48d4a4a9824c9ad683c882d81b03e4dddb8bd69ea8c0f5a9ffcdbe78a32e6506

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23620ebcee80771931864a744b12d27_JaffaCakes118.html
Size

32KB
MD5

b23620ebcee80771931864a744b12d27
SHA1

c19a9924449064851bd6815687ee96cda80511a1
SHA256

48d4a4a9824c9ad683c882d81b03e4dddb8bd69ea8c0f5a9ffcdbe78a32e6506
SHA512

95f0766df428f1519a06b188e5efceb6e687f0ce7a50bf153c020bb66a314b2fe4b1bbf890b0a188c3cabfc9befc3ddff71c35cf95122cac63337ca5ce3fa1c5
SSDEEP

192:uWjFb5nKdnQjxn5Q/VnQieYNn5nQOkEntfjnQTbnxnQ+MC9AFYLWPY6NJoky9t/L:hQ/ML56P9NQt3jIOv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424682472"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A91A7761-2BAC-11EF-A68A-46FC6C3D459E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3068	2208	iexplore.exe	28
PID 2208 wrote to memory of 3068	2208	iexplore.exe	28
PID 2208 wrote to memory of 3068	2208	iexplore.exe	28
PID 2208 wrote to memory of 3068	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b23620ebcee80771931864a744b12d27_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0e0ef4d3f13c119d84780503083199ca

SHA1
d041e69f1d63922fdcee109f173ca00b146ff414

SHA256
ea8c1c68b688da2fe8f3b880c51bc4901bbf1f31f670f0e2b1191eb81bc2f6a8

SHA512
ad07a42c56e3809798ddc287f1c426c0fc530ff589586953ef944f040dfbeda7f536e36374110df8eca958d5a4743e28ce0256f1b46f01905fc820f5cae22d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57612171dd34aadfd7343a27fba6d556

SHA1
3643e21fadd8bd7c681e66c667397a976d17cc57

SHA256
4657e26d1d8edfd03a8e60e52bbcc2b13b3cdd1daf81e7104c22faff47c1115f

SHA512
2ff09d84d2379549a15ce047f600b6bb4f70988e22c393e62c937e3c8d885fa8b4da6aac71800fc2fc5843e306e067d0f1004588fda85a8835a6b6dc8eb09881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b111803ffb044534260193f7842fc7bb

SHA1
73cbe248390feda4f598c2c2139e5f3d02fe0b7e

SHA256
a3a1d277411e5c58778e48911ad495e4bc9a10ea6ce194d754903268ed3693c1

SHA512
e74a5f6587ffda409b263306b305d932ed62b9e94452005b183106c0912d348e3e44f313b3979f4b06466dc760e1970d42c2136c1018906b8ccdb6bc5f274a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2448a291421bf73ad3c3255f458f777

SHA1
ab549d997369c5d15670961d22890e87506ff4c6

SHA256
dfba3d73b33c18917860203c96cb66be41dddb26963504cf3a059e453f006fa3

SHA512
655cb4a256ff3dfae5770335cc740bd4201bf695926dcdd7f0e41166ddff37023ff67f379298e3fa6cb0ab553207bb4349a6ecfc612671a977aa17cabb8c402c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5088cb9deb7deab43a0b2307fbf0119f

SHA1
727e5669c9825b9f110fdb34bd72f31378cf2343

SHA256
ee080a0667fb0817fff1c375ea15b3954c4ac48e5d03a2c6983ec5581ed526e2

SHA512
01fb57a2834e289ebd8592c24b6897553a7cc70b84dd96a725f5d2df6f7b0fef72ac57e40d9519163fd32869f85afac568ad83e897881c31a4acb7ab15b9535f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f49fa6087866cce80c9187174b6d496

SHA1
234ea6908cf4229037047dcb34b3b519379f577d

SHA256
e1d27ffb9e73a593d2ad70bad99156b4a9a39fbb59ddeb1bb6cbd115a46f7999

SHA512
f1b199d8ab3d7c6cbd26542908489724c8b166113613aceace22b83f8ba21e954259f26711cc68e2a8caf3619cf7f5297023cd028b4ce7f94104a0b0db8f0e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb8c3852855aba3c8b200c351fa749a

SHA1
1c920e6c1f16146381c57ae89d8be8a881a72cd1

SHA256
61d40d625b6bcd1a3c58aa98c63dc9d727246529dd3c3ded8abb856718f1bb46

SHA512
e93c145b531846a9a77d57b24b1b7a16bea5f06b7a6f2d6ca06cd34ade5da1776abb4c8dd1c31346b111eaa4319295f70732b7afe35d7ef89f28cf589d43d1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445388bc73741cea3d641cb59468c9a1

SHA1
7ea85128e34be4dd1859b35b3c538af106fa4c5b

SHA256
9c06ca212b72e2d1257ae7ccd221a06284cd254fed24268e9ad7143ff29523d0

SHA512
e582d8051d8b0c70655e974c526e235c053d362d63e1740dccf302b1b90d2cd85c6868712e182657dbd26198db236a97b3806bbfbdf24b323c4ffa5ad90713f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aedb4e63d8336a8a1c283b70202ab4d0

SHA1
bfd48d518eeef271d2c2fdc7bdb93541e5148e08

SHA256
9901787c87a85ce6a46c9391b8bf1c420baa58a34384ae0f30d891e6327fbcc8

SHA512
9ab82b15716e06cca6987c755690b68dfea24831653ce1c9dab195aa46495557dda9381cc214cfcd3907418acaa36df9f7a6f4e5e525d87769d940c4f1c358ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3141e3574c84cee3cabb0e327fce45e5

SHA1
280280194dc31189b03502d8ccb496695808644c

SHA256
acc8fb1f221f90634e5922812174f32049e21e690ac3f7e9276005385450505f

SHA512
4fc4c8ce04c46c70e6fe5f8028cf9df454a73de16f41d458292734a4024143343b293b2e14daee4f68986ff8d451ba60c79a90e77a6af0f3439033c888c37bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
07a74f9e050c2db89783953302817df5

SHA1
fe6aca862d1eea3bf2f0a900fab92271a00c194b

SHA256
00bfb370117f654d4d43fc65a7fffd0d5718f8e2c85836408d4212f63eadf917

SHA512
658bdad7784ce92ba367510cf0a7fe1bf7e4d73e1d29a7958ae2c504a43500935de6ed2bb9cd129d85b230712cbccb75dbfcf5d700fbd9ee74e03e760bf502bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1106.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit