017b67abf7185e46101efba4a307edcc146c53dd6a0bcf2dfe4023f2770923fa

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8160cd795ac3f0596a5eb89bba6866a2_JaffaCakes118.html
Size

23KB
MD5

8160cd795ac3f0596a5eb89bba6866a2
SHA1

bd412b9c01549a88b64f32cea9ce050e139c035e
SHA256

017b67abf7185e46101efba4a307edcc146c53dd6a0bcf2dfe4023f2770923fa
SHA512

1369a9fd1a5ae673d01dffcdca1edf17af986a32bb277390d3ab69605ef731a9ddda43a296df04ded1dc0817f49a635dc8e169ec55a8db663be1d3961645d3e0
SSDEEP

192:uWzkb5nK1cmnQjxn5Q/MnQiefNnwnQOkEnt8WnQTbntnQ1CnQtfwMB/qnYnQ7tn5:OQ/Qq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F08E0E1-1DE4-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423167137"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8160cd795ac3f0596a5eb89bba6866a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf82e9fd5052909ebe26869a14f9b199

SHA1
0f5325001cef577a638b5c7b1313a481c82d92ee

SHA256
4d0f47c22db1608f86ce642fad347c52bdd53a2f73a361643a731865893d2ea2

SHA512
0a8901aaee668b883d19a23fc61adab0c97e5c1c4dae24ee6cf0c9d8eea233e9ff2cabe13a49c431fd78139160feda70e9e599fde80965a5d1d581093cf4ffcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
523b852fc3eaf59b2f25e3b55a1c3652

SHA1
5ede4c24b45b946f3d898246b4c6ef3d79f0a00f

SHA256
647e7e38cb00cda05d92d7a0d9ba532559a31e2d74a3e775c6ab39cbb7aa4d9a

SHA512
ac33496dfd0c1bf107aaf32ed968ac1ecfcbc92ab1154d7bff351acbbf359d0973f31e36dba13ea3c8910ce002781652aafff4e70f9800afdff98e733bf38658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54ee3bb35ba6366f84068792688e124a

SHA1
502428a33d4fe348cb6dfc4275062964171e9563

SHA256
90698bfa6faa003b4912c9923804a15d4f59bb1f05efb94018857f27f622e036

SHA512
ec85f070902482cd19e805a5c375e98a8a505a4a1d6f0b174665a1f7da714d0d504784be57758eebf5d1ee8bd5b245f247a16a5d5f776d7b3f1c86693a451076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d65fd04bc2ca9184620b3d04a878a945

SHA1
d5b3f8fc0aaa9814bf5f2888983e4f7dccf524c5

SHA256
f0e4c66478762605af04a52a1f449c1dba9cf7c22b852636f5db8fb91fc39d50

SHA512
5b822233e73acaf435987b8829061b1dbcc7cc817e944004b15c4cfec1815f00336b5d98ef71cdd73ed3b79fedbf77432d152bf4f96666e1daba0ffbb99095fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af9132c5224ff0c53cb9929842ea41bd

SHA1
6509b01e770456a630665b7c50675973615b261a

SHA256
979346c663e86ed3a1b8d8e51b3b4bb76d7bb308c20a693cd0d6039a42d0344c

SHA512
5950e3bb640f9a7a259b4bb080c0c1bbf10e0845c67f37f3d56bde20a3973d4fbd4e6a5a65e83c7400fff368a11d013d635152ddf1b029886cf5f4d15b1ea623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eca7ba584d9c0b55a725fa66111c5dbb

SHA1
3407d2d02ef409ac12756c085448d764d837d6f8

SHA256
fbf606868f2aae5c60dc9c97c5b0bc663aeff1a3d40dd205344c2a34ad131911

SHA512
9a0d23940147025ec75cb27073d4c48a179f442b1afccd4eab30085a8d199ad50784ae23a58cf9202420655ff2bd20dbf8168a11670e9e7bb7f33f7f14a38144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
737667df381550c79a451d2c0925f04d

SHA1
0e0c7c3336fc04f1e22fe3a2b699065b3c63f44c

SHA256
ed86ed6affe76e0355e43820398d5c95ae82df5df77ecb131a4bce35593369dd

SHA512
c0f64b9d88fb599a9917ce3b5f164c042d90874519123dd7c97f0fa969b3b0e52cf4c298532d3f96ae5cdd347178c29cad70932751ee65dd0c0260600ec0b0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82806aaf1d1b22ce94fd16d0999dba33

SHA1
4324e302399ce63fc38f97f97c533fe92b45b8e7

SHA256
19f14daade2f012af3f9bcdfa7a18a4dcb4e565d1ea6c3d2ecfbad3b91aeaecf

SHA512
e2ce5ffad3f77cb5bbc0356e81df5eaf933eb9a086d392bb4de54131cfe862e230cdd4bc755273d7e7e6b8660843ee166a4fe90b4e78e76fb8ab9c1389115830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e57c1efa21ddd039dca2dc31c6e7bfa7

SHA1
d5a86d4554a3044bb90c6a614949e1999606f411

SHA256
3298743d199d708b584160d8826225dd8ded01f2882e4ab5f6b3b2e755d7fd9b

SHA512
ec5becc964e607c35f48ae5edea9893286ba8a12fa8945de6637540760092f74aab6c0ce783f30da9611ac4e01bf50847a6191aff4778e486f0e6c2334982e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13E0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14E1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit