a015e2f51068dc2b3f737f1c46d6b3ef3f42754c5f127969073851103d2d7dbc

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93e629e4fcd5908128d5713980e77978_JaffaCakes118.html
Size

19KB
MD5

93e629e4fcd5908128d5713980e77978
SHA1

61b7d2e895c045c996a415dff33c53c4d1bfb8b7
SHA256

a015e2f51068dc2b3f737f1c46d6b3ef3f42754c5f127969073851103d2d7dbc
SHA512

a1d2e4c4f921b408c8b00fefca03a3a0d3a10c789ff28f85fd91764aee5c6b447b5a2e5fb2fb1c4c754a3b7bb69b47308396df465d65ec6dcdb5eec8a685a056
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIF4fzUnjBhhb82qDB8:SIMd0I5nO9HlsvhAxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82B77FA1-223D-11EF-A1DE-66A5A0AB388F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423645173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1748	1708	iexplore.exe	28
PID 1708 wrote to memory of 1748	1708	iexplore.exe	28
PID 1708 wrote to memory of 1748	1708	iexplore.exe	28
PID 1708 wrote to memory of 1748	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93e629e4fcd5908128d5713980e77978_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49df267676d27ded82c23848c769f446

SHA1
4ccf8de8da33c4eaf49dae9642e087032a3a6993

SHA256
8cdd3b119ccd7fe249b8020eb6aa96de80dff38e94040534afaa95dd7a2a5017

SHA512
2bd72b50d9bd416f6cefa7e37e002e7990d18cfeadfebbdd74bd986618a827d3dd26118127045cbbb89e301aa27d5181926d074081e32fe97e3ad9c255a664d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45fb718bf25537bdd163121af191a22b

SHA1
9e08e7dd3e3394cc11a4435e941789c37ac727db

SHA256
b253a07497659ee2c8257f065c494306d99729d9aefbe20c04d8403ac56f3614

SHA512
83e710add6c1a33c9243333266a82adf32f69b510a170d5a70a503c342ccce9dd1386eccb0d2abab4d50bca9905a39354d395a1c399a2802d1e04151ca48f1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcec2d7eefa59f8b16a862f829ace5d5

SHA1
be1f2b38d5b223486601c830f9c4c39b2039c78b

SHA256
6019981beb5bc276019217a5ae2a9ea716c0360059aa3f7123ff7f5cfc00a92e

SHA512
86579c1b4b1be0437b9549e66c4b95909c085da043658b0f61cf65a52d1b89dbfd87417bf7655d02618ad7b85bc43e5cbe6db1a9f8437203f62d698475fb1d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e4ec4ee482dd6b19b4c96fcadb2a22

SHA1
0027ed3e349e9ee29f895d8f3bd4b5bb3483e19f

SHA256
57f2bab747666b0af713b4153f3ebc4fdc5c09d4e2d85ac77d54fa5904d28331

SHA512
c80ac80648585a2760ff2d60d6b6026e55cb032a9b13e6a3ecd298d5754bc4970271f118cb37d089cbdfa99e14a6cae84b0be7964b627c84200115dbc96a75b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4d199026b7b079fc2902b669834fc08

SHA1
35e51dc63de4068aacc89f07f331a727921205f9

SHA256
5c27b23aededdefec5cbbddc33b94f7261d72035b14d5fa28a592ec3d373c268

SHA512
b61cb452e90a5d1b161fa685e63b714e0b09acdbebfcc69af08a17d754172b8be1bf9c07cee16d3f7df4404ff239ad52777bb11264ac730fbbb1f0777bf97346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9be2d4e175083c6f69ca04a2726fe206

SHA1
30a42c0e8ea996d19d58b0c0a40984a600b6ae45

SHA256
c97af4385ee07b9788cfa1cdcb140679af31b0f1bf40192eff451db5dca538f9

SHA512
9365bb00ea2e08cebc0934fceb1940f015f8826d13e0e6922c493e6ffec9af119ee561d2f87d1605d9f9be4004e1b19ad4e41b6033e407e1cf694995b635c128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
114886305bed60c3ebb077cc886f5167

SHA1
6f6c9ccc19f5e7410ba0f33fe4af73b713855418

SHA256
48790ce2f58519d34ebe38e6bdc1057523cbfe17059a0790645ff7036f696570

SHA512
0227d21015d365f5bf3ca9c514624a55d8acac3c4af77267c098458d54a7e42406c632739d7b4a26aa4fb9114d248df63abcb05c15a37811838ba0b7a76a71a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4abd8859187aae997e170c8a2a22a451

SHA1
106dda8876729e3072bf8f73d2ce318f1c97d3b0

SHA256
66c059f4736755b4111bd7cd1d42e88c9ad65deca2d1222cf92976fdaa798430

SHA512
d026ae357fbca56c64598d2cdf897379fd02b436edf6b42d5ca0da7e8d5c1fd445b7ac6d583cbb334c5b017614c1bb593767450e0d8762d467c976f13173071f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fff336ebb2051fe67b42d7d1e3499336

SHA1
15f9806870ac7ee797ee50367a68f8e2f7a1b222

SHA256
5e0420d72cd4b53c16ee1dfef950e908df534a66d65871eb80499abf2dfc9155

SHA512
6ac24865dd2ffcfe750d6818038d4d6f60b6d96c165302496e6fb509174df6f191f0dabcb728a427ab29e612c17d1766d4614ed320034dfb7a6971105399734e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3249.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit