0b03950eb464f57a3f97d14898b49e634d26da2141b3be87328aca8ebd10ebc1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9295deddd688a967e7b8e66b081762e6_JaffaCakes118.html
Size

23KB
MD5

9295deddd688a967e7b8e66b081762e6
SHA1

0d09d0e5df23fed3f27d2cfa377bf80e437ce01f
SHA256

0b03950eb464f57a3f97d14898b49e634d26da2141b3be87328aca8ebd10ebc1
SHA512

c2b284cdb9e9e6c70dc2d181a43135a751ec590aff5e58e58b9d7996b08de64fa8ba37d54b2a90d82a8915d0d0bab2ba0ef0af49b65c4e2a99670ea5f60ae76d
SSDEEP

192:uWPwb5nT+nQjxn5Q/ynQiehNnbnQOkEntaQnQTbn5nQLCnQt1wMBBqnYnQ7tnoYd:OQ/97e9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423597055"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A25A351-21CD-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2984	2276	iexplore.exe	28
PID 2276 wrote to memory of 2984	2276	iexplore.exe	28
PID 2276 wrote to memory of 2984	2276	iexplore.exe	28
PID 2276 wrote to memory of 2984	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9295deddd688a967e7b8e66b081762e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9ecf0ff6c922b7dbf75a69854acbc8

SHA1
5803b49d1d9a54630503476da609096aa1494e41

SHA256
44079e68e3f894b5ee2b3ec7d769af746d08b5587abaec657487da5e2ab307ba

SHA512
b3026cbfbb76a20aa02c7fc11dd0dabcfe8b2dd97ae650f5ce229fdb018a02f00a63de37e443e397311e630d1a3b9bd3a8fb0c307ab1cb7e67c23e57e7da8b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8ceaa7aafe18b832cc9c847c8800027

SHA1
8307cb57133fb24627fbfcc6a268e0d096884db7

SHA256
59b33a572e294e7a5b3f695997a9af0c2f0a07722d587c663d0004f8fe48b08e

SHA512
c1d2d772c4de23ce1ddcd1ad5f61bba6918f5fc0ba4de69afafef3569629946c6b00670158f4b1ec4be603747ec8ebbe7e10c843cef21100b9260c8b746ca51e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44af43522291538a207b1d082b67d67e

SHA1
d24243e9d7275f5bb24e393291f2bd95ae40b233

SHA256
8a0647146551274b3c1b18b84882c95b5d7b2f2d2003b28a93349d9d5c2d44c8

SHA512
060a7994aa605fa83a855a21538a1f22fe323cbc70c0a8264403177803a0f56ff67ee42f6d26a8d123ba277066767580d894ee0ec0bf0957b6b4f15f7fac2d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07262af7198b79fc4d89b571a05ec7c9

SHA1
8f63099367e3606d8109ea7d6facb4766242e6f8

SHA256
d004ee8843ba8fc5d5890172b3fe4a857a67034557b87132d44d9fdfe70821e8

SHA512
6b73f78ff14d886bdaff69c9764a87245adb67bb722e7b1df28b674b48c1bde1acc2f243137314649a9eaa57a5140f76eac99af989a060854e2779ce3ba37b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88a40875780406e361955f293636c957

SHA1
aebfbefb823d7111ee1d553fe4449eb92a6f8b04

SHA256
bca8f837f08ea25f93f89ef5a5e1701521c97acbd05f0ca8273fc20330cbecce

SHA512
4465089c789c01c8cb9ebdf424c10809e6bee98023d1d71ee5cdffdfc8fa4cd79cc59c9342a31b122d76032cd5eec872dda4595c4904e998310fb06bab12d935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74293535339a2aefa84f9812ae56991a

SHA1
83d5b5556e100dfca185a6e8356e620195587b64

SHA256
36d5b21412cbf98aa862ce1ab43b8131d0ba14c25a157bf8432df7be2512f428

SHA512
bcfb0c156aef3386f924e804268ce554f7eb943a046866433a52fe0da7b2f4f5e189bcd6126ca4d8cc968b7844fed87f4aae2040be4e01c91ebf6521130b88cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a1bab10735caa9c42cbf5400ad779a

SHA1
0a3f13a1d141a435a604429665fe0ed3d3ad3272

SHA256
aa9cfa4f3c712a6f489827b2c610c67ee02711d29f8166d08bd66a0777f38797

SHA512
d1154301ac5d71effd66f2ed4559c132b765f5da5589d601e6eb536c42034e597832da6e787a202438daa509a4043f597a1068e3efb97a01d84b7e897758a368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdddf113b5dde1f12239eeb4977d58b0

SHA1
00c0e5c8d640027e680b0a6e8c4f6d54bca5f47f

SHA256
718c5c47b319504d55e9a121b07bee94c845c4a98ba9a3733b73c147ace5ea54

SHA512
71e817e74cb51407cb13687c3a1803cff0969dfa83110c560b54569bb8344cd2bc51639abb97b639051b7dcef87694e1d83c5b3440ab9bfff4262f0dc18b42b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4505174796e5ec3093d931fb4b917426

SHA1
259475fc822626e086e062b202296e7a92514bb6

SHA256
1118db0113f40c9fc7e5f32d77b837e35dc7bb08d2f7c23c5c4ceba808b85724

SHA512
3b70dfb58990479e814c993b3158e3d162fb6216eeceb5e2e7b718671572d6c56570acd353223e7ca7522f12c0e0aadc0a903a3d7a7b12a2d6360e66ca689712

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit