3b0c0c3cf67c4095c1597961ff914bb08d73c411d670a002557cb8805113f15d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92bb577fac710dfe977f4751e040451_JaffaCakes118.html
Size

23KB
MD5

a92bb577fac710dfe977f4751e040451
SHA1

b06267f4e2d6181ec1d7e987f5dba674aa9d3148
SHA256

3b0c0c3cf67c4095c1597961ff914bb08d73c411d670a002557cb8805113f15d
SHA512

18da471c921c1477c497b1bb4a9adc388434c25a0232a16c4fec9a24bf3f11ec3d0f25b79c1699b4d559abaddb7102ea4d28f1e9e7e44aa3c05213d2cb521870
SSDEEP

192:uW7ob5nJFInQjxn5Q/0nQievNnenQOkEnt4KnQTbnhnQpCnQtXwMBPqnYnQ7tnwp:8VQ/upzF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424522344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D55FA5F1-2A37-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a92bb577fac710dfe977f4751e040451_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
614594e809d0b77d1bd8665a22bff5ca

SHA1
91b2f4b06db55850bacd38bbb07625453508afe0

SHA256
1e3fb9f9fab9965e4550667df6fe0a1640b8788b085bda279d792cb5f7c33921

SHA512
2808eecbab4ef2c79f90fbe82265257005db1d9fa0094f83e9e7086f6dac674e058ecd42fd5b542c16b090382ced7cfc7b8d3f089563f57869acf5d146d63dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63cbf471ec69176126cf69a21da60733

SHA1
aff3454f3e7dfb04a56b2e2285281871263eb201

SHA256
4e41c989b3efed37d0149f8151e8391e926c7cf578c5e793801e9f52bf135a38

SHA512
9dc3619046b58bce4ec5c21d7d67281bffae06825462e564cb7528476b620357f77caf8bd9f1e63e73ad2b9d6fce218873821f61b861c39f86dc2e7aa13c93f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee60b2a8248e8e44579402cf1b46e783

SHA1
8e1634ea9055483546ec980c8b5d57daa8f1cdc8

SHA256
330bf0d57d95b3ab35ec38913966699831acce5de3734cd731a2edce3da7b244

SHA512
37de549a31f7a2cde09407cba2b33f0c5e6f95de2e4e837af172ce8f2213ea8f75b98dbb8eac1e3b68fc123f15fba71b5dd451e183f131b81248c72e09c08f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2848732b61f62b7e7dacbce9549e783

SHA1
21c6fbdec31128377fee6470ebf18f5e9f41dd99

SHA256
7e18cb85bf63ca1a4cae53b1f1a181a03448195bdc5ac1d7f9eef07bd3954018

SHA512
14fd4f013f3af04a9b1e5f8432bc3f4f75e7e4656cc5214d432f1676827a97fa92f21eb585143663db6d0942c378abc62c8e78c893d99727ab26a249665c259b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e622be7fcf6d74ba2263a14f61cc9830

SHA1
3d67d74aaf8e124eea5584da5898283a1152f8ce

SHA256
c46aa8a34897de9f2dc4dc4b6a6a814a647d335b25cace8ba17b16e7a55a5455

SHA512
001593f52ec8c771d92c7cda681f0cf0623b3c8a8845e8c0de2f641a17ab99e8c50db46861b3d1065e9f36bd8eb74c77a35ba80b0802b112924b9575d275f969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa39d349e16ea9f1aed91e91e390cadb

SHA1
3b0556185badaf1788f52829f56ffdfcfa56030e

SHA256
d0239757f15aecfa30f2d8b1a1ab7fa6bda2eb4a936a6c24d5e05b5c8d83e808

SHA512
90493865d448905e3ee20b93d2babd5534a956e636cb5d5c7bce8ee67ffd33cb0c4deb64afaa5cdc8b3bafa5a088d1fff77e62563c0126cc13f11642a0ce7d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53fa25a27045854dad43243f8cab0fef

SHA1
df41ccf6c39a2e58683a226d7dd2b446ef4a96da

SHA256
8376bd39e3acb5165b6c5732da9d4b1181811ce0d49fe3d06a6622da60a65cc5

SHA512
4ef23f3f85eb5c0fcf477a472f8403773a3da12ddb2c44c0f283bc0d87d5a1fb1a80030ac93ca7bbdc70765063259ca53ad90cff238637e12902e3e9ce1c4003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50a390ede2c3e91207e5ec72ba9612da

SHA1
c4f0c85f9f434fd2507d3c55a2ed04e051d476c2

SHA256
9148cbddb0a7cbd1012d73fb8c2254be2518af7bfe9952c184fe0d6f133a3cbc

SHA512
a79afc87a1f2bec566790e4876fd6d043e9812e8f44976f5ab87f03730f31a92722c9a498fdd8146c2789afe3a34d86aefb8ef127d4939494bfd08f79ebb0b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit