8fbb8705f34206c851c324936f60dced42f6abfca2070f7dafb01f46de3e1c0d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8459d4f592909557dc8eca3b2931adb2_JaffaCakes118.html
Size

18KB
MD5

8459d4f592909557dc8eca3b2931adb2
SHA1

df93445f55661b5d8fa78fe7fb74814819386181
SHA256

8fbb8705f34206c851c324936f60dced42f6abfca2070f7dafb01f46de3e1c0d
SHA512

e559b9acf204f3669ba127afdd633d7a2edf0ccc2952d1ce2a547e157d657440a6580a6da0ed43813c85b13dcc6d6d5bc40dde21d08dc198cb80bffb9f95827c
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI34HzUnjBhJz82qDB8:SIMd0I5nO9H5svJoxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423238352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E854E31-1E8A-11EF-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2624	1288	iexplore.exe	28
PID 1288 wrote to memory of 2624	1288	iexplore.exe	28
PID 1288 wrote to memory of 2624	1288	iexplore.exe	28
PID 1288 wrote to memory of 2624	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8459d4f592909557dc8eca3b2931adb2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf9a5d0c15e747cbb588f6af5b1dc10

SHA1
5186c082ad279c65c07b0d4e04f7a6dc835b1b24

SHA256
5568d81d7904c7a479209c83f0c2d421789a29bafcef1a096c45a07241c7ac4f

SHA512
9cd9dac84d2e445a75fd4044498308ef282e09b08f791ed54edb8802e289c2b62caeb0dd5105356e3e57a16f9d899e4999587974dab71ede067ddfd61f278a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d20ec6b98ce038fc35fd8caf7e5289

SHA1
d93008ef394753445044cbc6fde0fbc8cbcd0f8f

SHA256
3200c2f9a0e89057e0b5afdf8d35b19cf1f3ef9d837e95aa7f879bf813386bcd

SHA512
5c9cb773800ac9112ba968982cb6db5b94ac2aa8dc282fddbb74940ded707597de1c0294bf729197b32315e149f18067048931092e22e325b8caa54922dc2303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f27df210f907d217fcee5b160f3fb03

SHA1
18ddb1394b7b4c4920b01a9a612d9b5c3419962d

SHA256
9bfc136b2b6cf2278ab1c2c183a6838ec65c6ab147e4d36317fff46fbce7da5f

SHA512
468677a0478408b58d3d76cfa102a7c452fd4b28f0a17d31dc6a8b669883b7db57f3f478943ae509ea4fc346c4bd13dbad2d968cfa19d68320fb560bc0cb60c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df6f4a42f42aa961a88f5312dc3670d

SHA1
7ada93f4e353060cfd720050881189d9698bf2c1

SHA256
d26d1961b9e56ca2c28caa196da3e4df966e1b0b1f52983ed125f4b8799b3842

SHA512
9b75fc3a6567e6c58542b0b60b67724322d065e24519e5d9e208f4806e50130be54776c753284eb18f447428ee495b2a8e8c0fac476f277d294315bc1733da10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ef55b5b83091b9da443afc55c2d067

SHA1
e512ec9f0a6bf1efe87155715e05c437a0be68bb

SHA256
f49a0062868cad426dd6cb28f0c1239b2ef4f94b90feebbbdfc738c71535cd78

SHA512
91e7ac0d16fc15d097b8654927218dfdceb9df3db8be45c412f4498aae19a338d0373fe73040d040a4fc05ecd2e225aa2b9019cb84a2e5ca545a2640e5da6f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
275effba19a0fdf6682115f1fb6e723d

SHA1
c42843289bc155eedf08e2d0cdb485904f3ca31a

SHA256
8d4a7cc40f8f17cce93c1dd0491dec5d5c2040bfd84715f8b3bb8882d660c276

SHA512
20d8e8265f56be00c7b312fade7fc540ea0d504c69786b739fce7a94f55148392ecfc497f11b3d9ff61212353e9551869f7c74b8b270ae3928748de31fe43cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fbeef064ec9a9ed5870e88436fc9678

SHA1
62b90ef51fcb580d8d725c08cf8b2e7dd4927775

SHA256
3a9c9127bebf5cca8fd08ad4eef85df189ece5768fd300081bb271596325068d

SHA512
592623da94153f40bef75aaebcb77d87992dac81f3b82ad530a0972a67637883fb4aec0e7fe1bd4e3ccd21257be0d3752251d2ba13c12d231c034941b87eb099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb6706079f59906c512bca29fdded6a

SHA1
2ef9e1d284e6e156f1062da830144b5a00f123ff

SHA256
c049239a3aa72817cf0f95c60e19128f2f20f7b67f1cea75ce5b7e07e66594fb

SHA512
1a26ddcab6d0d1b561323a12b86e31722a95b7cb20932df95697f8ba3b597c25a50f2d700e3fd1c05000dd7a20445e0c184c72176458d99d8dc2a94a330fb1e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit