af7b9922a2a78647b2862784d7bd1309680747188f94030ddcdcf86e7a1e3c79

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

938db54b987f35422cbdad5c58ae0f7c_JaffaCakes118.html
Size

24KB
MD5

938db54b987f35422cbdad5c58ae0f7c
SHA1

e2c1d31b13f1894d17974fae58209c7005e45ae5
SHA256

af7b9922a2a78647b2862784d7bd1309680747188f94030ddcdcf86e7a1e3c79
SHA512

891f2fd723617cc200e6aa0b6aa0ab67cc2454533353e977b95d0248b1150a9b99105ba5bedb5beb193b83adf537943cc4cfd2c9a743e367b985f73dcd4eab4d
SSDEEP

192:uwbkDb5nzSnQjxn5Q/inQiepNnjnQOkEntKMnQTbn1nQTdoI7dnXoQUKMBJqnYn1:iQ/hBAHNz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423635199"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49BDDD01-2226-11EF-87B3-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3036	2344	iexplore.exe	28
PID 2344 wrote to memory of 3036	2344	iexplore.exe	28
PID 2344 wrote to memory of 3036	2344	iexplore.exe	28
PID 2344 wrote to memory of 3036	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\938db54b987f35422cbdad5c58ae0f7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b32229f8fff9b9fbb245ad99b2189773

SHA1
30b038367f1bc89fed1aea53d38e53218ff4f2e7

SHA256
329b9407a01b6efbe9833cfba3b08d6345ca2e617d3c912f7cb0f4d273347b54

SHA512
7efc9a40e80a4bd8096d3aba1a4922848b4c821a0314a2de0dc2fda3ec5ae42b95546a0ef53e52e6673ba193a0e2c544a8cc723fc46c86046816bcb9f2722a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f28c8559227121a63d186b5f141540

SHA1
8ea0efec0009edea93a9a6e2ef009e72688f31ab

SHA256
afe92835ad63fb76b405f236ad8acda022200fb65f21c21671b20bdfc6420797

SHA512
12b7dc0c6969d9d2e9f9b6430eb60501ad33914cee325664b975a3bf1843bb11b49418d8cbe9767cb349f167a0608184dd675f4796e30b525b8927150b2bff14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e9dff5ece23c58dee772b269fe2f85

SHA1
b952bc706db589ef25df5fc03a326283f3746745

SHA256
4513fe2f9a9414cf7ffcff2c2bd22a456f1ea991b9b6823be7ed71cfa2c5c005

SHA512
dc5d971798a124e48f01ffc585f4cb4480191bd2d3ada79f3f65f1cab7596b9ce54c8f568ea716d7c547f5122a39a3e30b2c71d239f3ca91253092fd00bdf0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085931b8992f18a804b5f20069d46d1c

SHA1
074e21daabcae437f3356e48d5c6db402d43c8b9

SHA256
b6c994d7dcc730095926f962f34ae30bdd62c6a9575e7c37bd9579edc1c5a673

SHA512
8e54c08ae5217f6da912786964d5be67e45f85053c8616b44b581f24807cb327aecf48283fc8c775c18074536d67927f4c55afc478f2f606681fda6384db6d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef638110f28a65518880987410e8c3e

SHA1
f5cb5de8e013b5af2b81c92da0114cfed9e4def7

SHA256
7a26df3247e39583cd3a9aed5d53a07ed64db259c3c2b4e61d698a39364cce8e

SHA512
313b8716078dbe07768a2df78b31c329f02ed9d9da603c9d347633cd04755dc7a1472afc53aad97b6745148cadaa96c071f39910aac73eb624b18f66faa31f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
260b68756f49fbbee2ed3db640aa2540

SHA1
fb089140b5ea5183c300014f7bf88334bff95ddd

SHA256
3575b42c447728db080e4d1f9848bec785d91da5b321a1f4593d6b3ce1dda2e3

SHA512
7d381312eb242bba82796be36ca0bd3eb30aab68abfb2c402cad66d425c02c2a50a12ae6af86ff40cd0a4de36a84311bb84d89170375809bf6ce5fca47188c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca84438c6e3e04dce52204f2d52845c

SHA1
97106bc1d1445de4a5d0e0a7fecbc6c455eebb62

SHA256
d76bb82f802afab4983a96c3f57d01a316394828197f5746c9c961bb8cfd5090

SHA512
405726c19e44fe4150baf718a50ab7f5dd807597fab45909ea1721c64fdc8ffe66adcd8999d4e16f9a20395c81807fc45722f038b012a567ea6df34f39894db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241c07ba8b2f33579e1c4e3ed2077267

SHA1
f56fc3f5d38864bf952b0ad5bbec366c7ac6227e

SHA256
574b8fce6b4fd78505e57235e9219cfc625bc172ac84cbab5b6e245bc375bd2b

SHA512
3ba8d42146708794887d7f5c02930d58de9ccf9be2ee07cde4f31f5c538300fc289abfc0403db71f46a5b1d1980140a1ebfa66d0919e8458b19e2f5f8fed90e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f982ec4924673c5a5a17f2046d8c7b19

SHA1
6c014d55793f0434d9b897c2a48d4f6c0b88e708

SHA256
23706f6dfe89110c8a101f1cae4fe8d6ee5e76e858cfa9c2eb36046f082aea64

SHA512
c43fb0edb01fe7cc91070ad3f67d18240574835187d6b37a9523b6462d9bf78f5b64b3a9be4f0a5571c91aa7af3c502b3ad053288850f0da9d419e33e6054d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75123b44fe0896ffd03e06804e126d7a

SHA1
26f7019a55ab4b3459528c63006441f8b8227dff

SHA256
5c4fdbdb1b6c9fe420b532401b35cbaadf9e6253c5c8828aa5b0048457850b4d

SHA512
e9e163d3379dfb79c18a9ef7417d26714caa070d1f599af0fd87bec97c6ae8f76f404684b43b87847b86d4d7a0f1eff32b91b13db214f8a10dbbeb9ec79c1d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33a53aa233a9f2a4edce2f548d7f8a1c

SHA1
b34f6b375808681ccdef9bd50dbb94429e4a7057

SHA256
49b669bd45e620473efed795e466ffeeb1c3d10f7d2cb86928c16d6aa7e1891a

SHA512
849cd098b55c5f2e90faa0d74d24d5dd6051d824ade721148b1bde6d0dc4ec26cf18c76e76f694d1f60148d1fa998fd2bcb9e6578782057dd013e955979f77f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1911.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit