31965f6ff349bd1a12e577e12d84b784956134b1ecbedcb880e8a84290b99980

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95b44707bed74923913188ae61308498_JaffaCakes118.html
Size

23KB
MD5

95b44707bed74923913188ae61308498
SHA1

74bcfb939862a821d9fab23b2b44d179b49f960b
SHA256

31965f6ff349bd1a12e577e12d84b784956134b1ecbedcb880e8a84290b99980
SHA512

b88ef8f08b911e73c1ef878631e0323b6767661afe8b890eafcc67b82076504bef59e41dc0bb5df4270f0f286a35876a010e4dcb20e27d9c4be98127be646f9d
SSDEEP

192:uWD4b5n9enQjxn5Q/ABnQierNnenQOkEntsmnQTbnhnQFCnQtbwMBLqnYnQ7tnYm:4Q/e9/e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423684367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C42B34D1-2298-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28
PID 2088 wrote to memory of 2500	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95b44707bed74923913188ae61308498_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81076d92f42b07e1c5ef457f6cd3d8cc

SHA1
431ca5e45333488b4d247e7606b5fd9b43e0436b

SHA256
eb381aae7a23c75f9950fc0d68a8199c18d5988f1c19dda9809d46e179e0b059

SHA512
27f8a3dd33e2a914e4fb9eb1921b63bc707fa3f4504966de41051f0d62d9086f52fcfdec5be0829ddcb714d60b607f9824a7ad136f7e337efb71e696f14ba1d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe84a8c558e5aed20cd57740efd8738c

SHA1
5df8d4de53b2e5aea16e48bc3ffb8c4660ada70d

SHA256
13167903c798a686e9aab8f6025d77c5872539b2c2b78d19f466f96b4b3956bd

SHA512
d2a3536040bf0a3fa7581f00afab10a9d63b7a85e2770e397a3c41572cdc0987a3404feaec90a9f8635ac3844b004cf7b0f7db4b0c442fee863892481163bf0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29fadbd6928b184cd1446935c0ba2a3a

SHA1
128b5f246964f61b00ec038839d489326d064450

SHA256
3ebd5d140f6f5e4d86297a2e3218c96747980e9824f8aa9541485dd68afd99b9

SHA512
499525341c395c81fd1ce7080624fc4632f74fe58a4321a5fccacd0b3de7089aac262fc6179d44d7ce595654fa6e1be282110a8f68d3f4d750ebe81077cf754d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a434048f632c330d2a5b9c2b48048e46

SHA1
88ac51d3864bf3842fb217b07e05d420251e063e

SHA256
2a19bf91ce4250ffd2edf60d7d78752a43e0432c0a196d2178f2e29f9934a5f1

SHA512
6a5b00a3e6cb2104acff99c8b38d504717c3f7627675d34c3b2abea43aaf76e32e5d815d7715ae6c85e9f36474d92b70ab74f3bbe42bc75bec98a178be23ffed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa369e79ab6d2088bbeb4a925dea082c

SHA1
4b742013ab056703e174f82c53db2149a54461a2

SHA256
06fd215246a6f37a14ed809f33491a1451d3e3506a4e8f29384881bfa56b06c1

SHA512
58825ae6629d0c71f62c9a9392b687cd8a409ebc77e6b42cbaf9320c5c7dba8388f1e55b781590f7a528dc8f615f89c4e7ea35cfa25cef5db4652faeba7f68ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bdc7edff8bc9f3d47c391896f4bb166

SHA1
14a95395f2f326d051ec6f85874b4f8690a5a285

SHA256
9f5a60bfabc1525bfabd25f7ad9abd89e54b39bed6b92b48fad71cd025c41722

SHA512
ee5aeb45b2e2b4075312ea42bbd31466fc4a0f7b85fef40e591162a7c40e9bbb3a4b2bde05f1289bf3f17efb726a19aa059bc7f304037d99d712c0a4b8b53d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b4dc77efd9ab68df4908615abaff8b3

SHA1
f422564ad871dbc14b7a29e4bf0be675a67cab13

SHA256
c41445bde954f0f00e626c660df71fbad004282450baad896be26ec4880f6ffb

SHA512
cf3e64e0529d64424de85883be7ac0b2a188183659628d679d4196ec15d51fcc984ddfe4261f66f1c42a0c2a9015a261946f6d795566ba3bc5edb2882167305d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398251fdc47f626be78a8ce44e5209ae

SHA1
817b27edc541383dc006ff243788be3b604442b7

SHA256
dbcbd0d6830989ebf2e35087559b5bc5be4924317302630acabb79cc525a3bc2

SHA512
49c6bd71a25b5806426ce71b96bbe71801950d4a6d609ceca22ee113ec7b9ff3425dfbc7731e04af5eaf6e1acce04d3fcfa67783d63e2b2a36ef78596ef773a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab171B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit