be8b786579eceb49b62fbd8392bfb41c6c39feffb99e55874e98a9c40b555537

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8409e5172afd940a351aaa4a6d64905e_JaffaCakes118.html
Size

27KB
MD5

8409e5172afd940a351aaa4a6d64905e
SHA1

7c2068f4ed139eeddccdee75ae3a994a73358371
SHA256

be8b786579eceb49b62fbd8392bfb41c6c39feffb99e55874e98a9c40b555537
SHA512

10a89efc189e7fe71a399de267f3d7ec07cc5ee59dd0cc4dfcb0adf67d1d49a617faf4a94de9034ae3ee73252b3cae26dedeb5d525230002f99bd184a2c02892
SSDEEP

192:uwjsb5nSaDnQjxn5Q/FnQieANnTnQOkEntj3nQTbn5nQ9eeJam609UWQl7MBgqn9:qIQ/JDUSUhSKY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423229710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{300D9751-1E76-11EF-9486-4AD8236FB259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28
PID 2204 wrote to memory of 2488	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8409e5172afd940a351aaa4a6d64905e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
596f32a1d1f1d91910638bae922dfe4b

SHA1
9bf0e60d4e39fea9a92f0e1d4961bd464abc1863

SHA256
1674f7745098a1c42858166c31ab75ff291195d3f62aed069a6fb1d2244c82a3

SHA512
3442295b99dc0714067676cf5cbde6feb6569f1865fb4d4f99e9b6d087e34cebd94e4dee68cc112597719b48b042dfb91cc3379f877d0b6be38de6f2e164980b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f29816ca4111b67a60686c9e6027872

SHA1
6172d82911c184f7ed9907560fcc91399b3a4869

SHA256
c0a3a6c845ffd35041db3fd4cd09ea3c7708250c00952abe66bc34b21c8a6432

SHA512
510de96da8edc1e8334999cffff516dc09067d2e7e991b61c0ff0c9d760c4ea8d670e93b5ab13df6166b7d650b4b4d73c0a453c570a62929151339703b41a5b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e1feffebca0d0ad4be581a6ef0727a7

SHA1
fe73b9a4f6b3e374dbf23d319a2914ee9915b01b

SHA256
4fa2d32f222926fd1e1935f79e0ceb0e6a85eef129be86e49cad261e97c1bdba

SHA512
a721ad736fba3f6eb5f1511fc96aabbcc7fd06d2b5143c1856cec5f9d6d04513c1c4100b0e61d207a68343905e2188340fc104864000d8585c055607639cd1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0a012b546bd75f4bc270d0b8d542dee

SHA1
a8ffabf9fd928679ea9cbae23ecce3a2fcedf2d9

SHA256
9a15a9627f2b6b13de1cf6d345a3f2934f6eb37d1d8f60d15dfbbbaa105df93e

SHA512
3576558455ced960dc8c6bc84a3eefdb122a72cb7f67b6fde86c0af3c563a91de77904b728e8566cd6aefa932c0a5295302635320b564c9ce1d0587c05155ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3363f6252800effb1863b2b2fe3a841d

SHA1
c952fff998d976a07456a48f6edd156a52484935

SHA256
deeb89666a73f40efe28ac9f52f92149e9af00b2fc1b1e7358e3779a6b82911f

SHA512
f3fb5eedc594ae6b76e55fa574a7d4f237c20e1e645faa552dc24d560466e9f92947b746b0bedaedd4cc2b5a495c9c4e842ed6d3a6b1d32e26ebd479690683f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a69c4304b918b046f5a68d0953cda1fb

SHA1
6b12a0e5bf871b056ac9517e3feac35a56456d75

SHA256
6bc8feb43437f36b15466d9f36c6dc1bc28a823f827f670b5e33716a8804a445

SHA512
e0f9b6aab25346b10e8619691984badb77e6d3a00dbec6ff711c8270d2edc25aecdd00d1a62a8c94d86b08ef022668c3242bf8eca8bce45275c00586e26702d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a9e321952408a452d0fb1dba03a483a

SHA1
e78b65e77d3081c14ce1482435027a6d616dd290

SHA256
12864e44cea0429d2ecd397c9450761d6fb6db1186387ce97b459381f8efb71c

SHA512
6d30778edde6975fe1fb1a79bfbe132cd6da45310d11641c0e259aee8f37b67c6caf3a9b7e7a6815786cf5d4fcadb87095ffedcada815b04ef639a2665056cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb8a276a64b8d54cff7ab4b7e58a9294

SHA1
04aa1acb90b19c9f525b8e934cd731cd3051404f

SHA256
d6b81218b06c5fe71d8d6981e7dfae86d1f492fc7eae945c08d59884805abc27

SHA512
d249aa9692b1c196507a6e664db43427dae7fba18b66b65ae6704eebe40164a56580d5e7fb470de9a2f5e67ecb3a4232fd683b55f55880107d89b5136ab5a2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B7D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C21.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit