736d6067ea2f69d1c98d15fec8d09c3940af4c74bf3ac90052c820cb002bf227

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

97b503d1805045dd41bd52ca676e43cd_JaffaCakes118.html
Size

26KB
MD5

97b503d1805045dd41bd52ca676e43cd
SHA1

899e9c90e69c12438d887cdedd3a6cc948d7fa66
SHA256

736d6067ea2f69d1c98d15fec8d09c3940af4c74bf3ac90052c820cb002bf227
SHA512

5b2b18a1e8254ef015dca45a37685752f6079eb3d22c2a37b054f917365b670eb3c4ec52d2d7e596e32b0e1ccac73fbe772a741530610881c52a79c5efff0f72
SSDEEP

192:uq3oB7DyGjHvrW6qb5nOub3vTqPxuIj+KunQjxn5Q/k+nQieAhNn2VQV5nQOkEn4:nWQ/gymygcWkwn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{799E0901-231B-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423740506"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3004	1992	iexplore.exe	28
PID 1992 wrote to memory of 3004	1992	iexplore.exe	28
PID 1992 wrote to memory of 3004	1992	iexplore.exe	28
PID 1992 wrote to memory of 3004	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97b503d1805045dd41bd52ca676e43cd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c8aeb2aa2db5b39cd843a5c8a170489a

SHA1
95a0c174c8a73d229db5c538d7dabaf5a9ed6aac

SHA256
c380da35b9925dcaf2bc4dddb07d65660c251062a6b51abda83a5e5364a0d220

SHA512
d6cb6ca73a89a4da6b09754148de0d8e79dfec52aaac5250c7dca084895ff9e2345a544cd24002f12419f7ea0c70f0a7f48a1b93ecd8bb8f0465e4cac5e867f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e37832ecd808791e4ee24eceb1848e64

SHA1
92863da824921e739e489926d9be17ae735168b4

SHA256
3ed992d8ba6330b4ea8dbcb6acdbc3c15f191c82e157a5d411465de563339d45

SHA512
68a96bc3ea8c0d139159d6ff3624f6049b214b011108d1407026c01de06acbba869ee402c1e9c640457853548943905ddd4260e5d93e29c9ff25d6bf0d525e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeb0358e803b71134b50597ed31c4e1f

SHA1
4dcf22eeeea6a478525f89ea0ea4e7d3f4efcecb

SHA256
76aceeb92c46c85a6ff571e4bc7f1900d0fdd6e6f5b5ec8c31aec4a9088b9186

SHA512
b8b7e4d53e763505f678725cf9574ef737c55bad367b62ed1fdac206f8f98c3001e246ba58e342898494a2d230404812acb74cee1a42109f3f2a4b543352156d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a65866b205ddc6264ebae58555b5cb0

SHA1
ff057caf1deb804e17f80e735b5b626f68eae31d

SHA256
2f2d61c919ac6778dd58bca3ce03efe1e3a97c2398d36ddd5a4f9f4d514c2547

SHA512
018ef3ee1681e02e7c0e6acd9e1a152082b2d903c23f2f0d463088730f372a005b04cef25f495acd82eda76278a004684b01fb6798573414f80b0bbc4c56a2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b33db608375cea225bf770c0035b282

SHA1
66065b9656609d15921b1aac5830ca76522ae279

SHA256
62c59fbabdcb6e998793116aa19117db266ae6196e764421cd93b403f2173e35

SHA512
2a18d7d641edf51a79a8097a2c0b5e9be687c487b2b73ec3e4e38ee7aa8ae560fa232c938c0a0dffad20e8517f7355d4656df796145bfbf260bef6971e4fdd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c236dce6265045e038d12e6ae235ad97

SHA1
1adc1fb77a8e33352f7dd6a0ceb9b07ee79c52bf

SHA256
5a9cec8fb3d9c5e908376fea38ffac58e13b98430f6790c4180a2655b606596f

SHA512
336adb52b4c1ca4896b7c5a068faa5f8a99a9b20e2f90f7b0ed38352cf092d20c2bad74a5c894507676c4971f408484fd6a3fb946062800738f29d4985048e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e60147842306aa882cb06bd0727b42e

SHA1
c4d558838f0359c298ab84f26eeab642311bebb0

SHA256
f4b0258715689d80355c9ea22d3e671540523c05d8d9e9e2d3e79402d1504a8f

SHA512
86c28a7bb9184f80cc3a0f067963aecbcf3d5f05a5ce3d6ee011a44c1cb7c80dbd582d7b0ab57c9b4ff537803c5d6e462afff55e4c26a3b041c16e26a00b420f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a3d49acb61d5fc82669eee1cee5638e

SHA1
da80a0fd4061010a13645bf8dc46749f108d5a25

SHA256
1d31475b61777de7868e3b66afe43fc7e77451609ed1e461d225334c75a0a717

SHA512
5904bb26616749294bbfd42edfd4e8ce7004fa8e0c968c0c19241f0f7e4e0208ea03c871f88ac456119d924f5dd0a7e3a4e98b12b41900ec28b6e3b914f70360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5956a79e3999466e1c6b2b8f1eb6b095

SHA1
cc1b9302bd16a2acdff765f205c5f1e86f82a1f0

SHA256
489c213e2630f4b54b8edd357109860b42472bd6229d6db0c151f413deb09cfd

SHA512
56bdda0257be280d30f482d1aebe79fb41cf077a0ca661e8191c441d06d420c1dc646ada770f1a9ff554427828819563bba58786b27d9b4df993125d1779da28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4922a6e7129026f9dae3cb5d30213992

SHA1
f867fa71be707e7dddd71ac3fea5311878b31598

SHA256
32ef335aa0cf06f32f10e209c58ad4c07e2208d9b02f6550af4f7c86326681b4

SHA512
6c528a4d8e7fe8910a713bf680526cd68f0c0fb9d3a3ef7fbf0503ca2f8115fb5c9895c171d4ea329474b404086bc200622980d262bc0fbd9990319e8639fb5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
235f91a64eb27745973de81a12b1cecd

SHA1
aef28c7cf3eeb466dd1ddc6bc16431fe0cf988a9

SHA256
913da3a70511ff17842456b3ae6cc396908ff4262efb8c21c6f693dac88365ff

SHA512
10a0a2f9e1180336f9e313ba017b51992e355ea316bbe2211c20ca02655f8b81350827a57e5b01426462d5db196f4b90fc5b6966eab83a7a19866700729c6e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit