74f71cc1b765d11db102057c831b3a8759a8d4fb461887eb619618c290752b69

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

937cb91753380e2e4d6b9400c5cfa262_JaffaCakes118.html
Size

31KB
MD5

937cb91753380e2e4d6b9400c5cfa262
SHA1

c7acb67dc992591bd48bb7986d04b945130167c9
SHA256

74f71cc1b765d11db102057c831b3a8759a8d4fb461887eb619618c290752b69
SHA512

ca982eea245cbd30132bf75c170580bb316ce1d604c6c2a18e8eb683c0ca69168dad0dec76ace9f42e4347c66c0ccc0e84fde1182be46ee6d4ae57a7a862687a
SSDEEP

192:uWbgb5nmZILnQjxn5Q/snQienNnrnQOkEnt4anQTbnZnQcXCI4Ae3qRiv19UMs05:bQ/av4J6RivUMNTpZx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423633225"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B12C3BD1-2221-11EF-8CD1-FA3492730900} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2368	2172	iexplore.exe	28
PID 2172 wrote to memory of 2368	2172	iexplore.exe	28
PID 2172 wrote to memory of 2368	2172	iexplore.exe	28
PID 2172 wrote to memory of 2368	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\937cb91753380e2e4d6b9400c5cfa262_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fc6deca289753b260b5eeee991e54f6

SHA1
3f78125ce597afe5a139bb91c331075aacb1065f

SHA256
8a58a1e75f8037edcc6bd86694cf2c029cd48e1acdc86a5d33c2b118c467cc01

SHA512
f82e96c9a6e24f0816d2d49a7f81c8b523c1377809d2b42ec6946fad8c6f5e3c3e2c4d4a0d7e74e2a993fb80959572d0d125143ed3bff8a8892a1642a2d5bf11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef1e1511850331f46261b868ea1ba479

SHA1
bf3bf8dc409eb352afd74cb0b388d15cb082998d

SHA256
5a6eb6694ca648c7ebe50c851b9854b66a5c9d2190c4aa1c973fa27125e0224d

SHA512
e0f9b8b04be16a8810307d23aa2ca2de0dd75b7aa3358915b9850628b21a4a9cd099a982c010578879857a8037feb3cefa3a49ae2b64fd657cb1c97811faa005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
add5b75830fd0a7cbd050548b6f96834

SHA1
a63f1f0dffe81b053c6d030eee76f8beb8dca01c

SHA256
f4180ff055892357ad3a9cdd9be9898baf5f03e669cb280b34e586da29aff91a

SHA512
a017cdf4ef3bfd22282a110325ee20e3c6e6d6b229fe4993e0a029d3fa20436425cd87468b17e59f77116c614b0f050e8c98c72f0fc0b7d252c647233c5ca0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e81fb701701843732bfb4c34a042e41

SHA1
3506a3dee6a7231aa8ef4505e133c39e4bea78b2

SHA256
0286b23af518bbac446c089b58d0ec1bf7e15f43de4d3cfdcd6a87daaaf17344

SHA512
5fe07c7f2811fb650d4c9e516b975a18f8ec484d7e2bb87dc9ce1eb580a9963b143a35ae3e6c9dc406c34211f26c7a478ec87cbba37237cf2b9e75f3dd93f955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af0d506c6fbbfb7ecd4cfaf83b1eec9

SHA1
3b25e65d6d8bb1173c148596bc9efed2e8e52a04

SHA256
0dbbe49ffde1177682829c1c29a93c01104d2756423041e937e830ecb4f5ec3d

SHA512
9da4593e9ebe50f8318f2c539b55fe48b1027ea7a5bd1a5974684ce8abb4155c04eaae30cbfbef329ac9c68b5f78f4d50a9d9c1b3ec69155f96b4c6ae94a5822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec4b4b861beb6ba403833185dbdbea0e

SHA1
7ba95d1ba1779ffeed6cdc3f71646473bd79fe91

SHA256
056c250a3ff0684417fd132c907610fb4212d6a423fd61957fa777c5af706f77

SHA512
dd17c6009bfa81e8363e3f5c36e5555704d4eda3690afe38afc601878849d67b3d30a5a928f2bd1d63b0587a3aa93c91e625340eff95b3552a3c9fcaa9807ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d815497dbb5619cc67ac6e4e1f53947

SHA1
9cc1b70484660a8a6fa84956655bc60dd358a4f5

SHA256
8a428633794a786858a404d8e090f429e1ee56b5f2df9a704bca57ca798f2168

SHA512
5d11d18c4a2611e5be9e6c57201746fa39e992fb65f6f76c63171959e89fe6a7fa76dec73e836bec1d752a815858bff0d9d73eb670d2b94170eff7fab8f5425e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12d296d3b97a86e29aecb938618e6728

SHA1
78b0fd175a0d5f933142fec457ccc59037e0470f

SHA256
d8d919783ccfb8432b3a32d2d9b4ad9d8defb7c4edae36394cffe14d61f5e34f

SHA512
712079d72e3b5c0df3db9d56e4c0b07f7393c0d467d731f9b6e3d757e66460c3ced324023eb4f0c20518c203cac6eb440222df16c828a0289b57c5cb1f9ab9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cb547a6cd4c914bae41a453b9d6b049

SHA1
30a38a17e9e2e877d50732c57879b2658b707a40

SHA256
1e0f7ad52c56fe993ecb1984e7f3043fc05d33bf9680f9871068bcb346516d90

SHA512
a8c5365284f0ccecb082955163550a36d012a472bb61db3343afdd100818f82fb60195ffb9d5c3d497a4fd5c328d90a59802904bf0746234e7e9154b03bdd3ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB57.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit