1d0dab00f9d861c1898e7a0044a4409dc1767c7fc1007910db2b131e2a5cfc50

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

087289865b76e0862fa65a540ab61f58_JaffaCakes118.html
Size

102KB
MD5

087289865b76e0862fa65a540ab61f58
SHA1

36e6397656313fc947db6e98cabd7aec407f42e2
SHA256

1d0dab00f9d861c1898e7a0044a4409dc1767c7fc1007910db2b131e2a5cfc50
SHA512

9b5044202623ba3095862e1ed2acc1341bb83dff16c786e04e09d36284f7f590dbaac39c6c6d97a44e44e881d32bdbcdd18bfe5a10392af7e3990cc15015e67b
SSDEEP

3072:SZyIzgr5bWUwm+WEcLwTNR0WhNur36EREVjHx0cB9D5C:SZeAD5C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425393230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85DEAD71-3223-11EF-9CEF-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1816	1096	iexplore.exe	28
PID 1096 wrote to memory of 1816	1096	iexplore.exe	28
PID 1096 wrote to memory of 1816	1096	iexplore.exe	28
PID 1096 wrote to memory of 1816	1096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\087289865b76e0862fa65a540ab61f58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c61544811026d7420d72f8705db698f

SHA1
a34d3819f88d09e5e23736db99f667bb8a21a579

SHA256
06aae1fedc102800d9048b2f7fff21b18598485c5909f51259af3647ec7f86bf

SHA512
98e1a30b392109e7744f5f07dab05c5c1dd46557e87596613787cae9ba444f87b01b2ca8ee2c3fff05dda7f7e1dde7e61f2084692d7ad672d091ae59cc02f970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fbfb62744c1a52791e6b3b573d7a9e0

SHA1
56848fc6bd9e11d4f224747661810de74715d898

SHA256
fd0032ac9bfe30ee4abb136478d00366c9d85b06c594dcbf0a00b2095608b359

SHA512
9d4da840ee6995690c543a27de30a66f174f37086480492511137349de6e1e08822dfcaa6d206d87f8b8af769382fcb56a6c6b80d8218188bf74922e78befd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c33c0d4557fec82d195a0861030867e1

SHA1
450b943618603928c44252665f3adca5cd966cdf

SHA256
49b301f84d7ea6ec4ff8e669d97655e50e618928e03f06af8aab2ed7914564a0

SHA512
5a1d9937d5d883342d2b0dbf7c4679d948c8c2371009b5ef1055725fb34c7b3f774fb0bfb339b6331217e93364b313f121dc10d259d13cd4e413d0ca0274c487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b12ddbf53c35224f885aaa95da746af

SHA1
da09221fca48385cb9bc2ee01eefaa304b15cee3

SHA256
93b557f9ba73d3ef5435d65ec6b7519ba7f907d3b93c7b8780892d271eb61494

SHA512
3ffa9c8f9181bcd42d42b6ae2fb1d18d882ee0e81fac13bc6c70c222cf744e32f2bff62b12c8edea199c365d685431203474cfd99fca74b85578e55448af09a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640a41b147b8768e2b9a3ab27e477061

SHA1
56175ba7fa783b7be68f9dbfd3c0a6411d7a8fa0

SHA256
1876389cabffd5cd09ff2dd028724a2258bb918c10f2a694b58d15c826e3d829

SHA512
404e4f7c9534b4e91249d182e368747f37d937320446fd4064a069905432b0056fa35c40e8964c6a3d9a881fb8dfcac9091564dcd996d8b10b56dd256b0cd9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
747d33f6fc332cb3f1b527dce7b01476

SHA1
2537af15b1feab42ab84df28eab47ce5fde1e800

SHA256
3c9ffabb0e7b538ee86077d1bc3970350a2941d4ac776ca9130e7aaa28f0a58e

SHA512
cc5877809dd4a968462c0000472fe2818798612d04a24315c4552333367dbd139df091616612aeaa6010e5b9f7067018895c68c91171105ad62e66c0d9e65f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34fa77f9e6c341c8cba0c01d5a92f0fa

SHA1
c97882e27e677571d5d14d765020fdd4fda490b7

SHA256
012660efbf9f090665fc333be15919156e82f8f1c22743870f743ae1c10fd6cf

SHA512
650f45d38fe3333b814eace96aeeae84ee9231c69e324ba06afa94eae0bfa41dc151d7bacf3c9e795c0cd98cf787276e351b4c40bab5e4177bf862f1963355c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9530574a2905a47b36f43824c0d85c2

SHA1
4a155bdcadc799c6c0aed6f9a481d6ec1ee939d6

SHA256
98304049bef28997f56bb9065747853fe92b24ca4bd840950d831e483098de1e

SHA512
7812f82d96d4f3ea09f7be671f4b0ab520ea1aa769dfb330437f47dd5d9aaef5238d814fe58aedb4e00fb30c08fc0f7eae95c46cd88db3f240d699d26cd45a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d9c5230ac1b6ee54acf106ac6cad47d

SHA1
05e4bd053a6e17c73b35e5a37735916186004680

SHA256
0165b8d7635524c9e7a8b47a9b271b231472512248262742ca59444fb27a1fcf

SHA512
0ed8f8114b0122faefd60e9dd3ab782f2c22d8c78dbf5e2836a3f525be4bfa320ccef7750af634c6031f9d8786635157aedc17717acb53f3fcfc177739f1628e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2211.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2315.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit