9f1702b096fd76aea422b0b68a00df564819412f6a330d32007c4f4b268e7eae

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8013da500a067ae8448b39fd13a6bce1_JaffaCakes118.html
Size

23KB
MD5

8013da500a067ae8448b39fd13a6bce1
SHA1

9c8aff023745ba75a22720c9a2db5393a76da3d4
SHA256

9f1702b096fd76aea422b0b68a00df564819412f6a330d32007c4f4b268e7eae
SHA512

a2745021f6c10734f817b341bb17c5009505b6349fc68217a2be40dab167971079f2045dc3f64fe86f3a7ed27a7145c739b30456b29fc4e5f518a31b34269340
SSDEEP

192:uWb8b5n7I1JCnQjxn5Q/vnQieeNnUnQOkEntNJnQTbn5nQECnQtUwMB+qnYnQ7tG:jrQ/es

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{346C97C1-1D94-11EF-A4EE-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423132652"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1444	1796	iexplore.exe	28
PID 1796 wrote to memory of 1444	1796	iexplore.exe	28
PID 1796 wrote to memory of 1444	1796	iexplore.exe	28
PID 1796 wrote to memory of 1444	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8013da500a067ae8448b39fd13a6bce1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
292a7cc8c6f5ca49a534e9272ae16458

SHA1
ec90c11f176e0f4ed0cab241197500a38945d170

SHA256
0fd6b67d5933a545d80bba0016796335a18fecd6fb5b7879d39bff71aa0633d6

SHA512
734f933209b43f2af2ccfd9d2f0ce9662c97f7210d466f4cb24924e87d29128f5e1cda9f97997a73bded2d0db8d0a93739339f117f7ed4dd97919fb1a8ea17ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a888b48e3ec6721aac1cb9f108106329

SHA1
067db050f5b7d73cea69ce0d3c5b397c9d9f4c6e

SHA256
d80adf8144715cc33cdf4f56c07aa96062b4d6037ad3a6c48ceeac2ea5f2a4af

SHA512
de02a21e5c9edd4a84c24f075068263aa402089f17a2706218926ea1979182698ab0f194de548ed4f062466a41843fd54942c04cd5e2bbe55abe1a1dfec34a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0fb96444f32e0d80fd21a29819ea603

SHA1
fc194af8861d6def2006731091f754316dd679e1

SHA256
cf61ad017b3247f35d2c9dc036b79db29ee95fe8ef8799cd5f6a1417483bd6b7

SHA512
c437eadec81cdb57c99133a5ee653687476114aa3d22ee52a3d174efa4399200bb4fd525e0741df4debcad5f240e7894644f9fa166ce0966d8db93bd0cea6865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03fb8c2d0618e0dd749fafaf7e1b24a0

SHA1
94d316838768b76d1c44ff7057f1acab2878e90b

SHA256
4e7af3f19b8a7a4ea0a5c48cd3def612bc9a11a44570c7282882a6438cc378bc

SHA512
bc1c15e3d8b12a007e9a82c00ee679ea5c2ddb8d8789f9252e58a46d8888cc93d4f72bd9037cd31cd76d34e91a651ac42eee9390732f008ead9dd4a18ef4e8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
587613c58df1e20f913358d1ef57d795

SHA1
16d23ef0b9c86322d3b753801e9ddfb2cb9fbc81

SHA256
57c4c59328064780e18ef19bf573dc0590b44808ffd18c659a24b952aa601440

SHA512
0066d771988b092dff6cc4ae9a71211a3abee1da7a7602001e7d2979cb9b26188f0f3a20288df15a2f1699571e6cbeff3d4919b7bda5652667f5ba8d7f159794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f55eeee0e470f5e5c6ec40131aee28

SHA1
1df2498a39e14173c23038de809d6a20be3b860e

SHA256
ca2a859ca64464c0f861f13c71349dad756a2d7a9ffe530cc0cde08bf4da9e69

SHA512
18bb7309ce06d4ef7b5708acc12337a686e2cf8da283c51a50dd2948f9fd669814a34ea89125e3d42a3e980fac2be85d6ed6ffacc3423c232587287fd74abbdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0186fb11bff34199725ad9ec5c2552d1

SHA1
c4cda2801fbb9bc83a0418967efaa9e7c7b6329a

SHA256
3be59b34a186cb4aa07387fbcf755ba18ca6d099f7e0de5d719f12f0cd992e6a

SHA512
4df8f2db483d092568822c3b58c1f59ec2326f05388d54b7efa7d1ded3e5968b854867f0badd48bb6822e4e4c278edf79ae9a9eec4deb73282fb41553038fb91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6804f7a99f54c3feb407295ff2ee61be

SHA1
e5fe8efe4226228fa09ae95f9c3dd98e240823da

SHA256
e94708055e79f0a6310f0a1ef30afabad0db29e018973e91f451ec841cb73271

SHA512
39024b409bf67760dbbd06f02d1be08ec9bc3fc45018cd0831b784be7df5c3fe03a4600b430f983382f6569836be4677872c3da35d7b67c0b09d7bf6f641fd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ef4c8efa63890086252214234e80d04

SHA1
69e0a072e962ea589935eb91576a8c479c47776a

SHA256
9bb9e2745ce92aa834bdf31e23d9d9e835ff792b4e9ed8f5895c0329dfacee39

SHA512
291fc4e566c90a4016b9a8338b7631cadb93ebaa4210b67cd55ad90b990234b4531e9312e59e9e40ec33840d343712270fc129a1ea64e4f6ec12e804fdd11b1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit