227749999478d4c5b68e81e219834d72de93b94f6f1081c92490060e09427efc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2ad51523376bc8f4452c114e34e292e_JaffaCakes118.html
Size

27KB
MD5

a2ad51523376bc8f4452c114e34e292e
SHA1

e5f4d0f734e372b5eb70f62f021037a072e1f5fc
SHA256

227749999478d4c5b68e81e219834d72de93b94f6f1081c92490060e09427efc
SHA512

460ebf10193e2e8f44e28d9038e4eff55cc66fc4d697fb092ba04c2e7559d1b158b9574c720dd9fbbde06e7ce46cb026d6bf80338dc71863affb90d9a9129b82
SSDEEP

192:uwrIb5nt58nQjxn5Q/onQieTNnmnQOkEnts+nQTbnBnQ9eLkam60H17Ql7MBzqnJ:wxQ/AStQ1CS1mL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424392851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55806B91-290A-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3020	2088	iexplore.exe	28
PID 2088 wrote to memory of 3020	2088	iexplore.exe	28
PID 2088 wrote to memory of 3020	2088	iexplore.exe	28
PID 2088 wrote to memory of 3020	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2ad51523376bc8f4452c114e34e292e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
846097732255524fa2d197696cfe64db

SHA1
ef3769b04c4e71dde8f8cc924ed3e48b76d045cf

SHA256
4f0998f6843cfd11131a409d5dbf4db813754d2047fcb63b17776c31c7c6215e

SHA512
71f22d577820c85fac6392c84b34659682bddd6ba6ae672369eb17e9398e97bd3d1bbf87bc0f140b4876a0e961adf4c384e608dd09b6b5e6c924300d63f44a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deb535002db7040394d567115e72cc59

SHA1
be4e4e38c923607620954028b4042a83625b27f7

SHA256
ac07abea182e51912618e052106f049789aa10aecf7dbb183fae44227d9928c9

SHA512
319409d1ec0c915332c76d94c20e19b103192b2a9c41f4c25e947541f158973983459c318fe2d5f62ea7fdf889cf3d0f01fd8fcfce53003decd82e8db1afe901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2169db8fb1120054101caa474a35d29e

SHA1
e6f9bf2b88d2f515c21a40c7b46d1c5c5eebf35f

SHA256
4b06e92c56fe58a37afc3eea7673cc5e76375512b7add59ca4efb44b3af80932

SHA512
6f70a3a09c4a8e56161dcf34b00cdc9f97c2498a391a329e4cc724453f84fc88aca5c8286923ce3b06f81baeefee67f17fc6128cfec75a10b5381cb675c42329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
314b51ba642648bcea4a110b5875962d

SHA1
e01f4cf0fefa30133d12803457074eb6cd4087c4

SHA256
8e13187268915048ea6f7bf1c5ac529d61d570f295efa0faaa8cf983074e4a27

SHA512
17fb19d62986243f0acdd13b0fc1dc66c79af8fc7ccd7967616c378613a033090c89c6348a67359b4d4d0072661218ef28b2ace7b879315d61e22da60606b1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5105860d4b2922d4d18abfaeb6f33e1a

SHA1
7f793f73b54ec2310b24d4e6dbfbebd2b2eff22f

SHA256
f5b1e4e7e7ef6812e6c638c43c9558f2b101b09c6fb8d35922391a00b63bccc0

SHA512
ead276744224250b6b47e84458d52bdf21c77c4b55e4deedc05d46957ef707545bc5e81b615e2776997ef0cf26c880bac27813a9139b4e4d175dc0971434bbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bebf2fdca507d5e8c69d2d72f463209

SHA1
44038ce5deab91ccf93ee7aa8bb98cdcb3e210ed

SHA256
4f15705d65f4dff818cfaea6af7e28e3c19b99e2425ee9cd58260e7d598896c6

SHA512
32ed83393f880de88c08501dc4ed560b83cb736dad02c058c2cd3e094fc2cc37ea3f4654ea63ada9e687c7eee4a98fcea5d52f302ab8377ea62c5047cf3eef72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7c9f733e542861d8bcc40edf05d4e72

SHA1
c45a52ec2d85196560f7e90dfcfe82520fecf296

SHA256
9adf95c5579ddaf747a3c93211bfba6853b1c41162b1652703b7a02886fc76cc

SHA512
5615541cb3e6373dce67432be3417a67e2f02cdc16a14107ef1bda2da4949c188abc1a78e2181e5812e686b7ed9595bf35fb8b40f2331f841c02cfc1e92cc5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27f9059d8e367bf0e1524ab174b5b1c5

SHA1
e21e6b08be12f43c3876f4328e2a0cee519c092f

SHA256
33621fac8728f3bdbc4d973f195dfe7ae60243466d40b8521c33dcbca3c5ee57

SHA512
ab6268e1036f9db0e4660d39431c06a91334d2e53018baa6c6215c2d744a4b7ddbf6fe216cb2551e3bb4661abd6bf2a8ba4f3f59248019fb931a717ef25683f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3917392b3d2ed54bfc968d33590b33ea

SHA1
56f5deeda3f2f6f4ab02d27b0a648d7f35961eea

SHA256
56e9bd3ec00a6dd7f1719583718ce6844f35ae04f7170a31c72af042e2cf6d8e

SHA512
40abdaae601d8703c1e8ff56a3255c87022baf107da6e0ff76f6525bbc98364aaee8706c857b9c8f737adca9fe081c21012ec4dc90b5b86c33955c475b0c57d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1600.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit