a0386b9feb7d2216fb468892a70f06d35da13ced9b78542c7707c9be87da202f

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html
Size

18KB
MD5

93c3cf0b5271726a86657e735de89ada
SHA1

7431b470c6551563a3ee12e19947d93acd37d60d
SHA256

a0386b9feb7d2216fb468892a70f06d35da13ced9b78542c7707c9be87da202f
SHA512

3a06c2b404a6a9ba8c9d8652fd485a0abb856ea3ef2223222bda2c069aade2d8a10fc5e26757c7364531f2931cabc8e62bb8e321fae453a3f8cffc45818d14e8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIT4xzUnjBhDF82qDB8:SIMd0I5nvHFsvDexDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423641542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E714CA1-2235-11EF-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2628	2360	iexplore.exe	28
PID 2360 wrote to memory of 2628	2360	iexplore.exe	28
PID 2360 wrote to memory of 2628	2360	iexplore.exe	28
PID 2360 wrote to memory of 2628	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3825d1433cc995b77452826fe9b3fdc

SHA1
28de072a84720c47682c3f9ab0954e94a050a4da

SHA256
d68530a197324077a4e3eb85f4a55ddedfebc496566c6dfee210ff65719a4a76

SHA512
d8c9930eabf5b08e59d9ddbfb04540c67b6775670dd0cab50f0d8c125a33a4c478fc4aa0a1aa67f5448f0607d17393fec7810d421339503b59e72fc9d26f9e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce547a68cacfbcd91ab93d40095d220

SHA1
f8843476c633dd1cdd3fc88e39336c07d950ebb1

SHA256
c90ea676b52fdd696404b360e3777858b68a44406ae2785a1a732ef8f2a684b7

SHA512
42b2702ddd0dcb6f954579855837d87ed6f493a107cdf2e6acf92b95ced237b0c97b2ec6f7430d98c6c9794adb68f09947a32cf29330d9f44f65c1b8c5cc4819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27e70acacd97d878d643236621866c49

SHA1
630dc4a3d8b129c8185896ee9c7436c973cb652a

SHA256
a16834a6d8081500763286016e2fb49653901706fce30893e4b54dcc9fdc9422

SHA512
ddea1befad1d775ddaabb23d2699449ff39f2ec019fb0f5a239aa92717e14bfdfcc0d2203b4a4737917081b81a311c3d93b0d6910738583691fb009c342fc6a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4075eb4802cdc9c4f39cf78ee5e7bc49

SHA1
df1f67d6eb5bc716505d222919a35f3411a5a41e

SHA256
2e5c18cfcb4b6bfa7367272fab87369642d7a4cf1d4e81277bd50b3a1f15c319

SHA512
eb906596233b4856208e3f59d551ec4e46ec74669aba33fbd16a2b4fbc9fa4c68909875295fd6d39450217c7be42740dafc08dc617d64fa13b6a56815324e255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb934a09005a23c2b8c19a152c974135

SHA1
691caaa5c74cac0a539b7144106bd6d3163cecd4

SHA256
b67cb29c705205e7f1b28fe45360e31c0bacf7803e39e48392b2af935487f294

SHA512
458003795e40140badda4d6cec033e2fffa7ea7452922b0ad278a8cf1eba391f757056a2c1785a4c061f480ff1e988034157f42c13cc9c0a6c1afd6a91470cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc268e587ab3eece6f20ea3859cb43bf

SHA1
ef9e19b47605ee00fa81c6fea54bd9dc790c489a

SHA256
435e97d3bd1ce1820b4bc95f4a49bda55cc15a38ca454002992386610a5ceea5

SHA512
f5db56141dddebfc11fdcfa695ab1a04c5d2716cb57ebe4ec2e2ccd9811df5fbe92bb316e868f270a269732d5f0285054ee476766ee5e577b5f36ecc46d09de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bcb13508f82722bb14b2c161ef2ef02

SHA1
81eb46e6c85a7d5483597fbe4d4cf6065f9945c1

SHA256
abc275d19037441a3918c08d9c5723674a16d182b9beaed91db0b1feb5f81917

SHA512
b2f5a8bb31013a29aa88e89eb0db84fc386164f236983c90275afa2c7cde51c455eb5ea9933f7987d03b2e91a87c181d47fab086720a0b95369f494385031ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
386d64408f1f2573cea0242607e051b8

SHA1
8dd958f32777fc095665324f3cd1305e0213672e

SHA256
8c6194b91a906a478cc9ddb6aaa6875d6608d4db0d0cc5226837332e5d85ba9d

SHA512
49d4a27111cad4b04881f9f89e079cde8284223c6e6cf4e4cd2bb2195935b905b5b30bc6f54e44e5e77e57d54f954fb5d3bede053c7b1753e1f0a415b7b716bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a80d8f5678043520abe06a5a6013dd03

SHA1
6e4e69ce5a45e025e9fbcb5a63a5a8fca6057767

SHA256
f2d73057c1aa61962ca11c08db417e5fc469d215bbc75f82b1e755d6b339ac8c

SHA512
6fa8df821861a4e4817924cb95dd98d87d9b2f0918f6e704690050e2e0fb59d06897d431317f297f67ee14c5b428c01cc0d675d3458121c23256b027611f32d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit