27e97fc1ab51314318e43e33c657a63a436b8746f7d49633475423c2d8974269

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

925464eb5e54d5495f9ae3b46b7ffc2d_JaffaCakes118.html
Size

26KB
MD5

925464eb5e54d5495f9ae3b46b7ffc2d
SHA1

9b3b674ff602ef81b51c8150b895b26b8ac94809
SHA256

27e97fc1ab51314318e43e33c657a63a436b8746f7d49633475423c2d8974269
SHA512

8c0941b9a73dc95e8afebb7263063499a414d6346179bb524a4f09d1a8792bbb677aa157516771453b6fb1e5fa79e94081341bc5056e9cdfd68e38d2eb271f26
SSDEEP

192:uq9PnFb5nr2nQjxn5Q/anQieJNn+nQOkEntKInQTbnRnQxCJVevo7NtoFo+NzQ4y:nVQ/wygcHbrP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9C749A1-21C0-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423591659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2516	1760	iexplore.exe	28
PID 1760 wrote to memory of 2516	1760	iexplore.exe	28
PID 1760 wrote to memory of 2516	1760	iexplore.exe	28
PID 1760 wrote to memory of 2516	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\925464eb5e54d5495f9ae3b46b7ffc2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8de7eefcb81fe4db371b12b6f686d7

SHA1
bbd07b77094d212012d1aace106188242066aec5

SHA256
26c7e0d0019722ac4c778dc88c4c5aa9896f3717ebd549e08266922c4d62203e

SHA512
a50d96fceb8654396e9f10c3cf91ef2a0789efc27bfe5b0d57bae50bec5e2f9e9a85c5f3229ccac7a9d9ba937bdd46c2a2e167e9fff3c37cf0187363dc492fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8315526c5fa0672cba617948a7ed27c

SHA1
90ff346b66f21699f4d7c718b221f51aed84688c

SHA256
ccc7e289d355b11a728746b45911ddf0632db4ac36e047beffa0aa31f37ce9a7

SHA512
e6d048f861ff1e57d0189853dd2483f8de67dc7e12a76e45ee6a974604703aabea34c3d10a50cc0ce0bd7fd2d0148d2c9d7b47cbb5b95d4d9e60d5f2e573a9e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328ab78a10b726758bd572176e241fb0

SHA1
2fe4e4dc305fd81650ef4329eb36f5c0008aa24c

SHA256
30d6bf85f6fbd3242dd512cdba5dfc126c0c77a846ee697f0bd1597f2f4f34ed

SHA512
9b5e8c68eb8bd8bb43b2c1c9120678956865d919dc1a1bf1af54ef320e35255b424b3a39c87f834660ae1a358954bccf42af54f3c2f88a8c7843a3d039843572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df6849ae32ed54917a60233651b453e

SHA1
38dab68a9c77eeaf55fc14edf7dff57b5bdfb5c2

SHA256
60b590519553e8cd6495937a226fafce3dac0edabc8c7f60ffa51b8a5c338942

SHA512
69fb94c701583c510b31b814fcedbf56ea33d685f71b526522ad27dc591afb314c4a040759c07277a930869d9414ac441e1c0af3ceccc535721f226980d20302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32ad46f3062def3b05f740a8da6322bc

SHA1
55cf297f7d5555f1a40f5a92295c560a7821f8f7

SHA256
ae7223bda0c3af4ed8d0be48b56bf8f839295f2ec1364d8945f9c8e8bd3fba12

SHA512
18acafc210ebe9d61d98d240c5a1b746f57b634638b886cb5a6561423c2b24afc7d5c27039f83a8c0bd41a53feaf6025a4f274af98018710222e07fc010b7c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
168235a9f4ebe89be8a81dddadf74ee6

SHA1
f9fa03e1652a50be5236cca97d8e2213c149cfa2

SHA256
3f543b9f3cd857a37814b5220eb5fca370412db800970cd1e50bb711d09dd662

SHA512
b723b555c13fcd5f9c7f7b8aef65ac1549056b1c347ab7549626befc7bffc17d84d9d1b1564217fc26346bbf787083c0c51c4f096d21293c375c7286763cdeb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b1232dd715bcece7494afeeea31934

SHA1
94dccc7ce19c43dab8eacf7c94e3d4859ab05740

SHA256
b1d2bba619d1953653cec2fbedf4a7216d5d5070196ea2afee3ab63097ab7262

SHA512
78d453ec86947f7f5824de07b30dfe3c72b8ba0150e9db30150fe0c9786d6d9da4a3cdc14006783ec727ea47edc1d65d206be34400a2d63928c0c2139bef0b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
594a6af0c041e2285208f58c1139d82c

SHA1
a3a70b054cc94b5704efe7d450cf3f0f2486a107

SHA256
bd9267d20c359210b8d7b103eeed005f80cea458fa648ff3044d06d1d1a98ea5

SHA512
ed335e43a6c7a62e0acb47dc8bb6ff44698887ec3fa4f69e8368f2d140d14295866c6fac76b35eb275e422809b5e70f70e72e24e49f2693c8082fbbe0ebfca4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42125b5312817bb542edb7895272fe26

SHA1
2512aff8321a037c73ff42cbbd2af840216174db

SHA256
42983abc4dd7d58d105b8cf12aaf2a785934ffd59900c9289f00bfc1eac2f8be

SHA512
bd673891a6a5dc4f0d3a8dc7f152db0a393b22c929663f9e24f38e6b232ae5fc9bd5ad56c7275b59fc2e081dff7051b514964323cf5b3fe472bc29e90cbcdd7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B9E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CAF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit