7571f37260c98485cda5aa87e383376b84ead8fa8af36270435c727f7924ae2a

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99d6f03fd861ca307fd9de8dd64b5049_JaffaCakes118.html
Size

27KB
MD5

99d6f03fd861ca307fd9de8dd64b5049
SHA1

770fd42113f7abd297a526b016fd6252fbb9f396
SHA256

7571f37260c98485cda5aa87e383376b84ead8fa8af36270435c727f7924ae2a
SHA512

6c5204d8287f039262973e0484becf378144866508988994d5873bd2e985826bcec79c9c2aeb3d7f98247c7a384981c2defe1cfbdd710d3a8070769f3360ff8f
SSDEEP

192:uwqyWts84lF4b5n35equ2Vtatjy1JAnQjxn5Q/9UnQiexLNnEpPnQOkEntjW4bnS:qQ/yYTgLESvw1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423804300"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B67E01-23B0-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1224	iexplore.exe
1224	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2956	1224	iexplore.exe	28
PID 1224 wrote to memory of 2956	1224	iexplore.exe	28
PID 1224 wrote to memory of 2956	1224	iexplore.exe	28
PID 1224 wrote to memory of 2956	1224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99d6f03fd861ca307fd9de8dd64b5049_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cc2e6c6dd1f6bce22a022d92c953d5c

SHA1
b456f7db6eb88a12874e623dfe50268123347583

SHA256
18bb8b193438ea49d173664e5f679af462b1b88de5b4a425719c1ba71ae7810a

SHA512
73703687148e984a95e9d5d55a3b9bd21e248efb12a43efc702a2a8cb67a4b7c3e5e6c733955e107632007d67abf02c6e515ba8ac0f9c5709955435c623db5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab0b5fd542cb3b5ab06aed59e173516

SHA1
78961b3722b8881a959c9f1bc065cd654b96a6a1

SHA256
da442b200d65c8c5ae6448b08e3d2351e1eb67c5a45040706f3c03c86d857a85

SHA512
eb82f18f89758d4b8062434479bf4cba50f73f7fc08139cbbb5f7103c4693b245c990c54a776e465eab817b41841ccf4b24345344ceb19528c653b32f07ac94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c06af97d5ee4c6d553a881dc3df5a7

SHA1
2aaf9dc4ee7bbd7f7da6113a988bc29b014bc0f9

SHA256
514825cfe7f6f1c5c6002755b5b4b97c0584cd77eba8249616f3e9b1b15bc56a

SHA512
7f830bcc4a757b0bbbe666f7d3026e10e5e0e40cd69e84686e0cc725164dd5a30f597fd3952b72ac563c499f9bcff6910edac93e294aed7a5dbfc20a8b67f542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5c7b152a29031c30cdd4e6b5df6153

SHA1
fed82f9d3182067f544834664880e33a9f4101bc

SHA256
023cb476127777e5648ef91db8c2f541e5269b7d4ac854ea7e84e2c2a1b576d8

SHA512
65fc66e9a2fb7c3baa0680cb2fb68d02949f7b734b22a0a3f19323e02c7b660ac45a1636c0dc009ce2768fee977e2c96c2993fe38bc3ed4448b2f3297f6c66aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dfc5b54d7126a235bd8ff262442ff57

SHA1
0b774a4ecf24b8de238f64aff7b9cafe936b485d

SHA256
1ae6a3b7900b5f3b9870e23caeae0c286c1d42c0aab3d99aee1189ec09417652

SHA512
a81992ea83e0699b89b8fa7817e5393d58d664ea192b8239575530f0b3d09f98484f85fbf0444089e2e2b470108f48da15a12274b15aa05f5c77aacfa3346454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
346566d8f734ad29c7cf36ae5df9b966

SHA1
95518a2a9ae19bbce9d962be52a269d632f953ee

SHA256
367c8d5e5d1434b322f8d5f3dd9a90507df3f498c217accf92bfd58235348efe

SHA512
01151282e3f25173c41fc2903256b7fe01d04ec6f8e69f5676dd668c31c97212dcafdddcb2e658cf2ad7dd4072a8e12a7d560ba49be824f145c351c4766b4b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
406dd668ddf0b97b04e40727923b3dc4

SHA1
0ace4d738ec11c9913e633427f64260822557f94

SHA256
a5d660632ba8a63646c35bff15880362e2fea3dea688212ff34885fb3424b602

SHA512
3f1d28eeda65c0e653b8b2250c64936383aa44e6600a178508b36b313e5a3d9187ef0baf3d6a5589f4bbfb630558fe4b75a317352efe844307d175a712a1412c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e588de51e93ac2e16b334918a6a93636

SHA1
950615224b125f2a5b41a8d17985a2b8d3b81b62

SHA256
78d46fcf7e6eff08f3d5ea3649d22178e6c0fcd7fb5f3493a8491b116a1677f2

SHA512
3f895a146ab17a0529eed9476b6cec608157263786fed95643801c06ac8a7dff2cc99969346d1821ca28fc16a44cef12c3f8da1b73d2a0c667804036db34749e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1e5dd7878b3c4d75145800a109161ab

SHA1
78859231cfb5deae8a4b1394b0b541c0ee210e82

SHA256
39c1e01840ec6747d453a4171153781306f5afece7ff6362a7c80320713f1cb7

SHA512
8f72d8e73b01d81cfbee8142ab3b945eb5e180813f2c0de50df18d885c72d6760ec16707f924db8725e6af972393f10e14d3c9942eb7aec17f1417ecdb527eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab900F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90F3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit