a3b0e1286e2def92446ae23cf76e0f7718c0a84a59bfeba48852253f4d22b3ed

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

927eb99a9140e5f7840b7df5f92955f4_JaffaCakes118.html
Size

41KB
MD5

927eb99a9140e5f7840b7df5f92955f4
SHA1

68da21767154a1b8f5d8850d7df3a53aa1c6ee76
SHA256

a3b0e1286e2def92446ae23cf76e0f7718c0a84a59bfeba48852253f4d22b3ed
SHA512

8b5e6e8e17f9990d8b65d3430f526223f7eeedc28c4b6d510a4ab31db5134276296a592d29fcdc6b976fa90156441b85c81e691648991347f6c35779b9f39d7b
SSDEEP

192:uwfzb5n6GnQjxn5Q/inQieBNnNnQOkEntuEnQTbn5nQmSwxxubtisEs7hQmaEgBJ:kQ/GtxittnYVs6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4B21441-21C8-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423595007"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\927eb99a9140e5f7840b7df5f92955f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95c9231db452285f7644562cb2d47d9

SHA1
d410bd8ae4fa115283856250a71a6cc763d45aa9

SHA256
ab00b60d960fb4e0a15ed203064c3e82049447d98daa9204804b581b8ffd36d0

SHA512
e365a54fd7031641e27756fd67c5529882aed0393cc0b5d3fcadc79dea7618a7ce24d79ac9a477d05e1f9319220d27458e124c19b6fb0569b021517f35546dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
647d234de7f34ab04bc62b63aaaed8dc

SHA1
f287d3915482f25352bdbfac120acf071b4f41b8

SHA256
33f2a82ddf375a76efeca0c7dd79401fe817c9cd07d7f40cfd5d900b413b9d8a

SHA512
a60cc73237626806824237b3dd9285ec576a60afd93157c384652e68cbc72ac3e747e5a98cfeddf5263359cd531f42783641f62a406cb01324ff246941c399cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e03a84308a6e73da1fde8145cadbae9

SHA1
d184ab312ec5a48e16557883c832905291af66cc

SHA256
afabf2c1e566aef047b3771dedca1188a8139f5b369e370da5aa58c33f96a1fc

SHA512
65549a6d70c53f38f30d2ed9c858e8e39bf4e93db2d4a502443827a2b8514938039e60d469c20c516e404738f6f58a43df9d501d92a7bef9d2fadb3e11a2c842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a18e146b5378477d3cfdb70ad8edfd2e

SHA1
c20bae4228dfea983048d339cbec42aad15adaae

SHA256
7a139926224103c5bacfee58ac425f0509588d663b68e9ffecdf3e5e8552f8cf

SHA512
39a2444b899f433c8325c3adfd9a1baf23c031800242b9e848095f3a887df25d0a4a7a2991e60ace984703357b276b89c62fd21d17aebecc17cdc8cc627f7de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9db9fee690f5480b5a317c709a4e24d4

SHA1
6025c586238fb62854de4078906ca9254d1f7c2f

SHA256
e3ac10b4b30ab57029f9c34357b20249e23c4f4150ea7739819bfd0e1c39543b

SHA512
21fa1bb3530374f9d501dd7c589b65057cab45e199dbc54522f3747e3ee5014115224f5c834ca8313298ad2db80dddea4d82a93f2a1472e3704a2a671852d019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c916432329bd4bfd8c51a647d37d7b50

SHA1
5429b2f10bca45948c4604aa8b015794c57b4b57

SHA256
b7ce00e353904a21ab6e481044574d312fe645799e3bc267a0698fa8393498b7

SHA512
e6ce2e69d2b85cbc1a93ece619efd3348dc2b77a9ab62dde60ddd677f585aaa244aa217f0f36ae646e6a328fefa0381a8247132376fa283e79b46bed7db87932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
063b4bd26accc713ea83d8b0c64b2983

SHA1
9fa152de7f872c07dc2c120d6a4437dfc9d97b11

SHA256
673a7959d48ec8980a34b2e9b0a89f799a85dcb58b3ba6997bd1140462e79c40

SHA512
0d868d2e93e2a5e6aaa5ceb2d622134717d80b994347753fd1063965bc8adb78b9a2a023b6cb18d8b1af1cd6cc7ea1195abb01c1f199751e4115522cb413e04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b5b0726422191c5d96aa1b16b9bba45

SHA1
01522802c64e75dcf1b2f3abd218efc5d132b41e

SHA256
a111c64e71c7e6acf2dd791a8a7070397c0c4f4f6a0c4318aef98628204e919a

SHA512
0363fd1c3280ca46aec68975c05663903a61a6a93dd69b67737868ef5678f4f9f72dddd2443904ee6479ffd8ea41b8c0560b290ca382be2210b2f2936cbaccdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69123476fb047a4c6cf8bae549b39936

SHA1
5414e0bde3219caffcd643370f7b5afa2f3d416c

SHA256
5d6e7c41928e5bb97ec3f390f4d05aa8ee93d45fc5df7f2abe75cc7b7e55ba52

SHA512
c3f913f2f635f6c5ca28527164cabc533f60013396d5f44a7d2b62fe26b6aa3cafe5ac1e8c40a44c67cda0f18ada91e781a6f59cf09c80f202b2cb4a6628ad60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90DE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9112.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit