93068455976c0042fba69f12e5ba81657211d1ff818693f8d954afaf481ddacb

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96e64824368f8bcdf28c358c296c9666_JaffaCakes118.html
Size

23KB
MD5

96e64824368f8bcdf28c358c296c9666
SHA1

909996962b2dc9c6f32595684095c1d905b145d2
SHA256

93068455976c0042fba69f12e5ba81657211d1ff818693f8d954afaf481ddacb
SHA512

a523c93397c0b1adea2f134124849264a966d8cfb51f0c98094ef0b1d2aaf325e1566b18c3298536bd166124fe7ac17ebb0a5a0f4439278eb028cc5164a26b9a
SSDEEP

192:uWHYb5n+2TnQjxn5Q/VnQieoNn2IRnQOkEntLTnQTbnRnQqCnQtawMBIqnYnQ7t4:aYQ/8Ijime

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4473AAE1-22DB-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423712928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96e64824368f8bcdf28c358c296c9666_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b3f272244dbb254e9e9d9251a181b06

SHA1
06a72e32feabbf0c7f5c585fdf3b052870753661

SHA256
4b4200d03b135d3711f4c7ba2b76fb19b19f359db76dfd17cd3f1563133888d1

SHA512
56b9a649a4715c9765a57f79d03ba9bd16b7ad5ffdcb1c5304412ad4349f4899c6ec713d44b4771bd9e174a2cdde37f8dc3ad38bcb9f9713838ed268993730bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4785e54b29f1c787e71838f3fdfc76e5

SHA1
1561c5232cc212d8faede99c6f04a3c28fdd9a40

SHA256
66e59b23e0d1a977a4cf9b0594c31cf7730b349b4dad10c6f628167c7154cece

SHA512
d2da7f8a97b29edb60968d6c855d860aa7b09024edebfe15a138f893aad81c86fd64d892c03291198e131d141b7180316d9c370bbb535bbbd5a70b6537b50de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9cd6db8b11f18cacacc4f2bcbfc050e

SHA1
d40b15fc778465892426e694b29c18773549014e

SHA256
406b3849b176cff75a3edd8136b1abdc1efafdf4f065d23f1fa92b1a078291e3

SHA512
19111b506d2736cfebce9a0325b3b94c8b5265f7c691cbfcfb93fa1ba3fdcc4c42c82f5e595d7696d7fd3d796b22aa0c2c71dbde212f10e7535c6f416929b7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304e5a2db9559df65ba13d93d1e35fd2

SHA1
cf66aee8ccf0ab103ca087c7922826c81fc23602

SHA256
205b5c43b315e92686ab9056c0445d955c047112f1df51b242c4af98a7ef64a3

SHA512
9280c95e44e03fb27cd1b6195fd341d22a747a977831a698fe8f1fd98106cac466188138d2a69ecc9b90baa91b6757d0036f12d8db5005834d1de29bde56e6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c77b171ee4a1ba90a1853a12805e329

SHA1
a5eb546474e89cc976f37fb9cfc599f795f9e6c8

SHA256
6e0b63906c0872f99a7c821d64152ee67ce70a183bd2d2f0fda78cb6915de748

SHA512
b2ee9bb1d953471f6e559c1cb295076ad2627de6b02343f5e926a9d970cfcdd3666d4d73024df1b3f4f0aa1380472ef176f6e5ebd52663a7fa6c783b6cacee28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b498ffe3ccce65b38016bd49338094bb

SHA1
470e9d9640b24f0afcdf91d4299ef7f1591ad806

SHA256
5ad897722321ad0320d125c2184ad2a02c72cbd8a0c71e91dd5da25a7967cf42

SHA512
733eb4c4dc2c124e57ce6046b527229cf3a88cd61823ef73662abe503671df66184fccb320469abb89fd621d5e4447bd7f771443017ee9f5a5e8b4e9bafa6673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8647e06e0fa35b23a3bf352aba121a1

SHA1
986723edca15144870e6437185455ba3254d043a

SHA256
3896638a493ea1e4e0b979fed1cff918f8a522b269513f9308da007bacc3479f

SHA512
076c75cd2394819f9d2d2918cabb2b7081e3f0eff674b54067177dc0f94aea5a4158887a2b74cc59212d5b18fddc45e1cdb31160b161bed9668ad40f985f630c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a974b9fedf0cfca783af75f09c58195

SHA1
7beed74cca4e1242b173484a8616c7260bd8c516

SHA256
e14b3c279fa93c945455321189881ea6df28d8fc0bff3a62ecc7b2923fd3ec3e

SHA512
7ddee1b1d9d2b976d44678825cebb3fe5d209a07921a262557d1cfb1595dc80eb710b3e0d2afd8fc9801b1d73ccbdb52d09ec887547935b9f73b8bf2fc40df1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
785740696c2ee55bafa2ec91b617211c

SHA1
9bd7396448ab6ae48a8452e7a5b911d1cf1cb169

SHA256
927ee880781d245d379bae7b5a7f64f77d24f97505eb93e82b6b1a3068a4e45b

SHA512
6bfba6bc522afd309df7192b11053b816a29a0f7ed846bf8ff6c121793d4f6a3038ed2886326fba43a033a879092d4a720c136924d7e0396c60db84a0db42719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a37e89a6c05eb77046065e6a6bffe7b1

SHA1
b752b254fff9644b1503fc7cc9ffa557d16fb46d

SHA256
e00508621e9e98c2fcb258a4bd6590064c64d5462328d779c6dfc6292b081e1c

SHA512
2738d59f61116314e73ef3764f198e89c7b777c6c8913bce28c1b154f682aa242d4e491682337a2d5512971fba5562932c35196cf1c405f410d595bbd8c8fc20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0b14de2bf1cb9bd85637385e817ae2e

SHA1
5dd61a6324c9a0f7257f67f3c51d0165d36ce2ff

SHA256
6d4bb2924f5c9b58e7cc87f37e9eb0e066bebdf0f50ac31de89706aa165d02d4

SHA512
5cc8cc7ad504dbd2ab960195581885e1ce148d29aad455be82c09680af3e14afcb4b1938f4653a2a1eb4845edecaae4c8c94a8e9fd7aff741bc8463c166d393f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23C6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar248A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit