152f6f8d1e4be00b21e44e191db287256e7f1000313e6b2486035b4d9208f5a9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93a410ce24b5620d6a31975981a724ea_JaffaCakes118.html
Size

26KB
MD5

93a410ce24b5620d6a31975981a724ea
SHA1

72e4a0b341d22a1ac6e6060055d84fe3c381197f
SHA256

152f6f8d1e4be00b21e44e191db287256e7f1000313e6b2486035b4d9208f5a9
SHA512

bd8eb3334c693f0cd05a08070e764376c1f82be10e6467ce2db763ab01ca9a0c55f4683994ca4e51c3487668a8e3731627676af9996c98352e5b9a0a006466e3
SSDEEP

384:nxPqoTXsufNg/qoemVMJ5yzXgQ/iVz0F3BqeqygctlzVZW30JY3ztL2r7M8qu+:nKRW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423637900"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93BB2E71-222C-11EF-A30C-E60682B688C9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2548	2196	iexplore.exe	28
PID 2196 wrote to memory of 2548	2196	iexplore.exe	28
PID 2196 wrote to memory of 2548	2196	iexplore.exe	28
PID 2196 wrote to memory of 2548	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93a410ce24b5620d6a31975981a724ea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb9ee4e59bda70539d3c02b5e999a4f6

SHA1
5ec305768bfe41ac97ab14594d6bd2d0203dbc92

SHA256
121df7b403341c80889d7416eeccb7dc4da910ca209240a287a6ecfc7dcbadb7

SHA512
4ea22a7fabca17afe2a15bdd3085c14dbaccffe00017cf58f53ad5bd65cff01ed7072766af3ab9ef68be378210da965793ba32d47095d0077350bfd3c10a413c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd9ce201b7d15652d811293b8d19c62

SHA1
38bab367023e472efa1206c4c46bd7a71d149a84

SHA256
bae4343105c5a27fc6ac7afaf9b7a50a7d743db2894514a63042822006d34993

SHA512
99320c00d27c3332ee0e19ab6ca8d3209ad2ad04e9d7a10b026f0712273e30eebead8a1e3cd54a09dffb401dd0be2e6043bab8cfd3a554a2f9c880291b2b80a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a237d02e2ab667b2425f9bcd2c61049a

SHA1
7db97853b3ab9eefbdf2b38a4bd7ee32d3266cec

SHA256
216637671d4acf58176211f32c3633645c82511fae7c7418a0f6d1612d93e007

SHA512
55578b9b569a03c167254aac9314afea1d69a19de8fcf18f7291a9108b2c2c2012407fbd7f54e5be7c4fa193b5e0046b877c1831d41054cf45032ee1f1872f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5961e22b68446ec64a9f443f799eb22

SHA1
a90f0a457886dfa0d18f5b8e6943f3a688e73ed6

SHA256
43df60fef3e1e101d66b071dc63e2d3c1c1ac2ada12c735b449b9c5d9bbd58bd

SHA512
01cd819baa4bc307922efb0a45d40435f3a734208c6ecff32ba0c31420dce8703b1318f845a07ecbcd986c3aa309e1aec45d10fd886d527e8ae814c5fa0b4f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35307463a4d6b44645dcceb341b0263a

SHA1
7fdce7aa5de52a583c9302808ddad7e393a5687e

SHA256
ceadf68536140f6395a5a6f0e6a03158dc2bbe851ef2a9ee0765d24720542309

SHA512
c83a28351273ea46b327a5cef6f1ec97135ba10fc67fade68813a2d1f248a6d7c23b703868058180adde47ac6b4547a633033a73fbe9b267d5a238c222a619b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd88fd8d7af42b4c5d52aaefcccb7dfd

SHA1
9a4f33b6f4fb5f05f34ea8174d9305869491c58c

SHA256
e90fd473cab7a398e0396de18a1c0c55c7abab876f18b03340a51b65e933b801

SHA512
398a1aa24a05dd4ea6f7ac2a4ff1cc55df5634fc5adf26154c52444849b2fc4809636f92c9dbe616c6269c8097bf1a78ef122c83f6ed497c6322f3c5f88caa39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4c5a3742eb1c5bd86ed1b852515588

SHA1
43d0c6e0590821d5f6d80745b3770b599b9b27ad

SHA256
63cd42058c86d15e7e8f8f82b780c83b0a21905459c9209c0920b48a78836a73

SHA512
2579dd32ea83e155485fa4188ca0f6cf7467d2d5f0468bac4c136a7d77486624ae888f61a74a34f187bc32ddf1c883e6bbe74bd92656d5188c26ed97b8eb9af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95b047d49a0f372d1caa83c9ddd94c95

SHA1
75fba5eb09283b3743c6e59827c6ac775c5607a4

SHA256
0ecd4b38f33ed95fcb1ce87a9d702ec6303a65b557f911111e2848c9c4e6bc0b

SHA512
87ab72c741a285c77d869a1913d585c5ef63334a7e9fd6794587eae9c13e12a77af3f773dfe2b49dbf155f7f525a792cd7457e7c02652df5f52a5e2756da8109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949edad021348aba8d2e6db12db5927f

SHA1
fcf542790441677ee44947f00f2cf8f71028fffa

SHA256
323a5892952e4d25e156c8de5620e998ce60ea6909a5ef227a4728334e42de0c

SHA512
3917a0bf882d13c9427d2086eac4a5205d6c7e92f0c6f3abf37d00c6746954ab5f7d3fb20af24f94160aea00a021efe4d5cc724e990cca111c6657c35dafad4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F96.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FBA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit