2a3c8b5b4ae515e99b51c1d2bbc2b123a8dbf19be2ea36d0ab7ff284ff0cf569

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

928caa7106585b7e684991957592b229_JaffaCakes118.html
Size

20KB
MD5

928caa7106585b7e684991957592b229
SHA1

c369204de5041834f82c60f4bb1ebac48ffaff93
SHA256

2a3c8b5b4ae515e99b51c1d2bbc2b123a8dbf19be2ea36d0ab7ff284ff0cf569
SHA512

b80589e33554d5d6c2f9c3a5676a8be1c8028a3101a1314467396a8a146ed70a3d10125ff7b40469692a608ad95dd363b51942514407de7fd1ad06b953a549bd
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIA4ezUnjBhKs82qDB8:SIMd0I5nO9HDsvK/xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423596351"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D68C6EA1-21CB-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2476	1992	iexplore.exe	28
PID 1992 wrote to memory of 2476	1992	iexplore.exe	28
PID 1992 wrote to memory of 2476	1992	iexplore.exe	28
PID 1992 wrote to memory of 2476	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\928caa7106585b7e684991957592b229_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f29f1843211ec4dc2c6d0f63e17774bc

SHA1
9207218bcdde0ad9a2afb944b5050c1081252062

SHA256
6db9b6780e9a236ffaab64ffd2aa9cdeb2e4e6c7adbefac0833f52a7d038f507

SHA512
704be26bf172d416210eb15c6f22e320da08fb53c301020b9057ff1d1c9736b9d564267d11d577c0c44ab62f0ac7ec7d12b43d995cb18f039ebf4246d84576ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f59da12edcf097aa6f2a3a8ce8735d7

SHA1
b9f9ba9915568ff34fc153c964684f5f5e377e5c

SHA256
91b8f584f5a1f19f3afb72af76bb664a5e38532a3d4896dc39bdf15ef6d0c156

SHA512
c42c9beeb6a95f567fb5f086798416869cc0c1a8bf1fd22abf706007677452c3c4be0e640a2188d6564b3deefee644b4823e18c6d2b04cf384ad274308d05752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15571feb11c6415033a9189e3dec4be7

SHA1
d463c79b3d778c791a079445997e0f3f62ee2026

SHA256
82cb9676fab418bbe7711227d60e6bef60d266499d18756a6a5d6f64e86ee9cd

SHA512
95e9dcc67eb2fc04602eef24e0b3cfdda0275d0805d45ef332ac5da53d80bed90075a924e64d090b94a4985d7dc84bce6736e9faa9316a138b65be66b99953eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb57f09fd9827a0a68ac6b7f655e9e0

SHA1
5efbd3d05a9ef7a1847e6500f6e5a5b2c7fbea54

SHA256
1d9361f6d47d70b7ee91f83c7311b76a989820f4cbde38e937d081425436da01

SHA512
bab36536ff5b1f2a374bd4f80f0f84f92b5536580d04190308e930a3d9a18e2625fe4647f7dc23fe33313d9a4b30a96fa848f836ec94ca56f6aa00bb7347e5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a55e85d91b33e539535cda93f63e52

SHA1
3321b1d341c30c74df4a225fa85bea49e20250fc

SHA256
487b03008abcec6cb09f2fdcb1ff30838ba852ac6a7ceb22676f5ad1b5436b08

SHA512
8e0ed0d23f8a44ff4d994d73d433c183ee575752bb01e237a973245eab27f15ceb04b11a3b66bb6b61bbf21ecc1b5f01493f5014267c1513bea54afb2c938fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f8fc88bbc17f747b4c10c77674d55d7

SHA1
f4dd5e1b3d780da3bec0ac3a2a73daaabc021fbd

SHA256
447cd0e5f2896bcd41e77263e07fe44942a7d60da2053ebc5725772df35a5202

SHA512
8e47261a7c65fe76ed23e3545ad15221e3b9d8e18fc252795053fa2150392e1aa23c0713ce268adf31599ce7f42d9843b50a2b8afdd635b41e4f34a86b5fb068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a03d9955647e040781fa090c9b2815

SHA1
a0219625b4f056bb55b850e20db6b05ea8fde054

SHA256
009bfe6f6b77fab7255c088e230a8ba2cd06cb88bbba131c25053b1fe596f133

SHA512
6476908241c5140b1b8ab59d21bcbf337d16d46ec5c460f34d5356528d5d34c42bb1965a231706c54ad1fdd0b20de8d5c0bd1daf697777aac0be20d2701770ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1226545a44fa754899d818acd084ee99

SHA1
2e319082531d80c7bfe2a356f6e770a6a0b83887

SHA256
b8074b2836c47a354c3d15d644d2a6641567acfc7c2368f22b0b3168309a5877

SHA512
bea8322d99e0b4e59d6ff5ca857cb207794a834e6aab51f903f987f03039cba218f65e6821af840635781030ad7809c896102a995b234a4be03d23932325a8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1879.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit