62b7c9aa3a09d65783e33d40dc719679a9f3ae417ee2de7a87bf854257264a50

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94ed84ee8d28263ea7bcba82e6fe7228_JaffaCakes118.html
Size

23KB
MD5

94ed84ee8d28263ea7bcba82e6fe7228
SHA1

662e500c430a7238564abab499e34c580696295d
SHA256

62b7c9aa3a09d65783e33d40dc719679a9f3ae417ee2de7a87bf854257264a50
SHA512

42b7d2a4dd7c8892e4d3cfae634ae08198066e7783ae44790a29c7b4bf822bcbe6538b0bda71ce84ff89d78464b5699ec0bf2b4bc1a3579c833393994162f132
SSDEEP

192:uwbYb5nOrKnQjxn5Q/vnQiemNnUnQOkEntJFnQTbn9nQtBXUvMBGqnYnQ7tnynYl:9Q/W38C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423667799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3174E031-2272-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2804	2348	iexplore.exe	28
PID 2348 wrote to memory of 2804	2348	iexplore.exe	28
PID 2348 wrote to memory of 2804	2348	iexplore.exe	28
PID 2348 wrote to memory of 2804	2348	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\94ed84ee8d28263ea7bcba82e6fe7228_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f42981dca1d62900d93a0829eef2a736

SHA1
778670b3119124567f5d804e437f08924125d636

SHA256
66ce20bd1699908453424822206dab13861f7ec220d7751f06f97af08d51ae5c

SHA512
89cbef10d5f89837c6ac071cdc2c8706178d6b2441df404d1d1f766dc242a36eba55f0767feb85fba21113e8b42d26aa621f6a46241ef6f63b0b9f5d4b38886e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
633b77020be9eb59e17d48fce54c6b74

SHA1
1046b7e569f693ae74b5e984a1693293d212173a

SHA256
c41d283f34b53c42d850d9b904d191591185f914e3801089a3f702f3eccf1e0d

SHA512
ff45a763499658128777e524094715fdcf0005cf2b1ab4c418113fb9cb58f867bbbc444847559c4a65a1dcdea79298a450526ef8220a2637af5762c287f5a589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32628ccd0b7f4eb5512c80b2de03fa1

SHA1
b422fff3161ce27228a6c6a6fe5525632c9c587d

SHA256
6d2099e9bfe333de30613cb80a4034a7d3a1b7343025cc1a6248317af7f22b96

SHA512
2850ba3f42e70b8be796efdf4ea807908ef0520bb3f276c8bde803464ba98e67bc00803677f14aa7ef5eeb2b87c72fee37c39970204f54000d682a9fe9af1fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247dc8a6676c9c0f3b7b5712a88dd41d

SHA1
6cb3e95ceadaca48075811699729065c58c6ced5

SHA256
49b973352cf612c62d1165367ce8f55e6c64d3ef9f1a6383b7cfcf3240f4c4a2

SHA512
2611697112e1d4e3528e2e0da797d6db278803f74c6bdaa583fe4a1f618dfeaa32439164126e77e931514a94d053e01d8acb9bfb3612145d58a72c8cb8872411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e216e463cd230d0608f253bff2fb9c20

SHA1
35ae3e8dfc84390383d8501b86f56c53ebfcc819

SHA256
8d3f8e24920e1af1ed04c16cdf748d6de0611f88f3c4723429a4d6a7251d8043

SHA512
f7a2da236928f8fe808ccba5816f8bdf02961c908c3d1da127dbf54df15d5a77c60874bafee922bcc3e6a1ee7b9bd973ffb9c99b6cdf3596ee55be4ce19a38a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4d3b0b6387062382b71410b6cb52182

SHA1
b57e133f94b0c6ee6667cfcaaf787e937f4bc9ee

SHA256
67e24575d8ea3f51f0c8e5a833508a5aafb4667084b21a2d7f43a919d7e24c5f

SHA512
e8f443faec967ae7fdf04abd616bbbc8d7d17ad51046f078e89fba656e94f7aa4455e9913535d8fd62015aea144c4568b4008c547df7f213cca8f74c5e0f7dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ed8ddc3672fcc61fe49042ed6a5fcb

SHA1
a73f4c8dc2af03ee7719a0ada335cda514ee12ab

SHA256
10b6c151a30942176ca53c1c5a1228b58cb6c350b929463f3f19fb5e5c30dcf2

SHA512
f1eaa43a95ed7bfce319b9c7f0922633580cfe1068249fb9276573538e517a1bc043fbe04d302f56db8b52d8279b1ecc21eaaddc1101b170c2d5771fefcee2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f4b47907fecca5f8e5debefa0bef89

SHA1
1ed8a08b976769b1716b987998358a1de55edb2f

SHA256
3d7111f6b409746000c600d317674aca4d5014d46fd805e70b9b541e42af1826

SHA512
76be3c2e19cee74f8d274e157e8eabed11499f6bd84d6ea4e04dc3d81f633b7007d746f085da2425faf4e23b9d5065c8c5ae28a04edfa9595306c1ddc3376af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e207fa8fc60a68dc2f20a8f6fc121ab

SHA1
ae77d450a9a0695dda52f5315939363e6b07e63c

SHA256
bf78cdc38a9d3714d18201d125f7ec6b82bd9ff6cfe609941bb273abdedff2f9

SHA512
a76d82bb035e72bf31eec6afef3fa20b7999bee0424597ec86ccb13d518127e4dcfa5a019b58337ea0bdaead69fa461eeeae91f5a89aa3bd66e390ef0cf78181

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit