57eb45d263c30555a44e0cb1c61d75751f27da794253723210096e9ed5a76422

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
Size

27KB
MD5

9699487cc03022dc276e3e084f55898e
SHA1

c4697824d8b5a5481b89c24b983c33f1125362d4
SHA256

57eb45d263c30555a44e0cb1c61d75751f27da794253723210096e9ed5a76422
SHA512

30e5713a1929046e494b261014459a34a828ffba9f37e63493fffc10fd9f7dc59f6d5f06520a8f87698da29f07b65cc27bbb15daf2f361c3413feed2d7aa4f66
SSDEEP

192:uwb8b5nUmnQjxn5Q/fnQiemNn2CrnQOkEntdJnQTbn5nQ9eUWm6ApCEQl7MBGqnc:BQ/IC/N+qCvSYx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F5D0CF1-22C9-11EF-9969-66DD11CD6629} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423705108"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2944	2964	iexplore.exe	28
PID 2964 wrote to memory of 2944	2964	iexplore.exe	28
PID 2964 wrote to memory of 2944	2964	iexplore.exe	28
PID 2964 wrote to memory of 2944	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9699487cc03022dc276e3e084f55898e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7a1599d532c29b6df4d6ae1cf7ebfe5

SHA1
305a48eaaacf9869aa7ea9a181a79769b7ed7367

SHA256
856899570a9a18c518ce4b83a5ffe39aa7268af0cc6b0f8894eec6f1a633c109

SHA512
4ba203a8b1afb78488a2542c617dd28235aa387dc07df3ebb25bce8318672c186ad7175a90e3a41f28b9f91e504e6710675488a51b6804b56866155355699c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cbdbf47bcf56fded0b180d773a8b54a

SHA1
067103a1b9e3f82c84493b703a57d6b3bd53d574

SHA256
de2a63acdffe3778e9ff71314f4e741a60430d238defcb8a4effa64aa066ac99

SHA512
c041c1f36c590592d264825c46cebc674c2bf9a7b4ef53b73ecddcb1da6f8acc93f201866cff55e845b7c712a39f96e346b8f759e623baa376086dd2e48c2279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
564589d23f98f3ce7f8a1ff12d810c50

SHA1
80647aa9ab81295c90ecc97df022a0613e9b89b5

SHA256
4f9dd11fa7540e653034cf1511ecaea75ad6b84814f024259a8efea574636907

SHA512
df648764929adea6bf2ce5290d84f5c7d19b5556040997d62f7559fabbe51425dead6dfffcd5c44c4a5fe4c5868df1c57c146ced85821452a7976b5bd2d5240c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2ed4c0a157fe869c6d838f230ac77d9

SHA1
7f2040aab66e7eabe42c44a69351929013b21ffd

SHA256
f1f1c860c31fb26b4ff9403d3b5fd6591b4ecc91d343d03c5e3d3a76d564a7c0

SHA512
c795ac09a2727ee6c6119204b18632859fae678234ddb1854725d45b92f7673c6c3aaeb47795b7e3f84d0a1784c95cbfa489a963456677ac97498ebc2d12be99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d2d1fd7350865871c7c4e96dcb0ab5a

SHA1
d2933860b9c3019e40cde05072ae6c21507df57d

SHA256
b5b4737a380b4b692752cec83d6bbcc27530c9d829a22065db28d257fc180f00

SHA512
c7949f0fa0c7d9a892e19b38cc4e2c4834f6d89507d193d3fb3bbe3d29978d6203184a0dc70824cbe87a84d779e8dd195d04a1a105c5808d106d4e35998eec4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
616f5b836e04a6eb8444d6696a7fb27d

SHA1
6a430c644c1c2e3faff5d132beaf5693870f7ea4

SHA256
baa8f9778b9c43dfe4109900d1c649a3c21460e4d97d6283a077348c41f347ed

SHA512
67b527e904eec54a90e4bd6380b2afbdfc3af29b97e774e2f991a49f43f08e37a6e897327506a857d49061bc879899fde027bec5043bf6b1467bd5430d5c5157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5086572e2e8a728f2e694f94cc8556e2

SHA1
95e25ff75c66595cadb6f34dfc359d2e5002aec9

SHA256
6a3c5d4927ebb51134eefc983629b13e028e87c93958e7e0be87d742a5935ce7

SHA512
5e872ea67580099eadf5ce4132f5d2381ada6a0a568447c29252de4b66935ad5c49d3cc359e61391f6a38b54df01f303fc9ddb576ec1ca725a00e5e08378cf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d1769a8b354f24d4121bd5f537b571

SHA1
90b86f2bf7f99943b857b24eb4d21fbfcae0f4c0

SHA256
cdc4deda544b755757679c9f335bbf9dd3bc90ca892bf6d28b0264ad83bf378b

SHA512
c0219b8f4f0abce2768a6a22b73b4b8809edf574a4e6b11309d2d8e5b7a0db49a52b841306619769644cf0fdd2d9a1fc0d97367eec2751fcb826d96157e62243

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D98.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit