17c88282a7a522b02209bc3a59115370bf4eee7cd68efdc20e2cc999fc93f6f4

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96b052335e60ae1bd9286e3b2a7844bb_JaffaCakes118.html
Size

28KB
MD5

96b052335e60ae1bd9286e3b2a7844bb
SHA1

92ebf3f463adf5e7b365d683cc36c876bf8cfea8
SHA256

17c88282a7a522b02209bc3a59115370bf4eee7cd68efdc20e2cc999fc93f6f4
SHA512

5be990ccb884c7afd80f1ddac6c37abd8c535ce386c34078fdcc2e584053fc14fac2eaf7da295a727bf3b285be31b3082537ecd66eaf89c508b6f76354ac2a26
SSDEEP

192:uw7sb5nhWAaIqaNnQjxn5Q/ZnQiesNn4nQOkEntPDnQTbnqcnQ9ey4m631K+uOTo:dQ/svgFK+uOWSIZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D636011-22CE-11EF-90CD-4A18CE615B84} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423707279"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3004	1632	iexplore.exe	28
PID 1632 wrote to memory of 3004	1632	iexplore.exe	28
PID 1632 wrote to memory of 3004	1632	iexplore.exe	28
PID 1632 wrote to memory of 3004	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96b052335e60ae1bd9286e3b2a7844bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3521c20a1473fdb32297b91205c5cfb7

SHA1
35c30d93d1d40928256d46338b960e2fdd1a2ecb

SHA256
b26d6283409e1fa7534c13937357fd7e94778162b9145c4a23e23da68ce1f244

SHA512
4f9892475573e7f84df40f3ba139597d7dbaa45b2ea4d1743b72d8341161db9d66c42d8947d9fda38e0e4831401656e70e6189cb161e6f05b5937c9bdf49d519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b6a31f5161fad2d2ea756a8ec40eb3

SHA1
b4bfc05b5902ca11210027cd777f88446d63438b

SHA256
07296af63cc88d955213f73bffcd220d55d287a04e84858773b0fd53d20652da

SHA512
51205f436d71a1b415b7f2ea97b43a8e7eb05cf0b1354ff95aac773dbd2249712ed05c8730ec048ed1520dd4bd76a261eda79e3c4e0912e1e972058e76aabcd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3c22aa3f2a52f3db26003e4190a3f41

SHA1
2a6bdb1ee17b3c04df9a81af20d2e062466c6446

SHA256
8cd56eb952b8978622d4342ebcee1e99816d0da047e4f2d2330da183bbe5788b

SHA512
43f1df3ee92959806fa64ac15b54022b21bde70a580721f8be58f2c2d62f21a6be5b9e324052732f00dba25f98de5f40919ebc013c9c94148405cd1d5337a916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18c0790ba401f88419a34d13934645dc

SHA1
d0e8f13ab7d2ef10d1b16576980f8772fdeafba9

SHA256
6679a99eb44fb00b5e1751b0a13e3c843ca52aad32ca5f71bc6960d69ed08560

SHA512
d6d4b5143497f5561a1c38484f98084369254bc3172d58550520986e580b0ffa6c6bd9da7e157260c6df1a1e05ab76454901e97647b26144be991997db9510b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fa9474a8958e0e953cdedfef454345e

SHA1
d66477fdbfea4fbd2b5021129bf5a9d911655dd9

SHA256
edf809e2c998bcd52eab1792aef8bf6321017bcc9c8719a6a7e0f9237c3ae791

SHA512
2d075e8c04a2065ee7dd0e93ff06c13b0742648d90f3ae6ed7117736fb936134c2434907f11bbec3b6c8575b112ac139780fdf5d8814871c78de443f74eca58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36187d006f72b1f5745597a551426137

SHA1
970ef22e0fa332382b89e96d65abea145936ee2c

SHA256
b1a8ff941427e55a5bc3c697a3390642567c0fe3426e4428b49008817808f83d

SHA512
5b3f64684af5cc102315c64c136bc74d1431b277b0bfca7aea8a37fb92cb6f3355d7e9a56405c00c622d3952b257e506c7d8cd57c53f97e7f6de274d0a34d2a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb23add4bdd6d5c278f11b0fc70925a

SHA1
fb51ca1fba6fae5531022cf475b386d17fe4e170

SHA256
51f59b3751605d59ac68aaab7b2b24d6b57c98d0ab25ea3fd59a8ad6fb6e4bec

SHA512
9242394f0a9eb31421b0ce515c40432e2cc3cf83594e04c38a2fd7f3b33cd19f98e596097870273127d43ab77546eaddbefb820112498f07797ca993d27890e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5862160f4b302606dba2afa26062b43

SHA1
b45decf634f68da8d13629b4795113c16f2434a4

SHA256
0aa7458a50469661d43aead5d39e2c55fe827e84aa803ddabc50c3c3b84b8c72

SHA512
f414f02165e210b6a11d34f96ef6386af28b6b97af70e1e48dcb9100692ab3d07a7546195c089bba35ee9381ef5a92acf0b99f9cd61d01b3c86863922552b7b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0383c49b90179508bd9a5f697d2ff58

SHA1
a0f440d790aaff17c6ee3cc9f3be1a40da2ffb91

SHA256
2f1f2fb0631ad2286495bdc9b280bf85fafcc5aaf0894f25ba7b345fa9774f4a

SHA512
6e656b4e4f3e49c73a1fd4c2b2410fdd252486f34d87adab26af0f56e5a04fbec647c5bd712a33427a43ef49ed90be76323eecee9c80ef67b90124db1858cacd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB58.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit