e0ab731144f440321b31f30c1930f4430eb2e587b595dfe8ffcbe41a10456550

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9270c91935415aff5a3b2442c59cb253_JaffaCakes118.html
Size

26KB
MD5

9270c91935415aff5a3b2442c59cb253
SHA1

a42fa67ea78837cc13dc9354a3d526705e50597d
SHA256

e0ab731144f440321b31f30c1930f4430eb2e587b595dfe8ffcbe41a10456550
SHA512

d85e0dcf5045920475b7d64a1d33913b3758c76248e4c3d51ddefabf6fd3ab82e2413e64d4a84752db68cefb5a1d54907c6923c0199ce1f408ab585baaf1da5e
SSDEEP

192:uqD33zb5nRKnQjxn5Q/snQiefNnPnQOkEntoWnQTbnNnQbCJVevo7NtCFo+NzQ4u:nPQ/NygcdpNv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423593916"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B289D91-21C6-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28
PID 2088 wrote to memory of 3008	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9270c91935415aff5a3b2442c59cb253_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f247b4c53adb802b6b9ec69480f193bc

SHA1
bff183244c5c382bb65413ae436b82d519878be1

SHA256
07393106d87f769fe600197e51289be44e1a8b5ccae1e7a5f2b0b3ff7572da0b

SHA512
05e3017bd4fb685edc8d79fdd8c20c2dc7588ce47aeb5597bcc45ff45fbc0b051bc6941eaadf1b80656c672fe6593f4719c4cf6be0a40c8a15b92e7c01e90df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbac722fce593754a68f36186e5298d1

SHA1
ee223311e7001f2534de23f9a50459dab68d4fcb

SHA256
cc24ce99299fec53d527a39504f02cba779b4dc6bed0746c5b8128deb59c075c

SHA512
99ffd62b376372a76b1062933458b10708aeb77e34f2b15837f7ef58b167e821c84358903f9a8ebb953c2f413939ef8ded8e01e35d9e4110d68fd1bdb0870ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
771e79e4c5281e56542e60212c931179

SHA1
d089d86c3e380f021253fc6c795421f374298555

SHA256
b70ce72cd064a7b090c1233c70e16efaff6e349ae1e4f729ab9c4d899a312640

SHA512
1d686bdbb2ab09eed053d89b4dca810bce9bccd973631d18ce6f20ce5434d80d7ab67ecaf88bbc53334f847e5e9e66c623e273ce6a3faa826df253f187a89576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
613a867e9012f2bf93d21281bd7c0a66

SHA1
e7f4939e83cc88d67f05fb3cb5a6c91eafbe4e19

SHA256
ab37c04105ce796a5fb641f4af63ffcfd6ebb67c963ef336a8b3f2877bbd37f5

SHA512
3b6aa3a3bc04374407361f477e64748f81dd5b329fff995a2c7db5854a7560de03c90762bb8bc39549e28905b64c5fbc069b677eeb49853f7ce2d36bfbb0de00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb4b6ef206269cbb49657e1a4cea43fe

SHA1
c838926f5b23e5c2abb4a1a86f8f940579e57cc2

SHA256
341f77f4756e6f0d8d5f15e4a1bd69b733efa15f6e357473d367f51004fa436c

SHA512
5fa597041cdafa28421767f601b4a2509e6e537b0bd6d4357e04ad4ed4a2af635486a656bb93372b72fe5e369d659381e449dd21f9f039a1118c660c18ae1cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
396f66c87ab38460d0ae8cf385292193

SHA1
ce2c4fa22f7fab300a53164111da35e370dece81

SHA256
bf8862f692ec7cdde87158bec0594745199ff0fe2c84fdf5bb2d2ace82ca7f89

SHA512
bd055a2c0721483339efce86888623d9afca7c7dec22f120310a4f75d997b8f3479c56a1bc3f1a3a1e85a2b73ba656c3736de55354c804f7899dae42eee9f38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a520b281d150b4ae0b8972be24c8fd6

SHA1
46703e54ffe0ca5541494b65242c95d8a5bd3f87

SHA256
0d7c3b19bddc057022b0e1b0eceb5cdd33f6b01a473956d7d842cadd083a67bf

SHA512
fc14481a20379762397c261cc6db6daedc275e2a08132765911e365095841de22da82c44f56a61fda7cd423ea5408a0a3f8431b9bf52c1a5a3dc1c554f2f264b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75a92241011733d488d28e7305c8cc33

SHA1
9bb6a8b2bec5adf67f28ef98b4b8766f29f155f0

SHA256
03cc05ac0f4dde2388cf861551a2c96bac87056146a25f2dbd3b34f242c6b6b9

SHA512
616bb168678e1b70bd1300e92273fd37ca318fc19b3a2f50cb3342e86df090057c904456ccd27be3f0dd35fb5c761d0ae3b78c18035f23226ab01474fb3aba2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ddf57dbbd71a13d5384ed09a582df83

SHA1
d3c10aa210cd64baa22c548a4ae8fa682e24dc3d

SHA256
c57e0934140f8e1dc8a3ee03050224ac310e9328c7a24225520fdd1b7740a3c5

SHA512
f5acb3b55bc896cea662d1a7e4b6e6bb3a24ebb91a4d32888bc89cd828d37c8c4bb86ab2a6bc7236a5999eed472f8274aa2655c4935d7aab8be13210f2af8243

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1364.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1464.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit