53e6a0a4d9aaf89db93b6d0d0dea155d68c25938da216d05cab2e83e12946ba9

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93976f1b5fff29fcf59c45174c809cd0_JaffaCakes118.html
Size

27KB
MD5

93976f1b5fff29fcf59c45174c809cd0
SHA1

56619bec714ab2a417018943cf5f99fb4b46b981
SHA256

53e6a0a4d9aaf89db93b6d0d0dea155d68c25938da216d05cab2e83e12946ba9
SHA512

7fd3f37c5379a7b4aba88b99ccd6df5975af107be500303bd3540c1903d9b93f56c3ad7326b5f0ae774e4de762fcd4d1023268c426744b4117f4021f610f222d
SSDEEP

192:uwHsb5nl6nQjxn5Q/4nQiezNnanQOkEntcCnQTbndnQ9e//m6MXRvQl7MBTqnYnH:cQ/gihgRuS5yK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A127CD1-2229-11EF-ACCC-D20227E6D795} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423636381"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2580	2020	iexplore.exe	28
PID 2020 wrote to memory of 2580	2020	iexplore.exe	28
PID 2020 wrote to memory of 2580	2020	iexplore.exe	28
PID 2020 wrote to memory of 2580	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93976f1b5fff29fcf59c45174c809cd0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e006b5ff078a50a6b9f96d45014ddef

SHA1
d3855cfa5c0969f3c42da2dc6ecded0747ce0269

SHA256
6758f4a1a0c2a590f1030b0bf7549c4a51c3767d23058dba8b4c4e44d84ce05a

SHA512
167ced78153475a608f3f2677b0dfa95e5817ce8738fae9a3e5235c193765c79d5aa0caad562e803f64d329428b9dd767a2d3bda2ed8aa785c6f89fb42172fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c15e71fd763419a9bc22a6b0939fb32

SHA1
e5d417a128a6b081bead65fd065bbec3939c4fad

SHA256
dda01a9bb2ad92959bbbd3e19c281f83d61e6b4d79b4534a9193523d7d54c531

SHA512
a989baef02cab248557db63090d53d22e6475df773e36b48bbda837373efb05b0a55770ba377c304faab43e3d2bd22a747b926bf66caac338a4b2592e8b7eb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
febcb3de3afd46e45e29b609ee1bda1f

SHA1
11a5d780282ae0375f7a96b70611c4be2dbadde4

SHA256
5a769958bc3d112c4ca3a41e8637b3ba49286bf76030b360d63fd3d2d6bd9ad2

SHA512
884db36130d79ff3a38fe3dcec8a02124d6841111d82bef3ca28b491484899a54889d862ea7c0440dd2da5d617e6f8a65cc8c8bdd52d183ee8b8f14d9fe1ffff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f20ec8a743e885bd23450ace2676abc0

SHA1
38c2ad4041411d5daef7bd8577df19787403072b

SHA256
e6db81259e3017a448c2725ca65a6e5b725640c1f01c0c3fd7b71559b3007367

SHA512
1e018ee743f805c551edd27f22fd7fdfdbf935574ec34599b71b72a27cde8cd6180901106ccf6b3a164a9dc6f9714ac352f786fd225dafafc439314c63708a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fddb733394395da75873f4cd5b7efe1

SHA1
21dc456000dfe0e39b1c97176b03045296996711

SHA256
b39dd5eb7c626ae0a37042b9382a2cdc8d1c7ef892c7cbf64f7a45b8636f30a4

SHA512
559e5baee826a1bf059f0e8e130778b1cdfd75c03d5cbf80ba563fe8262087c750a12507d95eb050d82684f91c12fb0d40cf3269d1538f55df2bade19124b830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a3a4b1b3378ad71f5d2f79408ba638

SHA1
dc5c692c7c9286bb94dfca25f522fef3e1572073

SHA256
1faf542b73f1e36452a70c47960bd23d1b4ed5f24512de140ec65bf6b656e80a

SHA512
9bc90ef2b105d6598fad126a8595fb0f73aece3f087e95103b75e433bf2191b78216e1ddc8770786a23d6dac1f7cd0eac39c07d034a1d6e57b11eca6ce640e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
777c64974c1a26debc438799c64954d7

SHA1
02ca9335a53e17d29d2b5c32e4300aa619c3be2e

SHA256
02430d968f2ae09802324265bef03283f410b1772617800846b8ec43e004b3de

SHA512
d50c54dffd3ca0ab2b9b19f5138bafd70ea495edb3fa3cb5d344eac8b7b9f7568862e98e2f8f601aaa09a18c8c3df9076279ec62f65ccb9aeed67f3a38302cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b84f95bbf888b9f3335be59759008c50

SHA1
38ced22f1b15b31490c9409584366a10d4caa16b

SHA256
55ed6ae6e634ad2067b474c5525e5ae9556815574a9d84e5be2e19747248e819

SHA512
fec8420bb4e9cfc2a37a83de3772227fd18bd1b2ca4e7c213be11aebc074a04ba3112940df9f3cf6e122c3476e27bf0bc0a83ad6c583eef402491cae2e1e6bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51546d471ac3582b4cbce4c83b0486cf

SHA1
2e51034045fdb3297f3f21b47d59898907ce2436

SHA256
c98235466bdaff5bc5c64d7ead135a01deb48eed5a8502bf70ae973b8908a643

SHA512
661b5c8fb4fd903f938fe74b7cf0fd5750a9d0428d17c0d16b7d2a5bf3a13fbb9ab33f7994663ee9ea666b302ac211d2cb644f670e202b8b4a026f5c2ca57ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc69575b8c5151620ff225eb63111a2

SHA1
989c3d023049acd8aafcee6126f43ba1790e9ef9

SHA256
e30d0cd12dfad6257889efcf5a490931c0786ebf96f0e762c630f0bcbcf9e5e8

SHA512
067ded3cc3298efe28a77f74c49ef6ddd40ce7d7b6678d2293a4f10759143658833cf3b5649d28948172c5e225ab96d3d13c4eaefc909c65eb557c0827b9b5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab673D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit