96f81719abed0b096b64413aa3bdb18af1aba9bce350c6091c675abce40a6971

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b58e2332dae2bde41d4cd69dfccf05_JaffaCakes118.html
Size

23KB
MD5

98b58e2332dae2bde41d4cd69dfccf05
SHA1

d98d0530f5c81809b6364de9b857dc43fe1479b4
SHA256

96f81719abed0b096b64413aa3bdb18af1aba9bce350c6091c675abce40a6971
SHA512

614ce1763bd2a8717b559b028ea7be3e6a58a23fbf4e80f2275dc1e3afa000e69243640da0b186ffab3086f732b7f9962919632745d98eb84ab8174e8e913a35
SSDEEP

384:3FNmw/SOHKlJB9e/KYt6+/Q/su8n+6wvjo1QSzaKu4uCPeQnmQvP:3FNmw/SOHKlJB9e/KYt6+Xu8n+6wvjoP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423768972"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C13ED591-235D-11EF-9B88-D6B84878A518} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2272	2296	iexplore.exe	28
PID 2296 wrote to memory of 2272	2296	iexplore.exe	28
PID 2296 wrote to memory of 2272	2296	iexplore.exe	28
PID 2296 wrote to memory of 2272	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98b58e2332dae2bde41d4cd69dfccf05_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c641f06953c38786b3104922f345e4a2

SHA1
ca93c2edbbb19da7bddf384ef047bd625b400bcf

SHA256
dd40aa869edea47bd3c6e36d5e857d85a4e35b4b1262c1c5a58dfb6922f4f85d

SHA512
b8a413cec4803d3e3cb79f84bdab2239e26a09e92dfe3afd95e455b09ccd296f790dbd998d1a2a6ba82657d4ce2ae9b78ebf5210272a2f9caa6a65ee1414b8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24762a9d9e37eef5dd978ddd3dcd4710

SHA1
439823b8b8f4e3254309d27ef8a684d0907da715

SHA256
4318f5a675fe52aa08f62674de1eade8e74e97f929bd8eace2aa9e156537eedb

SHA512
c43b69d4ede39fecd47e075bc7efcb73da9107f967dbfc8b4612465d0fbd49c809ca55e69a6a490fbfb471967c78de677574f2699cd12f3fca8207ff7956ba36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc0b6602f734a45413eb2aa75a76815

SHA1
a4345798f7ede6a940845527f7da5d289f62213d

SHA256
2ddf6c285f784991cbbc2e5f9cfa5fc464430845d1fc169e3a8aaf5a66318f47

SHA512
a9922b775fad0aa4cfb7b79f236bb330f3a80e2b3c5cc34914eee42f0435179ec4ed304d5f4106ed9a0101417fd45c42a1e75decd22fc8b47071c51e9faa6be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cdc54c028ffc3a5ed01fae75b1d9ea5

SHA1
b84f77fddf4ff1757e7f890b9529dcfd4c54995f

SHA256
9951d70540a4ba6ff9069cddc1109451c993765bbfc7f3c16f6f18df37a71afc

SHA512
9058b5086c5e6d4ebf55624d083a13bef517306f14c377eb7e43d2eb7461af71d66ab3dff5db8c14479d2ea46e9f41eefa2176ed6d2b9c6cb8cdebfab8c727af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d94e0bac33383b0943e7aa35c2b1c7d

SHA1
25ed33ecf444b2da4fa98e95f732671d27ef9bf1

SHA256
30238fa03524a576bd4b21987c736c7225f32d359577e467f397f4a6d83c8423

SHA512
185589be5a898042f266a3bc2da715ebde2f8b38782b0549caa7153079c353daeb2d1dd64ab8c08a8f1607fe86338e886b984d3983a2b5769be55a80bf689763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe5984883b099cfcbf8d0e102f49b45

SHA1
04f986216e2c8c4c11232419afa14014494e4add

SHA256
190d8be6054c4687e41372bc3577cf34b003b326cbda86b24788451054324971

SHA512
1b214544014234ac1a20d0d57f93876969f95ea456563ce11d3ff6f6bc09390a9b7946d9642d878a7599b164122e48da0a337474fdfc31ac203fae0b03aedef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2ceea43dd6d3d1cc5bb16c3130e7d4d

SHA1
26de2203349107d4fecb977a63209653d13844e3

SHA256
b3d5a7c547778f14ac15b2db8eec2a9e9ed2f032fc52179214cbae9ecad182e3

SHA512
feace61be6626105149b06894341b6b638955df037b18e76fc61cd8cbf852287d886bac7637a06f158ab73dc33627acd8ec151114124d037658ea1f76a9390dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
114aa5c0da7a92b9c9a66a2ca561b0f8

SHA1
102ab179a9f00675568a293f2bf1573206e4d4d2

SHA256
3b03243449622c9b88cbe798788fddf59475d8860ef2baca58a02d1f68ccbd34

SHA512
c862dec24f0db3f2dbe0b32eb705d4807806b5c913a18bc4c2059a5fdfa5486c3264ee97c5809bd3f0c767182f1a84142d5f3fc514c35a6996c8ccc26e12f1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac0bf09d7a4d2d864465b9a5a44c3fb2

SHA1
7f20e50ded5bc7a66ae4da9be6c53d425448c2bf

SHA256
3f4ebcf5ad84ac15f46c40d29326da1b899ca188c4e398d22c05c976e01d5ebb

SHA512
8ca91d0bba865df5288f5528f5bf2cff35125a07e4e5c6fbeaa63238d123b0ab3a79109d639bce4b8aef1c84543a1a5e669232c0f1fa7a27a6a46be9250947d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab277F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2842.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit