b381890c99f7b0aa8f32f4f190cfa27fee0adeb90de8486105c987c740d9b7de

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93f9c3aa729149735be9ddb4219b5898_JaffaCakes118.html
Size

42KB
MD5

93f9c3aa729149735be9ddb4219b5898
SHA1

a16076743b8015c1766ffe99d9902fd4cb005509
SHA256

b381890c99f7b0aa8f32f4f190cfa27fee0adeb90de8486105c987c740d9b7de
SHA512

757b7dff233a1192f6f333a2ec42bbb8e6428c99ae612cd02dbf6141c4a2faa0497d90cecd2f986a769a0c6acc32fde7b36a3c96149ef0a85516d38b4bb2e5bd
SSDEEP

384:jQ/+ivxfzpjkSwVLTh0NTG6QAaMRSCBKwBMHSl1NaALxC:Rf8Hk0gk8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50F13651-2242-11EF-B7A6-525094B41941} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423647237"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2368	1244	iexplore.exe	28
PID 1244 wrote to memory of 2368	1244	iexplore.exe	28
PID 1244 wrote to memory of 2368	1244	iexplore.exe	28
PID 1244 wrote to memory of 2368	1244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93f9c3aa729149735be9ddb4219b5898_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f0c9570edcfcc29be7923d7f38f0e5

SHA1
944e616abbcada346a33dd789bb146ffa8e6fd4c

SHA256
05076cf4c7ce66a4b116044677d3118b1eefb34f7399ebadfd89bca2ccb2da5d

SHA512
dfebd9b5dbaa4c6d3558f5cb0f89cc5a2acf9eed6a702acd85a56512fda970b7c02da96ef936ea27f302f33ba970e3e70a52ce714841cca6b90934eb985342d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5dafdbd41a13c4a5dea28119a774cd

SHA1
fd2e4297d93f6c38518bb4cda2fd43d546097183

SHA256
7f1c94818486bb40207d10a0a46e2883717084bf4e7d7cb1371135f18c9f26b5

SHA512
f1ea1127c1983026e7ef82fe9c8a993262808b3782872abcd71d9aa2751e5b0a59d66e0de51229b8b2069775f9ffe6fd006b0584e03ac2d33feac521087abc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222ca6748bb1e81d49fc2bf4ae957baf

SHA1
9bbab5933d3e787f32f03875edc7c7e3c8d60468

SHA256
856d2c33ad0e7fe33d721b033b80bdcc0bf564d5951198909480f6bc0d207ba9

SHA512
b7f02f7705ec36e3508001b8a1ac700a5102e168a68093f82a2bf1dd72f337127f64d3d037f0589abad12130943ba295746b50ca7109e80484bc25aede55c910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
679867d4b4aadfc00015fa1bcf77598b

SHA1
562d617f12b7f9c9814f0827eb46c55edccadd0b

SHA256
c8090da36785846312c0f43ca870787c402d80a925643d97aba2c191c8954eed

SHA512
64a5e40bb5beae6ee7b05df986bf6003c35dc5142e75c7dc790fb535b29e363dd0a5cff5a1e48fffaae9acddb7161602a5c5a1ae9d7079af7b3e1b03de29a72a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3e33359b802c69f1e104712bef16a8d

SHA1
4b5973de1b7b0b5ea021e61f8a890dd468317537

SHA256
9d1ceb2a78f9cdec922124041d6ff111d692bcbfdfba0e0a228ee4fdaef6216f

SHA512
3f0e8972d6a972b77786934b2aaa1450d7c0750df24b8ff79f067eb3b966ae96c1a04322b144196955ea8864f7d2b0cccc316d6282908ee932b4397b4351f761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c2485a8c141a37062b03e8161eba2a9

SHA1
8a1783359ab5528097167ac13ae5ed9544afcb19

SHA256
22aae640f36cad7b8215479576bb05724b01bb5e9d70ec47000df1e2106a0d4e

SHA512
d4f9104b4ec4bc1e8ed61cdd1425c0e6d05a5df730504fd6662601555ed8402c52022b0dca284a40eaa1de203d96556da42d1670b73c4bd628e69bf40b6dfef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
204faed206e137a2211fdb07c9e58309

SHA1
883a7ecbfaaaadd3a362ab2bb4f3ddfb481e27ce

SHA256
6ef89c1e6871f9a682074b87b0eb4a459fac6ec13e4958aebe6402d9377154b6

SHA512
a45491aa26813f6b350995823ab4187468e68d39aaf0abc7952a43b4fc3fe4fa75632418e297ee906ab2470d7c45a330e1ad7cc4952fdd552c7a8f28e6f3ee67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0617f62728fe35b7e11c171a92799b5

SHA1
6173aa13a898fd1f599967ec387c9f80211b58bb

SHA256
dedf2433dcc79a3a665ab2f8638fed9474c1e14363a58825e30358843c2c1b52

SHA512
fcb3c09f8974e821017142d82bdb9e52b271e9f16714ae1181bf8ab20b8dc9e04b7ced7abda4466690e90eeac689fcaa216682aa3cc4a7dacfe73ca1baf2a484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d86cb50152b4f627794061a03b165aa3

SHA1
9277a1105230ee14ae5edabe606f8d8fc1736d60

SHA256
1e55ae905c139ac83cff8e36eaf328b4b25dd42b82950699f6fc689355b1d408

SHA512
fa2b92679af464029d35b19c8dc32a6cc6eebfc6c7744159b3124dc63038f304b4199751f23157ecd7ee26bb2609daad008eae4c3109ca0af6ba2c7c40f5f15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1141.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1223.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit