a3cd77e67404d04f887db0d179cb4196e2906c4139160461bc0a640188deb9df

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

998875222898823da9a5927f79b33016_JaffaCakes118.html
Size

27KB
MD5

998875222898823da9a5927f79b33016
SHA1

bfd381e9ff853d19e8130c9c9702dc593a55f316
SHA256

a3cd77e67404d04f887db0d179cb4196e2906c4139160461bc0a640188deb9df
SHA512

a5a03f0194d2ecf53390177667f9d2bbd00a80454a0a16396facecef99b6f5895378993524fd79bfa0e7dff83cd67dfd38c0e04da01ce3adf68d555ca7bfe0a1
SSDEEP

192:uwatbyJwhuk9b5nHOF7RBMKKwgNq+3nQjxn5Q/5hnQie14NnN3inQOkEntbtU2nI:dQ/Mp2c2TSs/3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423792469"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76094651-2394-11EF-8442-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1296	2088	iexplore.exe	28
PID 2088 wrote to memory of 1296	2088	iexplore.exe	28
PID 2088 wrote to memory of 1296	2088	iexplore.exe	28
PID 2088 wrote to memory of 1296	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\998875222898823da9a5927f79b33016_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
250d408dab8f4698bf6276c3effdbcfd

SHA1
73a59f3b449c06ca9922d1168267762b9c90fe27

SHA256
7c7bd6ec601993669dda3cb1ccb935a283c9147cadb4d36ea9fa035903ace2b3

SHA512
797db8dbf6bd32ae903148da00cb41361dc1d3b0fed80cbf46a2155156ae19ad4a93397b646414c8c3dc4fbe406f134ae9a48bc016270b556598d2e63578fab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ceaf7b90a5ec29eac331be349dcd226

SHA1
4e48134a4632aefb4e212da8845cc5ac73880efe

SHA256
9dede2e770f4cbff1f551733439e37e050fc4adf0ce6f40fc4091c08c13c706f

SHA512
649a9d220f7c7925f17ef7ef2459d8c4078d4ce3004f6404138ebe982fcad31f5e3096183d07d39c76e6b9c0f073c9e7b3290d85dbd615906bc3fc892bdd048f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cea57686e40efdf3048a51351bef7d1

SHA1
2ad9fdffda791c16154de4106de13caf86772953

SHA256
00e1d0879a6c25649ec87c596de16bb90970850cfe59fa6706cb1ab5e0201c1e

SHA512
6c7ef8c5e37763664844d8934f832f3c29a2035bca9f20ef015416fe417af06b3c3e541f6d8903d2fe19f738c1d099b9efc216ad0937f371903b4411c432412e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87025483eefadb0dad6e2f373902e1b2

SHA1
52e9bc2b422ce7a24b053d97905e6c62bce8fe52

SHA256
15bc8eef843f2db53aed03787f803e4666aa1d18fce6f7d984081db5bfc9590b

SHA512
8d11ed21e6f3426ba1052fa620e1d6abc9dbed8d96b63a7eaf4835baac8b75944d537d5352ed3be527fda162351e1e109db0f62917abc947bca2b983efdca3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
980963b41e2a15c39bad3bbde9047e7d

SHA1
d16719aa8b9ab18b460e934a192a590794f4a413

SHA256
f7a25a4fecfdf5ea3363e0cd0d3d534394c932c97f5522b5380dbed5ac1a2974

SHA512
defbd41970e231a320de79f60f520bf8cd86646ed020dc4845d6251024d84fc311bd64d92ac86e18146fd3239e79ba6bfacd63d5a834cdcbb314c2db908636dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e8130bc7bc8c7ab4e32571c17ff36dd

SHA1
d146dc5d41c82897bf097b753b11bd2f94bcccac

SHA256
6468515f68c69af8c35d706df2899ba08a0db8d181e73d660e2ed27eaaed104d

SHA512
752ea1cd465ca4183289e0d0debe0e70e1c1ee34320a0cdfc2926753d869d1a4f5ea4d2639af3d1ec648e31b251b0e1bfd3552c4b71c21ab33e5bfa8b1cbac63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d317593fd06abb42a35f7ce5846cb154

SHA1
c7bc3705cc6c4bd4d8a80d45e16eb46cd2bf407d

SHA256
41bb1bc022e5388601ec8eb62edc3d38de4e594a1166ff5e988592d329c5d443

SHA512
211231f50db2f35b85305bd648f43cbc56d6f4227c68dd053a2f1e9ef4f5e3c519cee3e8199c52313bfde0844b2fe96269463d8126ec28979a15e738a98368e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e04ae8c8d93264929c715d3d0a193acd

SHA1
43c89d63b4b5cb8f433a1252ead597edb9d5c9da

SHA256
d40eb943f1f77cfd949bcb217d1aa7c43e7a5926a9f4363223c4e2f5fc028164

SHA512
294ed0d8b36ff1fb9c4f149e95a4e012dafdce601a2def7fac732e18b4b212cce8ae9c927493096d93a551e588b8ddbfaa23dc207858e19e778f7dcbc65ac9ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6491114c57abe1d26ae4a1019f8029a2

SHA1
3c9f85e766877810046e0e9d4f907e66ab71d34f

SHA256
ba6ec690748eb6be7f3bc6c6477ed235497a0c424aeed0ef00e2b506419d01dc

SHA512
9ee1b68528e93df7e1d0faab278aac2f28ce96d834510b0e41e21194c6ff61c31a31baf2c13f7ebad8e1124ff3001c7e457d370636d1c22b472b652ec16434ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2177.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2268.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit