a8c7248e18c6de949df97c4ff94d69a496326c066183e5dbd156acd0749ceebb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20f982b0f55e6d14b803e540f5d8b04c_JaffaCakes118.html
Size

126KB
MD5

20f982b0f55e6d14b803e540f5d8b04c
SHA1

629a15c2b86141c04ad39106fb453b8d63647d6c
SHA256

a8c7248e18c6de949df97c4ff94d69a496326c066183e5dbd156acd0749ceebb
SHA512

744cf6c9b18ced2382639cb235e488b506ed3c52ad0dbdad2a4b5f45f7febacaf2749d1dc482d880c71ac2924a4393d27aab781baa5840ea54c87584a5201c01
SSDEEP

3072:S05L1PJLN1AyfkMY+BES09JXAnyrZalI+YQ:Sm9sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421258821"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A24D1B1-0C89-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2164	2356	iexplore.exe	28
PID 2356 wrote to memory of 2164	2356	iexplore.exe	28
PID 2356 wrote to memory of 2164	2356	iexplore.exe	28
PID 2356 wrote to memory of 2164	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20f982b0f55e6d14b803e540f5d8b04c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
18ba28537a116085d897a97f97102e5d

SHA1
f05cb145bb949eb8bfe60c223e8cfa97a92eb025

SHA256
5a67f6232990927e49c09bf663147a23d3dea3452d0ac3474a2891a8878b7269

SHA512
234ef0a8b37ea4828a8388520c258032ff403f20eb52cf4a262d6c3e879820926bfbd5deeae1139182f94160ebac472732f57d4b8974dad48316e505c836153d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1ba62fb70fe00e1f9c0125a0561bb6d2

SHA1
4c37f33d5339e28d5f0774614c0236a465766e60

SHA256
c9e083d7e3a9be18534e68fbd95143f9cad6c0112018a9217b78180e6aed0f1f

SHA512
715f1f1577507f682eef74842cd06a3937a0739dffb94d33679a88c63b9107d8b25e476933e04cb887613252ba94c0f663aa0066eed4891ef4bcd757f72a98bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5ca4bd87420224823a29216aa9fb1f84

SHA1
e12b192a0a8d27cb314f8d876944ea11d0841773

SHA256
969b29b469f36484e651578af072128c75f8c4c89d83a052197d927eec3d6ffd

SHA512
1bc69b1c88807a133722074de8ffb24d669aecdbc6bbecfaa3305a6d3017e9db8962eb6a83b5ec0ebee81fdc2fb48a9ac1aed2efc51b46b00f52488bf8d31900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
efa756186fab2443ade296d61a82a9ad

SHA1
492c38f4cf1dc3ea7e4d98fd51b31e005403ed0b

SHA256
08698d95bf9247c3e5bee97eed8427b24cb6a85955f038e45c49e44ff3238b03

SHA512
a574e195ef62244ee4f47ce75f01d611ab42fee2e0646f5f00830bf0b8ac7349da3585fe29c29a608cde666e7c21a4079bbc82a914f6f01d7c0c748e67923fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7139d1ee24531cad14c2af18604e5cfa

SHA1
d17bcc86f9c53a596633c71b7cda7ff3b7f0c29a

SHA256
d6e44b889e737647e9453e617491a2a38495a11ab7400f0d1ed14a93cf9ccf7e

SHA512
2058683535f9e7bbbdac0acca16ce1ce48926ac3cf1c62bea25957d099302508a24118547759b31dae028092b088e5b99eb8e9b6dc0856f5fbe826334af5cd3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e7385aec17b5856391948d435783bd72

SHA1
ce1ae0bb2f2ed81388684c4b3457aae8ecd22fb7

SHA256
e4ef9700166f2724d954f5fb0670a604e215664832acc48dfc4f205e07424a5c

SHA512
9200566923cf376233d4d3264d17b02bd0433913fc57f1c031a911fa0d39b61e7d8918bfa531534b1fa689b6a1f4435f297a070c8b4a2f04ba51fbabfb59f32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ccfedc3f152578f3b86e2337c69ddc59

SHA1
0ee30d4a52a3b2deea81240d43211e57dac43f1c

SHA256
d7a5d7168008bf813217901492570d91a68d712441ce51574e72782e3ac75f36

SHA512
d70aaf0ac8aeea5899e28a12533a49732bdd6091c5c3957baf69d202a20ea153f096c0927b792b76a2f2c79b1e845eb37407f57642d6111a8d2d1bb7c4d44848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4046e4527fcd5ad2eaf286503fe70226

SHA1
41c409436d921cf0307bc1e8b4b88fdd15c60898

SHA256
22a221c32fcfb3b94af9f232dfd05e4b96f11ff8fb1874afbf046f015f4cc765

SHA512
4afeb9d54b41a384f4f44d3fa7bc64ba53614583c8a5401ceeed634fd6f21f75c7c7be6163d866228f70f4c65216cd07bfa0e0517d620ae28361d33f5ea1066e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
14e0b40171db41e6da57d2881b58308b

SHA1
49caba4f0352e1fcb7249419ed24c2e7a168781a

SHA256
d480159acb1a389021bc143a22505e0d04d02fda7653e03a4dfddaebd1bb1389

SHA512
de832743713800b131ee14b1a58964aeaeec15585ee6bc9aed67d9bf0c4506ceb45e868538c1fa3579b558c538804181c3babed6ab5c14624ce3e64b5a986ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F44.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2017.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit