9ec409bf7cd220e792859453af56c91f6a7e20d005a678cc138c6d5dcf771aff

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8173ee2bd73bca88607d602a28940cfa_JaffaCakes118.html
Size

18KB
MD5

8173ee2bd73bca88607d602a28940cfa
SHA1

15bacce909091d936192d5585cf252bff8fe0548
SHA256

9ec409bf7cd220e792859453af56c91f6a7e20d005a678cc138c6d5dcf771aff
SHA512

bdf101b838ea7f8af8628aee98bad37c899c6c75b9b0e454ac4d6b542bd2e99fdc6df776841611cbdff497371fe880f789b94d70cc4cb4733ab9ee835d161cdf
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAII40zUnjBh8m82qDB8:SIMd0I5nvHZsv8lxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423168894"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95BECB71-1DE8-11EF-9667-569FD5A164C1} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2932	2772	iexplore.exe	28
PID 2772 wrote to memory of 2932	2772	iexplore.exe	28
PID 2772 wrote to memory of 2932	2772	iexplore.exe	28
PID 2772 wrote to memory of 2932	2772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8173ee2bd73bca88607d602a28940cfa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e39bef8eada068211a1e66c04ce841cb

SHA1
55c0aa94bf67462423a35124486d1cb9bf74754a

SHA256
b58a6091f09997d58850d75ea5face12f0f105b7ea004c3db27476592fa08e3f

SHA512
c4d58c29e89b18efc3da6a4111cf17af070322274625aed98e912477303c830f6bbb1cdbb16588dd7a48e022bb119a12c5b1e2df71943d8645e79a57b5beb02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7799f69ea48ae100c10518005f6de298

SHA1
84c99d0e4cfadf2831db7648eaa62d643c421e0e

SHA256
e59559f98fc778fd3daf830024c133e1d1c4ad22b1a75c98871070ef5572a181

SHA512
881fb416743e971ee36f0352158e97407e42e57417566ddfdacabe24480539a4bedee365b7494ed96e13249117d21222c88ec0f31f566c6ee096ad8044e2da18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b26fcac57a1170d9445f6d7ba93aaa4

SHA1
ab7007bb38aa8f2d524e5804f15cfb5e3fcbdb97

SHA256
b078cb5e81f52ef7996a311d6b6c4f71b3ff63281a248234625ce369715dcab9

SHA512
fc3824bb65ccc8dfc8789a90fcc044cf005567601f59757b4181aff7ac7d9adad8647c780fa1a5b20ebf299a7a176166025682fb5b178b2cad68552be9ff667c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
236f02045aa430ef515592ccb5e87963

SHA1
3a5637fbb8a1c1efa003cf9d1b3e3906aa576491

SHA256
c6e8becf135cbfa41152a09d50bb0809e51fc44fc778b9ef1321f289c1605373

SHA512
d29f34f40488e0d967d996860e1f8616cf83eb8fb3b733716e1900b65f6ea397b6fe680d07763f19ba776ba34e6f46cb49c1fbabe85e90322a59a448a63e7a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e01cc3d4ef6fd5e206255aa6d5a594

SHA1
50ad3c4682cbd9c865232bc36c0026448fbd270b

SHA256
42347ff49a82cc83b447dc0778ff6982eb00ce58127a5b65a629332120f1d2ae

SHA512
df627b6a461fae2a1759ab0182351c81b912957a303f83a14f4b6b6b9588e30081227792d55afd7d09db9ee02b35d8ceeb239ef58c615c51e93f263e9adf7155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fa30bb75e000774466713ae7cd11a4a

SHA1
f41fac775175c944df05523d091505e9e1f42561

SHA256
6c7481f6993d0c3dfed1535446dd23dae015db7820eb415e53b815f95d9c076f

SHA512
7379004cf6673a3d7ab5236b76cce07481e69fce00124e33b85de0fb83162f0f3a8783c1e4fca3520a2ae0fc8242559786796e166f31fef77d239b2764b87869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec359d03927acad464c9e3ad8287bb8

SHA1
d92a942e4bd02c7775200df865d02048dfdb41f0

SHA256
16d572008e940e2df87b1e8a0434c7e68fcef3e5c3ab5913c17a0a67085c0ef3

SHA512
7f3d8602f1ce4740537b6099ad98b5a21ea18020b1c5bbd33ba44bf3627108c9f27d1dd7a323bf3009052d2ec76627d283beaa5ab9503fa04d03c667ccbd7a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afc114d6c03708b9c1598353557786d5

SHA1
fe75087b2f64d621e756cf62979f5ae3627cee32

SHA256
1db3270bb197d272b90bd3ba311ba8eb424a06b89953a93b019a5df5d2efc140

SHA512
d92155c0fe8a3af7ebb4def11a3f418c4fe628092f74b6f829fa16a6685a8791a812cf97edd9de0a5f2cb5aa808ed75edeaaad43a8fa688c4216e05b7e5b3f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
442cb749e227eea1619da161617f0de7

SHA1
3a88fbf7a9c8f02791b557d0e40000246da4b00d

SHA256
2324a50ecd5fb1626bbb7b7045fa5068cb267082b584e2bff2a2aeb1b316362b

SHA512
5a92e46264fc5adc08eca160d2658e23ab822b1042dc6d7cb37c22949c16ddf14a5fea7cf37e41ed7b8f7b7466697745f6668060fa4d78052552f36298b7f599

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E16.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit