94609848f6b1736b22f5b01d22ed781a6a712b4c5a360b4f326c4b307a191ed0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2673d8dd4ca065978c0869482e06fcab_JaffaCakes118.html
Size

43KB
MD5

2673d8dd4ca065978c0869482e06fcab
SHA1

e190e7d018c4f1c4954630093c28ca9349a878ae
SHA256

94609848f6b1736b22f5b01d22ed781a6a712b4c5a360b4f326c4b307a191ed0
SHA512

d0fe095c618ceffd52e0d48b28cab76b931ef6a6e1d21121cf2315aa56fd384271885eb6e879c6cf6957f7e6acb3a871d90e863c8cdd3ca9083d043729cd1ec6
SSDEEP

768:SZy3WJCWlPonOumkSQhu71NPeqPmxdhy/71fGqqm+qDVPF7Sy3h3Ap7VSs2QlsLO:SZy3mRp0SQh81NmqPmLhyD1fGqr+qsVt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FC06241-3A54-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426293928"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2212	1732	iexplore.exe	28
PID 1732 wrote to memory of 2212	1732	iexplore.exe	28
PID 1732 wrote to memory of 2212	1732	iexplore.exe	28
PID 1732 wrote to memory of 2212	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2673d8dd4ca065978c0869482e06fcab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bd90926dffc9f9489b865873697b477

SHA1
2b8ff0c430fb9259e1dca5727fe2c48816893708

SHA256
832be4fe18c572cde7e779ed8e4c7a09e572b7e50004960eabb547a5ecde3d0d

SHA512
29d41fcfb8c1e3bc9336ea28ff0195b114f442952962c780fff07f0c97ed7168fdda1ec42463b948c867445197369382b1d44bfeb2ebb8aab70e368eba7efc7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c4decf2df74798f67edbad450ea06d7

SHA1
b10094eeb7d914fb3e4512c37530f84acee56449

SHA256
40892c711d25a01b9c2834b284c2253593181709f7798379a3b9aa80b0f776ad

SHA512
bd9c5976e12cc617833ec7251494f80a4d88c09a852082b92c3c85fae25f2f6a7cbe62486178151e733f2f8e28444b8444af5ccf14bcacf0aa756476f9017afb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3f6939f054f2b12d7be94bd4654059c

SHA1
e5409c18e9915a5731e8fbf765b3270685d1477f

SHA256
b0bcb7a8bc99da40d620a6619669284b6614d023aad09204a8076a638f9f8b3e

SHA512
18b2c5521656bee9ae941cfa2e61355a88ddd4584f369f73053a6a3e88d0677077f08f5bc2231d67f2f4c7e5017ba57d6a0d0c04c78863f7036462af292b6265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
788d60fddcaab49a6eb4c8502027516c

SHA1
a383a9fec0ee95a171999a9a7be0ac0038c156a8

SHA256
9d68695ed0dddeab68bb8f898844cdc3070cd2b098d19995168c6f0712ff29c5

SHA512
8800d88b5583b8f3e9183c93daf5255ef21f72f6e43412f58fa2400dc151a491d5c57457ba1c56f6f588227a11078ce993a002f9e97df3f2125afd625f73bece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1891948aca583c2d6248cde1ed6158d1

SHA1
51d47ee633c797b5abbfdca39908ea08822a06ea

SHA256
4cbd7b85c6e3cbab1121dffc64a5be491a4ddb3ec0a66931295cb79ca4144848

SHA512
98eb872cb8396e77d775fb99334814b41c2a2648ab5f85f18efe6d2623f685ebcb56207c22a03528594c8bb37dcfef4055fd10b2f0fa1ff68fda999d42955076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01b54e54f33918fb79a64d82519c8060

SHA1
4319361362f3b1b2dfc2e7d6fd75924fbad1b712

SHA256
5313c8aa4aa5d45515e7e2e2497ea7924dc583407531ea8d61985b05586c7424

SHA512
ab1da8394f318133f426e4183c53b8c54c49d8180a8dd9a5dfba9d1bbdeaa5d24b0f45cffda38a4118bc62af9903d80298656c56097e1e724dc9ccfb0179aa5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7f4b899808e2eb07d2c753200746e4

SHA1
9b0e9cbe51aa83cac6b85e61a52f17d9d0bd6ebe

SHA256
8cb4694d770855f58a50645e36a90c26a454b36cd7f2eef48fe967092fa1fa4d

SHA512
7cef29eda4b8ce6c2bbf46e9173b319c29094c3bd4e47684932b7ba892b519798aba943f5ca8166054e60ba886284437c4e4de87aa30ab81d2cc511f7c1a841e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a3c504f29629060be627083d7cc268

SHA1
f09145f520107f83e80c48f6294e55c4e9a9ffd2

SHA256
921e9e7ea4fe712be9173645f7d781e59cff3001efb928fa1f7b892080440530

SHA512
ab52bc3b43d7868d2d211d0056da9c8fcd1fc2818834c666085d857cb93dc92bd283cd2247079611a5a8d824f22395ed31411f8b82ffeedd57decdca2875bcef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db51d35da9c1042346280e6ae68dae25

SHA1
3cd0557805f8d5f59109a1a34e26145f07d73647

SHA256
9983a41e029ad21701a02702717309b7f4556b708a0c024e4210e09b13105fad

SHA512
4505a6607cc0ebaade8be7c6bb4e99d77cdb16894fa4a27b55a1919473712a0e3a2f606a6a21a03059fd02f66ce53fb376654774d6145363e84bbfe0873df49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit