1d84710e45a2f4a3bc5c7c6c81298264742fcd41114864d7fc6a8779c5d4f54c

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8456099f0a9596e9cb4326538715144c_JaffaCakes118.html
Size

23KB
MD5

8456099f0a9596e9cb4326538715144c
SHA1

4a8aebd1a732f96f21096730b060946b8be275b6
SHA256

1d84710e45a2f4a3bc5c7c6c81298264742fcd41114864d7fc6a8779c5d4f54c
SHA512

a6aca6b4eab067c43931f8950add6039af3ab71dcc03537a49215e3387d2d0c0bb1f9f11d6abd2197a5e0ed5d24f8f6f09b96613ee06e96ae635a60eb981d61e
SSDEEP

192:uwvEb5nWZwynQjxn5Q/YnQieLNnjcnQOkEnt4OnQTbnJnQKdjDvMBrqnYnQ7tns5:SQ/RfYR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C46CFF1-1E89-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423238053"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8456099f0a9596e9cb4326538715144c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3045e3d2ec718d10d08979876d774325

SHA1
738c2aa0ca6a254067304d065fbef9d8a19cbfd1

SHA256
1a346d10b06857f7efe422627b92061a78dade68f4c3152b4bc47e01bcdbfebd

SHA512
9ca23ed7ed07a855b15192e717eebe520cb7977b1ea6bb4b7d92a603f80a2fab781a52b41430799537830908061aef39d02a39107219f47ae1319f4b59d103db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8143a350c8933294684cb5a70916538a

SHA1
2f0a40baf635bfe1bf2ab347cc13d658d9590833

SHA256
67716849dca67ec8b730b81329508d942ec58be250a0188cc67bd9382f1bba45

SHA512
bc84d9c4719932b1e6448aa2dbcf00a46110de0996564f27bc0ad6aefeac3e294af874d54e43f6e575468efecdb2bde6a66c169680f65389aff6f23d8633790f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6cdf27394bd82fe446977ca4a2b1aa8

SHA1
7e9e78eda091d829bece85b58c84b1e4faae24fe

SHA256
f1d0b011cf0489ef889c1897b04886cacc146bcc5beb66f9abcb34620e68739f

SHA512
916b470ed385abb95a4758c146208c3d8d3fa1273d073b19a816b72262d144eaaf011932d6fd3b0fff14985c96eeb0dd59d8e3cdcf1704e31ebd6a034d1e5ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b6ff2f36679fd9ad56e6c794e0e551

SHA1
9d5b550bc0c4deb0527f40f9d2386feb48f6424d

SHA256
2403d34107a60d2b422ace6c51f6b711dc5544ebde71a54ee46d402dde48050c

SHA512
7c365d6c66b4aac4eb43ae1439d5b0d7d6994c84b7427b7e10e98938e4fbc531d19915b82106add22c0eb098a81351434260018621c351f14b48483eb457b3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f7401a1d751c353dde2a21e54355689

SHA1
ef157df4956fab5133264ff3d07245fc1200b1a3

SHA256
a7b845837bd5de78ba87a49640e850b23629b441cdacc4e1264265b10da6185a

SHA512
a368c7207841dd6eba6d5887e0f1c080603d8927ce4725360fdfcea304df9238bf5cb828b819af03e0478ff8fdf4c482b7d352e8863621443b2fe34ecb14080d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c31a31badae0fc026eb79a00ad059ff

SHA1
90fbbf97e028f151a8a1393015fcc51a88563b3e

SHA256
09385fa26cf723dfef195f1a97c3b9fbf0a0f43a8541eaf0b9a30c86d6114757

SHA512
59c2450104b5aa4a7d7295fccb75715b746bfe59d994653aada6f65ab2d4701d407801a1a704ef3a9c961d257cf5da15def36bb7d541c560a4ce6d76b2b8271b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ff4412c650eba5309f25a6d3a12bb0

SHA1
bcf1757aef6c2f0c860803025a1a7a1f95f2bf3e

SHA256
ec3d87ef7b139c191b77663bc8a54939d337f54b2ec05fc8d678baa2121aa5d7

SHA512
47bdf2a544c760ca14311b52f7921020a655b54308ee874f558b3b38f4bf2467aa0f56aff98ca1d3f3b3705de8b469c7597d3b926808e2bc5824cb075a24d0d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0529ef21d5af76f7d84555b4efb22e62

SHA1
901c8319a6f1ca278490234eccc74c2aedbabc0c

SHA256
38cb7ab0332f5e87f512168e1ff4e7cc2ea5cf6992aa76df16d9dccbe516a8a3

SHA512
ffa51f57bb20214de842f78a265bf965430a391fe41d0c5e42505354c6ec3492459d96ac063695e3ab0ae047ec6d4368f978ceac89b81c605a9bf8148b49be9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ac828c2c961a237c6b826961b54d954

SHA1
0715dd5c3dc0f86c9225c73e019ac94ab9b23715

SHA256
ed8b97303e5b58ce352edfe0cc2ab68b8425ecb474ffbf77a26242cb86bd21c6

SHA512
6070c561b5a7fbb478b5e35d929f6180a2ff7e134cad56ee56444f6df048ef55f4cc5eed9344d3cf0b131ea1900a541fc408a08885f67d15919f03d06edc6128

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB76.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC54.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit