2218c6a017503298d34136fd3b4ade8622f6b67c9cf7b212211a1f794c1ddf2b

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98321c85c0852423fc4880a99d806423_JaffaCakes118.html
Size

31KB
MD5

98321c85c0852423fc4880a99d806423
SHA1

387a8b8b660c223c290d6608e2c33e90216ad229
SHA256

2218c6a017503298d34136fd3b4ade8622f6b67c9cf7b212211a1f794c1ddf2b
SHA512

16a090bc3dd1cb92791b68836edd4724c715f292059dc6528b0d44a424f009a0ad425543494c2fdb1138d8d838897f7756f3f835c68dd4cce4f087cc48bf94b7
SSDEEP

384:ACk3GDG7GaGNG9qG8GtrnPkul9o8pBVjfPdzyy71zDQ/qsiVSVSQuBT3WSEiEQ/S:ACk3GDG7GaGNGQG8Gtdsr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423753366"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AA9ED61-2339-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1808	iexplore.exe
1808	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3016	1808	iexplore.exe	28
PID 1808 wrote to memory of 3016	1808	iexplore.exe	28
PID 1808 wrote to memory of 3016	1808	iexplore.exe	28
PID 1808 wrote to memory of 3016	1808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98321c85c0852423fc4880a99d806423_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a10067cd4b70b896709025d52b503609

SHA1
dadc6ea78b91d24bacffb56214a5400d9a9b83cc

SHA256
1eaf324b4fbafbae46bf183f9cce6f594b20f18e5d7d27f14ef675694f1215f7

SHA512
2a3c6541a57613d18e8c034f890fbb65955899d9467a6db3ce3d1623c446a7968bb9ac4dd9a11195ab9216e1adcddc3a75bd371a323d3bb39ae55b74f7cb2c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94656d1009cc866eb30f6a56f66ff2fb

SHA1
daa792167baa96a1778baac5ccafda36ec37e3af

SHA256
97d6fab234187dcda43369684de4ab6856352fb16197563b30fe0546eff2a3c0

SHA512
a0515fbb926e1ca4158184d6b8d1dd9d89c09a9228d1100c1914cb249139d84ba1c66119a0457c1d95c0bc1bea8eb3c3c058a029636927e1942b1cbe0c64e09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c0ee4eabf3ba622d3be92fdc7a63c0

SHA1
1eb7b56f42c76d8556d08c65c1d7544457e79909

SHA256
7740157b2076321d40616d466940ec030ae170b7ce2de67c6a53ed1abc3f82e0

SHA512
fb25d5b57413539fdac51857c728527ca8f7ae50317a739fecce7fc91e06234754f99d1ba984fe57c96b676adf32580e55cbf2259dd3ddb747c553033d6118e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fea0b345fd77f3079061e2d666bc89d6

SHA1
85831a09a53cbbe47cac6bc9ca882c1d979d961b

SHA256
02a4aad5f8f54d3d544cd0e289cb019032697462949de7b906ba8eee89f66709

SHA512
6bc566b1f7532176b5db247e6493a70267aa5b64817bddf4dfe55d82fac1d46cd21ad941e42780c0b947154e5f725810bf502b9af4d3fd2d8bc2bc20d93d963a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62245edca91fcd86d12c24ba022cb1b5

SHA1
d3c973166a26a9027b6970c298cf02d45c488377

SHA256
850dae2bc95a91da6d834efd55f3aef34e66130bbf5d3d84910c525850ba0896

SHA512
eeeb0623a5b86820fd19d36b6f5023f93b4bc52032665d215381d26e03a97baa878eda84f31f039d0438c34d7d596d7cb6a0a530defc760504a6fe06bb0b2233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4036c0a3992765cd28252fce070d10

SHA1
0d5abb2b334c2e811f940f3258799a6b750287ec

SHA256
be5f9af9951d9027a0ee212cb92e6885d3f8b5df29d3d732c6deeb4e1e96a860

SHA512
6061f265f8dd8d9907131a26321ad3e3df5d3feaac361a2bfac70b068be0d1076b2ef36542d8ceb406977974f09ce93c11f03a52856042e1a4a7be6d395030ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c0c4840af9d65bccd9c09acec5192f5

SHA1
a409b714607a06042627f137550b5ff90d3fe501

SHA256
48961e9f3a8ada631b8f4bdb390ead2e598a89f38508b49641596f0e096d3d46

SHA512
9b1b55590e4862299bd16690797b992c1cbd23bcd51d74316518ca5ea99601fb6376fbfd64e7d1151d10a0caef683e648f885eca03191092fca1f654e86b2c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2813b2e4b4d65ecbf79f0f3e66a4a6b

SHA1
b1a65e87fa1ab2c823f2cf8825dc8d9a7685fbe1

SHA256
d1aef7e443188ec1eb8eec3ffbbdaa80cf1edf89c187b162985c8416d5ecadbd

SHA512
d1500fc9d40a9044cbba53502bcd641371fd88ad841416a4008bcc0456233c911bc792aaea9db80dfd01ff461be5271163a80c3ef46cffd671568632c5876021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64e43d15516cb3c2a7a5bddc7ae2ecec

SHA1
846bbfd0dec3b469fc7ef383f8f0775e173dbd02

SHA256
2e9e848a3207005d2261996c36308377834fba4b2ced1026514029afc40d57fe

SHA512
35e2bfccd0f966b4c8a437f95d7a421d653ed7185363b6e3c5b41f0ff77c16878fc4528cb2d80270a761953c205dcb03043d22467105c2f6990508a3873df191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b59e45bc0f3be48a2eea844db3552e8b

SHA1
2b6c927074486cee5be2bb7f41f9cf6d2bdeb9ca

SHA256
9edb41a321cdcc36d2976d1580370f18218b3bf5d87c0e6cd95aa8f13fcf6dab

SHA512
bcbd5aba4984b2445379b8b7da6ad78d07d515979d02dbd9c0805d13a7b2635a6c9579a9ec4044a325907c2e3b0025ed540cbec986a917412ec0e8d6bb5678af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DD9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DFD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit