b9068d4331f0e1b6efbead504ed1b60e17fd2da0931cf5676615367b7db941a6

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8898bec0300140e8017bffc22407dad4_JaffaCakes118.html
Size

26KB
MD5

8898bec0300140e8017bffc22407dad4
SHA1

dcfd2c1cb334d0134427fcfddab6dbb51b14fa37
SHA256

b9068d4331f0e1b6efbead504ed1b60e17fd2da0931cf5676615367b7db941a6
SHA512

bf4386787a7e7e7f6e1ea632cbdd55bbacec75870cc8c0e51d0642e35ed38ce6b4c6972099a181c4a768ccd53b8097da685bb67fee7a5098c76349db4dd1231a
SSDEEP

768:tNVPMSeO/sSjsw+R3N9SlnYq4g4BWhiETEs66CDKU:VPMdO/sSj+aln/bTEs66CDKU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81B5F471-1F9E-11EF-B904-5A22F41CCA2C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423356978"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2840	2236	iexplore.exe	28
PID 2236 wrote to memory of 2840	2236	iexplore.exe	28
PID 2236 wrote to memory of 2840	2236	iexplore.exe	28
PID 2236 wrote to memory of 2840	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8898bec0300140e8017bffc22407dad4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ec13ca488fe339f2a21df326eb71325

SHA1
202f6fa5c805e21ff57c42f70a3bde64def0478b

SHA256
9101c6df4e0e7ca454f778c78b9c65efc49f79b6436a16d9c00008be7a5877e8

SHA512
1e3b9fd9aff31f93012183cfc72ae1687a4eeb545cefc20c91b122ad86258e829e7a4dbd3d9a3d09c7ae0246e341eb1d35822bc214f59497734ad9472187a2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4998094d4e1afbb44317a64752094185

SHA1
8b1b951475d749cd56f69bf069100fffc2ab39f2

SHA256
afe2fc02449314455c3da90cc422f65a892d4098e60b5e12367ae5ea926310fc

SHA512
8873015ea3bdcf6b5094b1826c61110ee1a02724ce0f206ce24678661500ce6642a6161d37633e400bec2d46f9267d0b5e4094c743f6aa0df8530b946c523e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc43a7cf209ca70da381633cfd1c41b

SHA1
b6a8a7ed19a9f920dd1d051141cbf22d99ed750b

SHA256
d44b7e2af29fae91fcc2c9edbaa33ee7965f2a47e283f6cc28f71f1d7b00381b

SHA512
c02cff6a8939733f91924f12868e3ee839cb8a213a1fb9b0e1c48495150ec61ece07ee55e24c7e12581b864f5d357c844f25a9decef775b2eb480a2c1c51d5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475cdbecf9628fc2faa7d90d2b385cd5

SHA1
d392834cc6813cbdfa2dfeaf66e29fdf166c9382

SHA256
921f0780573dab2c584a5b8612850c019020775b09f8d1dff278b7329c4bc9e2

SHA512
0f69fd8fea24cf68561ec083531fba4946e1c1abef7ab0c74a66bc7860d96926025be991db399e7cf5a0e2cee14e80a2bca69b49ec81d2650826a462024a77d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1963b7bab640ae6570f48c21076fce3e

SHA1
7f3f174477cccec7cba909db492934420af9d515

SHA256
502bf7a96bdcf88a047cc76f107f36f4998c725d6ea3c5a8df42fcc82f6bb395

SHA512
a29acf1ccf19119411aeadbac2b265630cee1fe2530ff601118ae9eccc5935e85f3641c9b8e5000fc2ec7890c8c15256f5b250cbfc63a31bbb369ffdbb0b0b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f1f511464800c9e7bcd6378591fa144

SHA1
a946c69872101d8394d6baf9c07790391fc99b08

SHA256
9574eb0b90d505abc0d48d6599c5487a297b64f5271be87f883d94c4ed7c606c

SHA512
6b3d346bcebf6a34cc781aaa0c9b84a42d000cbb9bdd4a4e086805978e0481668c45785d7bbe8564db71b89c9e4efa0846818f2c18d7cb5c8f53014c729ea8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fee9f92e4ca1ece68a88a4115d1c0e90

SHA1
5fc2b8f9387d6da671b0ec02fb991b41c6192feb

SHA256
a4a7664496916bb96ea039dd6ef531911b3256f7cadd3aa3aa2b2abb884bc191

SHA512
115ee1c87cd26ef1189c65f58cbe4d1e994ba01d72e65a3f096e5171ff24193382134a7082bd897f78e181ba494278d9c5cdc45229b375de25a46392ebaf1fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c39212ff469dc4e7e34539b5576671d2

SHA1
238fe2ec727d07a1e9da9b573acab602e1d2a177

SHA256
3d2f2b7ace7680d2e16914acf58a70819b3bea999469a4b4d40342a70313203b

SHA512
a41c429aae88d30c851421e34cb5448c9f4f4726e51ab68b8f410bebc1bed4a51d797b61a1e719cb5fc48b9d3d82059b8fdab3ab011141ce9b1e407950b7debf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9303233486dd3733a576f2eeadf3b8f0

SHA1
ac0254f759b57e792aa88ffa368351dffb112db6

SHA256
575eabc6159749879b29d628ccf5c4c13414c6fff6a35f2ba221979dd0d89c20

SHA512
a65949f6f3c0e6c2f60720e66a4a88f5b3654698bb7aadd0fe10e9523cc1fbeeb8596d37ff880edd32d2c2820e83fabe5b4d23d7a5cbeccb31ff6cb8efc3478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC14.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit