19018f3fe0ee26a7e4162e105b73e0b44ea06be2545c97b32df1f89be20b7087

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b1ceb2a4418c550b06cc1df827b414_JaffaCakes118.html
Size

31KB
MD5

98b1ceb2a4418c550b06cc1df827b414
SHA1

d1fd9f4faef6c3463f6088ef9bc6ce98181597f2
SHA256

19018f3fe0ee26a7e4162e105b73e0b44ea06be2545c97b32df1f89be20b7087
SHA512

a172854b4835e5232d0b6cb6878c61dfc96cb269062810a06331a693af02d3f53f9da09cb6da5f0173a27ae09e32814271d9d8eb10d09b188897f84b23ef8c85
SSDEEP

192:uwTlb5n7anQjxn5Q/7nQie6Nn+nQOkEnt9xnQTbndnQmSZxTrAchW3otcBPga/eH:TQ/vWx7uospm1wZQ9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423768637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F99BCF21-235C-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98b1ceb2a4418c550b06cc1df827b414_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5a9e6c5dd30c40aecbc73cc1126ebdf

SHA1
60bd6cb58f01126624e995bf731a822a735c6edb

SHA256
e24fa5b90087cf576588a7222d57594e63c92f4934c0d429ed3a55b429797369

SHA512
135a25f8315c3c1388e84178cb7517646e0e3c54bceb7336da33a9f940a0f1a4b4ba516890f907c7f022847ded94f1051254980642090431e6dfe7e9e5d4a271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9df9f35878a0bca89ffe4fc5d43f3a8

SHA1
a5363d1a0743bd4ead9145852b140f77d0fdb92a

SHA256
498aafae53725666b8cbfb4f8bd3ab1c3c2a31b68ed39e709175b216c9fa172d

SHA512
bbe721331de42403e68ce7acfb2647697c4b2e757fa5773eb6507e11b1eac42da00d8e6956bdca7ffdf44afee15551f4b03612e8253174081c341cb939760fae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca5b7f15a5e1819060a4354f5696f8da

SHA1
2c6420886765fb3c22dab779323a3fdc986c8b0e

SHA256
2bce43f87902cf54365767313c3c1889e8932681f6e7c444557703a383ee4607

SHA512
0b837826e1c7acc7f58ee758f3e00b6307784818a53237fbd64657cdfcd584d3cd58eff890d1e424eaad7807da44ae0c3e0cade7fc7c114d3e9f257f0c52f048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0efad20d1734d4c329bc3796a6c2440

SHA1
2c8a5db12c7e763afd93bf77a7d6c034e53cd69e

SHA256
b9c1a5281963b9df3cb22bbefc21f2895d7279831f9756bce09e45b22978e617

SHA512
83058e29cf98aecbd6b9b4ddbc610a6c81ff8b5b7e6e72833fc0a1282c43450de360eaa1964c3c7dee5b49ef7b2e72c1d739700e6d31a6ef6dcbfb50f0fa029f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e6e9771c9efc47280cb2361981b201

SHA1
fb857a5a3b19002ec27b22ab4e8d3aaa5a362b3d

SHA256
d94fdab775aaafba5a4c22e6426dbdb3d3ca67593849c17ad52ee8571832f0fc

SHA512
14a1ffec5e36e116c56c3ccf18d77632b6c6e28072ac293bd536da575c38b3e4cabf139c9d4fa1ff4b2eb9aba06e7bebc3b412706fa46a362ed9e3cc18c4a5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcea9bffbf12f4fce7e13ebd92ff072e

SHA1
cd14b02158a8b20a1e87f975678bc61f661ea659

SHA256
dd8f0b0db3be648bef221f3dba99074fd719892ddb5195f3777cb0211cecc38b

SHA512
eae35f64231b7a236959cb8447f1d01b4c8422dd1bf92d8559b7dddb5769c78bf147ebb94d3cbcd1557ba758e15d63e247d02314f2a13a109a3ff21cbdc7548d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ba52608af408aac53a269d384e8e00

SHA1
de65dc0eb8291db2cd3eab0faa9f7a11f77c8980

SHA256
decde82d7ed1e0b22c629ef4a5738cdd0cb547caba0158f6630ff9348718aee1

SHA512
c7ded1b267f65208bca5e15f1abdf0a4edb0897b3fc2b843575a85094083079d9ff8e7f06b13ae21f56cde7c8061949caae2eec332b1c92a26e2f947cb3f1dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c9286e6b3d57db703c8ae9731bcdc47

SHA1
b3c45c617879b49a5958b9b5c3f209954adb453d

SHA256
9032b8466d2d7655a8c539dc063a2ef26fb2692779c6062795e7c205870223cd

SHA512
80da94b3df6af88e7bfa8a437454b2f1322ce514c3ef929c03fc6436e995174f42b5677908fcd6c32e9b41f0ee4e9d7c81de46e801db5f00111c6d2e93592a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815e5c2678f1323a2ed2516c39b8d7fa

SHA1
22ad3bb12ab33507e8efe65822baa2ff3ca79564

SHA256
2e3c3147bae5373a06487058a36850213a67a9acebc52a1e37c1c8c84145214f

SHA512
548fa8fc57b8e1c3aeea0c089fcf4f2bc9e58455dbb1f90d15cd7f0d56a7be2e3c983e4e542cba4da6f2d01f8e325d3fa1033e48dc71d15df14034761474406d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2371.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit