721bcc9f8906a1d2fbf3517f19738eb72a36ce5dd3e8c649a7307a2999428b62

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9842ba8565d1fd2ab14b5f33f80c0b60_JaffaCakes118.html
Size

31KB
MD5

9842ba8565d1fd2ab14b5f33f80c0b60
SHA1

f3069f25c4f23fc1b35c020212d6e9671ed25e18
SHA256

721bcc9f8906a1d2fbf3517f19738eb72a36ce5dd3e8c649a7307a2999428b62
SHA512

cb5f526f27e5ac629203de6fd113fe6c1ee12d42a2a726f1bb9abb80500dbb5240ea9206c7f62ef85f2b88c63d4aa7161a68ac4b390f2860bff295d2b25eb900
SSDEEP

384:ACk3GDG7GaGNG9qG8GtFQ/2WS9SQ/j+bf:ACk3GDG7GaGNGQG8GtE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423754953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D4C7D41-233D-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9842ba8565d1fd2ab14b5f33f80c0b60_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6351f0721dc8a6315920cbed3ce7e5

SHA1
a72f7ea0fcf61e9a0a7187ae1f68a9c0e3662dfc

SHA256
53201b2f2937dc17445242648dfb22dcb225e8c25deff16b86c99703d08dd826

SHA512
1fdd5eb912a4f3b03d662711ec878d4d50800f16dac7d5fd40456dd1c3bae5f35accb6781644aff1f736cfbd0050f2aa6706cf9fd4cea31bb3a84de041e61774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ec6a199588c721875bbd215379f83e

SHA1
b971c09c5668886480bf4c08bbcec79dddf1fed5

SHA256
fb112f2217ea98aa0a13b0f9ead871de7ce6cd46891315c8312ae837614804d7

SHA512
472c8bc438bfa88dba0541552dc6a1bf08223e439e41bdc5a2094e53e26e1645e951575d4e5a61505302136946437aad5aaf0286f28bdcc1a35782687b527afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f64c222ec39b255e92dfeff4153087d

SHA1
c0a38e50ab38406773be1ce5eec1ca317a9c7b28

SHA256
857f4f02012af0f91e0b55811c2a0dbf86f77c9cd0235170038acfd3c620bb0e

SHA512
5342965fa8923e0a8570d534d630a322bc4e8f5c188106758611a15276335fe5dc5b92589b5a2808e391ac253b237b1d0d3d65921fd8cd25d0b2a32b727ea798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0b217dccd03832f46567d6ce39a825

SHA1
944db7bf1dbb3d3dcf4a061aa7765870d4987722

SHA256
8ff58325d7f5dd29c781348e05b7ab96ee76e8ee77a5d14b09dceebbe9026454

SHA512
147339678d12eb304064d20fa8e3b2c10e12ff8e2b00b39c81be899e5236596b6c3b05527feabd6af7394f10373dc40d5ffea9a3dbce40f7038e38d2f58a70c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e9630b546c0a8529d31dc0bbe69121d

SHA1
67efa7424d85b055105819897a7158bbbc41f7cf

SHA256
69d79aded5abea723abdd6d36321bfd5dd2226372b5969f2e47ff1004a6093e8

SHA512
bc0e7ac3f74d2131e12e67ec5a779055f345d81ce87af134bc744b348f55e13325e47bfbf6cc6a29ce648b31994cdaaccbdb00e5d7b89c8a2f0649a61354ec14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3eeb86cf67ad37cc7e97f7330aa099e

SHA1
9ee708b1d14a94aab6e7d008d6c034f3f98ed967

SHA256
f749d96005a7d4d2cd8f31cdf2253acfa9b7b0cfa6c4a9408036fdc4a1046bdf

SHA512
bf657df742ec57d84ebed8d9f3ce4fc95ecfaf898043735d305fdab70095468a869325e76586bd7e5dcd1ac70290002085ff6e6bdf70dbf8a34deed40ec9fc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90673b316f8fbca256bb5b487b999d2f

SHA1
e72b1d2aeb87518d1371ba784f84e3a57e826008

SHA256
4c1d794b9f168a274fe7b0bb9a024db7be59de425b144ad8c475f94f2cdcbf27

SHA512
51037bcab3efdc7bd270d124ef3ecfd8519aa201589b4a13fb12770570febb9002304a80b3f42a46475840eba3d3fd4e7b636c144d8b6ce34cada54b42d97a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28741142810b796c3d5a57fe2fc549e2

SHA1
6171aad7e2530ca7c17be6716353b1a08196bbbc

SHA256
5fd0967fb86adb2b9ae23a9a0d28b8d6427404511197e010af428b8807547b56

SHA512
5843f7801ed462bea5ea0640d5c700ef177e7cd50e883da44601f20e8f12f7edaeaf6168365944a4b32b0feb42993c9f9755313af5ea16476a6ebd04403dfc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit