2463c996dff4250956886a519f5c97436072dd2d509dfd806112a5faa35a734b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99e38468372ccc9f874decedc444b1db_JaffaCakes118.html
Size

26KB
MD5

99e38468372ccc9f874decedc444b1db
SHA1

e9af740ff200d29e8f33816647553ea721f1161c
SHA256

2463c996dff4250956886a519f5c97436072dd2d509dfd806112a5faa35a734b
SHA512

08d0cba8bd4add231c233db03050da508a7c927ef176c35fdb647b263a6c8155f1449acb3827f1b833292d7bb68e9af895cc00fbdf734d218fbd22fd555172d7
SSDEEP

192:uqE/rCb5nYynQjxn5Q/bnQieiNngnQOkEntVlnQTbnNnQ4CJVevo7NtBFo+NzQ4t:nGQ/1ygcykAI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39D77BD1-23B6-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423806971"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1248	iexplore.exe
1248	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2204	1248	iexplore.exe	28
PID 1248 wrote to memory of 2204	1248	iexplore.exe	28
PID 1248 wrote to memory of 2204	1248	iexplore.exe	28
PID 1248 wrote to memory of 2204	1248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99e38468372ccc9f874decedc444b1db_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd24c1854d34f9f4ae7f80bed3740999

SHA1
c3b1d383159789cc6ccc2ddfcb3c884ab23c4740

SHA256
0619ad6243a646f307529461ba328745e5c870119fb5ed9dfc699fd94595a1c7

SHA512
ab46a9612c5dbdacde029aca61d6dd0f406feaa80e6c0763ca10afc43ac58fd61012a25523097b51ad0f0d7af637b344761025970e1e868ffd3b8a6df26ed86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f43cc63731fc93a0de92edd940b95b6

SHA1
7024d2ff2ad253cdb4f89f6856d583e2fc36b7c1

SHA256
11b109108caaad87beadf7a7cd3e5d01bc0b5821ca3962ab5f72d23829c6b42e

SHA512
7b0562d620f09a807571c3cbf5c4c411ac9b4b022e4c38815617123aed5b460765f398f16218b2449058cc1560746e0a6ec06c19104bd0e89890c0af955b3667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aebac7299b93a6571e55c459d1d99a98

SHA1
85a2a09fec4d84cb12b8608f103122d4b1f3c3fc

SHA256
b81df89da7d3a6170b849e3eca0d843c21ccda46027c096a96e8de7ddfe351b4

SHA512
3c0adfd39a3d1321a2c30daf57071075f785916fb37b819f924d8d2b31bcff41c99494fd5c80e112b30cef57dcc6bbfa966a1ad172ff160c49875fb9284c81be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7523056fd76d61a9bc9d515e08a6229c

SHA1
79430c2b1ec9d7fd9e7e7d4f4d6c99c823ed8056

SHA256
a69a7c7c892ae585d4ccf7ec9b658301ab9ae060b528583271a6fb9e17752169

SHA512
f1fe6c9f95a9a0bce34d45c50b899ade0ae67aee0a9993e770fde1c864b5a4b26a8906317edb0ba49d7a0cf5a5b30d7c93df494d2f974579feb5fe61e97c3782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3fc6fa256a707cf97e03c7a3de14ae3

SHA1
c16e94163fbeddc5a4b5a7f440af8962821db59c

SHA256
dc8d313f6901a1b00a297a9a8b4e7aa402b78b8ad4211bae61e958e66e8ee9bc

SHA512
f4ca6cdc0a491507442ed7f7d1b242ad177a5286f13d683819dd27effb60e12d6637f7b77d90f219ac7f35192050ad836659012ded3026bf041cf1cfea74fcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
074b9a290802ba7aa6433003ed1a88ca

SHA1
85e8a905e2a2e22429b5806cbb5b76ba53297b98

SHA256
1e6fa93bcc012fe41221e86d76de49443d06f4752aa12f80e97755838d072bb2

SHA512
eab717c9fdb9d9653bdd787a569cb7e7906798a7ef8fe31d08042474b02c1eca7c09f2bd736f3ee2f200ffb8a040a5ef0e4380d7d96c79f040f2249dc085db3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db7721314002cd7e715dc481a506f1d9

SHA1
9ea230eef762bf212f7811fb2cb564074d28ce4f

SHA256
92b259b6cbb7a5e92a94ec50f0e6cd531b3bc0e2e3e86f9a7b41ae8312b36397

SHA512
4359f02d10cffc7b9472d5fae0129173f3dc57679ccbe91e071da4ad93a121a61a848e32054fe9cf60caff8b0ba758ad4c88197bcf14543fee4d43e4fd93b2a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f8798b6d75ab685db370aeb62185fff

SHA1
097e690bf06b1e4973e214e0595bfc99db96371f

SHA256
a6c4a2f832f3eb3f8da6744f254a2ac475c0794fc535739d94a476fd10da074b

SHA512
4940cfae5ac460d585d4112a78aae38abc144b813405beb8112cea466cc95c0feb70516c52f7b7591f3a42cd2d343901ca121b3aee20d7f41f752cf73eecd918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdcd3e968a5226d6130cd0ea6cc6adae

SHA1
d540e409ca5b90c844d808713edec408f8400255

SHA256
d583106762d4b958d2a15d072b604abf27cdbee1cb0772b0a0f3bf84954b8de3

SHA512
e3604556d868915d52b1f0faf799a7439d4a39a7aa9003d984757b5f10e7d336ac0fe0701468536769bc5024c35f27caab2e8c16f2f5527d8bc36172d19c3f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE43.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF12.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF27.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit