57021b1ba6e88557889ced746efc4c007eda5508fc2005556e5ce5c8bbca50bb

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

997b5c57c318956019883f77982933dd_JaffaCakes118.html
Size

31KB
MD5

997b5c57c318956019883f77982933dd
SHA1

fbec3aa86057060ac327ee47a6d00a2eed2dce42
SHA256

57021b1ba6e88557889ced746efc4c007eda5508fc2005556e5ce5c8bbca50bb
SHA512

8d58ce5ed511e32b55991604a3083ec6b3aeeced94bc9aebc79dc9438c30db89a79dc964d4c4d1e83f48b8301bcc116c9044b3c2fa5ff108ccb38744e057bbc3
SSDEEP

192:uWzMb5naFMfnQjxn5Q/UnQieXNnKnQOkEntsGnQTbn1nQIXC84A+3qRiv19UMs0u:rQ/rP4h6RivUMNTtZa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21B16271-2391-11EF-AA09-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423791039"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3012	2360	iexplore.exe	28
PID 2360 wrote to memory of 3012	2360	iexplore.exe	28
PID 2360 wrote to memory of 3012	2360	iexplore.exe	28
PID 2360 wrote to memory of 3012	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\997b5c57c318956019883f77982933dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
32aec5a7639aa861ddfc440549432d27

SHA1
80ad5ecf6d443194ea9d105db56a2f8b3e757f6a

SHA256
1b898b01d918723b98400a0f61f609db522591a17c79823cc58e96a8f3025c21

SHA512
ea823048629768aa4702fc3309edc322ddb81e92e7c41b5f167ccc52011b0dcb8c2c73cf8e3999ff79fe13d34b4844abde0e1be981c64336499e81c3563914d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8c32d78e2c735b289443ba7e987b19d

SHA1
df39b5d95becf799c21e6f050c3e37e16f54abf2

SHA256
6a294897a1466eaa908b7ce9dce5d39763674760ca980bf64df96e89db67b14f

SHA512
5b61dd5bcdcf70049f0f7cbe12dbdc6861b8c6f54e6599154aa2e5b34ea2a4f560a4eaf051d6638d82861ff3680b004b509be5282909fffcba3e978cfc1b74ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65e4ac00e1eab37bac7e593c6a3fb46f

SHA1
a12813e89e116c2740eded524e80e239ce6a448f

SHA256
dc330738d1d001be9679ddf422195984b66070c16837bf3b47238873c6ff4e8e

SHA512
d3549fdb6eee3c498816d2b518c4b01791f002fb92a0ba42c4a782aa5c7f59e2e240a3a2bcfa2bc6d48a905ec146d4e533d9615d73cc05a978d849436f0e61f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0873aabc5c253560769f3a1e5b6f6c50

SHA1
b0c7dda369e19c0dba9ceb1a5f6f02aeaa92591c

SHA256
685695d3c52776fc22d82de61eb8747677fc84580c8317039db8cf119b9c4765

SHA512
8911b6941c161d1a20f9e540e507c6934fadfd1d55e5bcdaaf938bb2495221a0f0d971d0bee73e9fd59166785719c9be41e03d043b5cf8d574beb2285246c459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93b7b4286c1227b41ffabf4d233fc40e

SHA1
bdec97448616d537ba8286093cc74d4a337aa301

SHA256
87893d5b37a43473b48914d3d3ac6b901affcdc323f6d1409d3f124e554561f1

SHA512
5a35533c93e6d143d1cf9b12f5a81bc51ec58757f5bb9484c268033b9ef8b5f6b4d1f53f8a82c946870903c1ff8d2d71e786e65528a603b73497efb7fcf8f40b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0869e1d4947f2a6a3a0a0a559cecfcce

SHA1
bc7a66d4a2f8ad17c88f359dde0b252be68a14ac

SHA256
450d1665e6c369e8541b73956b3ad42621bcc148e44892e8aa25391508cde938

SHA512
286ff8ea2c4b8225192a23011e5199f6b580efcff49e00938d339ce2c990406bd58f3c9606a5fc936f78d3220b0a09ff4e0994a7113a7e6953bed01254af6f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35e1527b40d8b67e5d1f89ccbf69126

SHA1
79ce4d318687ba95710f4535da2957b35fe47e3c

SHA256
ea48357b08a92d4572d7d96e2ec665aa73dca377f2ae474e209ef692458c9461

SHA512
d7a797b617c3228237cb5b324034f1d67fbcd57c8c1c668e8b4a8a7327409b42ba792b3e3c2be9e749e2575d56fa20abf1210426d3b0d8d4cf3e0a3efa24e8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee268c47d2600cc60201efdad90aaeb

SHA1
3737dedd31553d7baef40e8ced0ee59e3b78d503

SHA256
78435ef42a6762bf6db97ebf2e43cfeaa2876ef11f576205ceb6fba57f807ba4

SHA512
c9d01bb1125aad81077b3de507c689f273972af4fa3d9e01e9767bb9ccfc97f08e438dca8bef646f12799c313ed9c839e74fb63ac1acba86363faaef06a09fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac2829072fe76346119d3944fc449a81

SHA1
f2ef65d2f95b281332545c0639bdb281e05a1ce7

SHA256
525ceca2883602bd1dfd5151cf31239c8eeda9d9fb5d94693d3fc28c2382e69d

SHA512
947f7ffd5194971c59d5fc47aa525dc1d482345f03a48666b18e0476fcb2e221d89cd42a0d74cfa735a05a2dae6e961e724618304a9432725339534cc38ffdfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84cbce2cb3449d65656bba2bcd1d245d

SHA1
33f006999f67cbfff6afa94487f0fe680c4dbbfd

SHA256
aa5d922569b64e95e8ac41e0cfdad3577f17a8fea79291efdc53d126c6482d7f

SHA512
783594a17bcc8d378d5e013c8ae54a2aff606be6b5b32aaa77bb6cf11dbee4cbc7d6eb83a0d429a743eefbf04f9379f3197349dc69505e9d97fd3867dd0c1163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f0fd69d51065f7a6703ff47cef30bdbe

SHA1
0bc2c4a413a752a92531ae7a6972f1ee22739e71

SHA256
61e52a90ac26cb368715eb63e941d02012718570b5d4ebef875b0368e1ba6b66

SHA512
dfaf5d0514b3f9556f0fb682651f5bea6e053e131b93c9daba724d41bc2cf45b3b8715a24fe2886205ec67026f32fbb2c79dee72233028383e31fb1016b2b84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit