d66f8a98a01677c029a93536ada5644adfe809254d2d236c66a7bba7cacdc178

Analysis

max time kernel
144s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ebe313dbafc6e4a6ef79c918d5554c2_JaffaCakes118.html
Size

143KB
MD5

1ebe313dbafc6e4a6ef79c918d5554c2
SHA1

f23b0abea52a238cc786ffc1abe1ad40d85d876f
SHA256

d66f8a98a01677c029a93536ada5644adfe809254d2d236c66a7bba7cacdc178
SHA512

47cf3dd20beda3b42765117cb9f58dde58fc6b380e034f9ed4edb42c5477c88ea5fe6c0ed5e061375551c37d44298929c0295e74a523c02510f087abe3f78efd
SSDEEP

3072:SrnpCgGIx7dyfkMY+BES09JXAnyrZalI+YQ:SrnpCgGIx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC55F011-0C03-11EF-9A09-E25BC60B6402} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421201461"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1684	2352	iexplore.exe	28
PID 2352 wrote to memory of 1684	2352	iexplore.exe	28
PID 2352 wrote to memory of 1684	2352	iexplore.exe	28
PID 2352 wrote to memory of 1684	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ebe313dbafc6e4a6ef79c918d5554c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3f275d496dc502903932ccfc9af6323

SHA1
69e456013a7a2b12942c913393cdb5cb21151ef6

SHA256
fd81b525217b51959e40983cc9bdf00948f87eddf840327a1d77c84a6a3db3d8

SHA512
e4292828408f6209c620077dd041ab1dd983f573ae626a57d0d0a90170885ecf447ae92885fd136b9f5e47d57beb7e3e8c9cda1076f8684fb7daf597aa0f70a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
191b844bbf2fedd83c2383eb87927358

SHA1
f1407ef7d91e0a537d028b7a472eaf845f74723b

SHA256
d4fad4a42e8d1a776e546b9a27ffb023e7bce117236b2709cbb69b7e719e5d6a

SHA512
0916c48ccfd354418ccbe64c19441c0da542845d11e5ae9cdc3346cc290b9d4b13ff88823469c9b0d90e77a28a6cd48438a22e640151b7eea22222a672993130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a82e7f29eef90f0b2c7a030b2ea3e01

SHA1
3a78acca0cd5239b673986576fbda992aaf5e9f6

SHA256
fbd215be85126227dc8e9b398dd26cc292575861b266bdcaf0f6c6b83c16235b

SHA512
ae42c2aaac7210ac62940231d30ccbe27172e821bdadf063240ff335f37218b262c11f05818f182d022265ae00473ef88373a8c9f90cf69ad7b43a8d8bc7baf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2dc8f2ec7ad6bec537323853a1ad01

SHA1
c142acbd4ee532eadb59d36642c80f11a0a25a7a

SHA256
f72200d084edf03bad300c9fe947f21c33ab7c50deaf96f7c369bb0016420cf3

SHA512
f34423f92b28f13dd132d0ca00e10c9ba99ce05ff4ac0aa5d2bd9cac0dfdd669275bcd738b06a98f3479b35855a958d9ab7993da3888c84828e74eb54efb1741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db1179ecd94099f8c5e78c36783a612

SHA1
7c0d38d4516c41283cbf678173e15b2fab36b45b

SHA256
1725c488f0f33e8b3010a331aef85642cb5d5b2593452480d25b0f75b2ee3957

SHA512
8f2d503328273466bfb48b63500bca215745cb91045096577a7f48434c0f74459918bd7c29b6438be39a67e7a9ae758de261571a25d74e23f4b08e172c7bec95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
363134430726b3f72258a64847978c8d

SHA1
f99f5cab7c35db259aaf1f62a69a53eadc01a867

SHA256
6790539f908a9a5959a1fe475842f6b24c4a20ed719b01b9cde956336edc1808

SHA512
0091de4284cd1304a63620ad087cd195a0caf2e54492736fd3afefa4d4fa6f89c90cbc27f43c83eed5236933189a7dad53420dedd8252a22d4a2c5818be49f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8171eef919fe2a4fa241df00f9adb552

SHA1
8a1252b579758388e83c98f1f54282a702ea8164

SHA256
3c6a207c66d9ab35de4e14b4a866b0b48cf83bc082ea3d1b16c86c1f76ed6e01

SHA512
6d50539743987eb794e8fc594db52deebadb487cec669e81e3f620c8924dff0c9507837c45159ad748bc18350f7ec923954d84a65305af76189e7daa5a2b223c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28e248c85f4d427dee1bd13c57c5e50

SHA1
8591e68896f1b149e5da60b51023ef4974cec0a1

SHA256
e4a4e21232f9f206b8d995860a01fbfc5ce21b1110883728664c9ae2b97aa2f9

SHA512
5823f8713d079bce2eac58a751fba70207e170e4207cc0e7dcc30fcb1091fa6ae7d45201b5ad779949934e5e2fbbad09b37d696dcfd1175acaf67ebf90029a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebe5a34f511a88b6def1df9d20884923

SHA1
1b22322ee713f252330a0e1e9e1fac3d9fe706ce

SHA256
1c36fd25f7c7bcde814d7165c2a90f62da46bf4f7b77be14aa8c0adcfa406f4c

SHA512
feb9a7c67cec2cad4db4fb69750c9cf03a885c769c25fa4ad5f5656f15a69c8dde8cfa1a6a3c71d08ddf9f897f17e7dc3fb44f6fdfe85c76ebef182b6a01c92b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2017404c9f5ec6e5a626813b3b8ea24a

SHA1
4a13844cd76360ec6622c539e5b72f01f8fdcece

SHA256
77203d2b537542536a805e2a2093e327cb7c3765b5e6cecbcba0acb8d40c2125

SHA512
ecb0712aed0b361e3fb85e49edd46724d51000f0eebdc2d3da0c5f553c2108c82580136a5fe8810521cf35151db4b80ab7968795c9a390973cf668107af25832

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DB9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E9B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit