87db9754

SHA512
9a8404d56699c5239d0476e7b08d282d7ea1f940f261bdff7985f17bfab3f3bda53b8ced39087ebfb5f1c76b2503b99ddfc1e9d4472ac3bc5ec4486424a74a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar997B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit