e3e389e69409b20f18b7755d2770ed5ed4817fad2193d5a5b2b17fb3f4ce8b81

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

988c7c21f46a818f039670c41edbda58_JaffaCakes118.html
Size

27KB
MD5

988c7c21f46a818f039670c41edbda58
SHA1

a8e60b2fa11b59b5b867166b2764aaa3313eacc4
SHA256

e3e389e69409b20f18b7755d2770ed5ed4817fad2193d5a5b2b17fb3f4ce8b81
SHA512

d4d9bf4b7e5c406b28da1de0491a6bf2ae418765960814b3d33d1d1653f8be5d66d5f3158d5ababd61182c8dbe04d9f86375515ccb115e71448731f5a6ea8e7c
SSDEEP

192:uw3Ab5nMenQjxn5Q/LnQieCNnlHnQOkEnthRnQTbnxnQ9ek2m601qPcEPWQl7MB2:FQ//BeSqDS0fh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCAB7A91-2353-11EF-A585-5A451966104F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423764724"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28
PID 2392 wrote to memory of 2568	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\988c7c21f46a818f039670c41edbda58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63b591bf3aea068992abea24fc5b4f88

SHA1
76476c93ff4b2815510c9624a87ad6f471bf78c4

SHA256
50ab4a14986037c85667addd84825ea31bd98bc4c6589304301b1350d0dfe8b6

SHA512
0f4a86e94268bab7e1fa1f440f52e9844a4e2381fbb3ad0d3dd355e20f334103f7a1e7dd06fb157d850820442ffa205e8ecaca56c0a6f6795b5565b7e48611c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247b17505166994383af6cc540e3078b

SHA1
90ddbf1fc901a6cd55da23bb1b000d466de514fb

SHA256
77d02c822a8eb9d9c7cb60e30d5a7064c040aa5f58e0e9d900ebe52731d24983

SHA512
f9541552a142e182aaa44c8eab453e1bbbbd2bd0f8da9e3bf0b91ac136215778fc94b266565d1cf8b06eac76883d725021d64dad2fb079617df83d5c2ebe8faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f100ff65e3f6d1fddda7747fe6e7854

SHA1
35ab8144c228293ec73d4c0bccb4650dad1b06ad

SHA256
15d1ed737f5448fa885b0c358dbbd7ecd7a78228f21a9770d8d528d5f205c5f7

SHA512
b4c78ca9776e136a75403ac96fd30d97636d28634b4daba2fe625d4fce037bf0d9f9f8c70ebd98230e96c50bf2b0aacb4afe267dc357442982f838dec7d1fd19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1350638b571e6c709a9afcd3b6559a58

SHA1
07f98c44a280621614002b6480b3801bf36f3c3b

SHA256
e3118c30fd49e818cd64cdbf2be746a1d2523d364b5c945de7d0e972e92a97fe

SHA512
30e4167a8639af4bf5300143f0708f29bca0feaa4a2f50e848b8743d9a9788e7fdd0d91e6dc82f73b7e270fcb7c0ff3e6a04c6af57b04f80ea9f424bd9395eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df44dd7c35383414f9cc1933c0992e80

SHA1
44375c5da3994b3c0d46cb58c20d843eb2bc6529

SHA256
6fef3c9d8f1de274678bb826a3dca3216bd2de28e47d7233f86540a61c49e0a2

SHA512
5c085fd335224179cfc1a96e6e0c74fd7b0fc55b5b8c226e21d6585d11f386321f5b55447e95b8400a48c988be936653be7ff40f11c9fa2b90b5d32776224f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4303cc464314433fc05bc398320354dc

SHA1
9e9e08e7d10bcc6465c8cbce5df18fb12a80d479

SHA256
f949ed474b1e8f5e1566fa66969048caea3598f69ead4be08234104b7e9a77f9

SHA512
9860b322a9c276bdee4c2a441b1b9600ae9d04ff77c89b802fdf72b785a1b78753d9024864ea57eb4d74b7be2a5ac5a468fbe6d6a418cef68a8a6f31dc9e7273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d4280f440b556003b0ee46e0b5ea533

SHA1
e9a3eb72a0076300d7ae2f6bdd3f8c578f2dde6b

SHA256
abef0e38313f11f6db208d7a39231e4bdfe18e45ab3d7bcd83554b3548ca8cfe

SHA512
598a85c9d3004b05b20f0830be074c2cf7ffe833bb202249d42530d7fa013fbbe51a53692932cd141954feac08257712802607ba2353f82573ac3caefc8abd06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df30e3b9be77a969174bc12ebe0f53a9

SHA1
d45769bd7282a0402d2edbc29498f16c9f6a71e5

SHA256
17edc8c0385dc94f2e070a27a48386f96aed5f82b814c06843746eec6bfa0b91

SHA512
3e483b1c66a0ffbee7979120b74cef41c9ab875826ff456628c7c9db869280fabfab7c300738a7e76d1c660c30cd3125aecbcc720c36ca971b36cf5bf08c3a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fd314744fb02e07e52f135f0b3c38a

SHA1
372eebab08ee48445318103af81becd2d848cc6b

SHA256
b08532dee6881ca89193fb343fc6edf2565510f985276f9f666a18dc5feec119

SHA512
e9a454c72115b1f10e952ea5b9b949463ccfa9e1e2e07ff35f279c2a4f6b7bdc7825586c872baa4450c7c686f690afb467fb3eab89be48c234fa000df44b47cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit