b1497b1118f5eeaa218168f81a10717ea8936c6e9cc044341dfea12577baf798

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8789611abc4b63b53dd8c84afdcf8a10_JaffaCakes118.html
Size

150KB
MD5

8789611abc4b63b53dd8c84afdcf8a10
SHA1

11af709fa11a34caa8f86aa1ee108396b9ae5145
SHA256

b1497b1118f5eeaa218168f81a10717ea8936c6e9cc044341dfea12577baf798
SHA512

2fa29dc387aceb5ec6d363757d5f36b1ebb1abeba86285e4b25397746d1d2a1ab9c716c6a2031a0db0c0fceaed364305f941c3483c37b7b515891ad158d125b8
SSDEEP

3072:acMsdMohCq0OpxZ1zjk/pVyfkMY+BES09JXAnyrZalI+YQ:aJs9sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E1B61B1-1F65-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423332413"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28
PID 2300 wrote to memory of 2520	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8789611abc4b63b53dd8c84afdcf8a10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
58a66ba7c0f2abd69ce7ee1efae9c3a4

SHA1
46924bb9405a5ea00f4d99c50b606f1db31973fd

SHA256
8d39f53888ef567f5b6c03a13082cb2e27098a12812e7e926ea86ec5ce59058d

SHA512
0f47ef43f5162d258ac096c197b0b3a7867aefec0e899ad12cf14af094bdda8d247eb9c13e281b9ff605c890c37898b66a5b22534674ac7058252cd1cc6db6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e37483d0f1327f8103a89a437994016d

SHA1
621da85b827c438766995416a3ccc733bef26996

SHA256
5d22ad588cbe30899af21c5ad6b65e740b1d674c86f910e4a4a42f7fae3cae51

SHA512
a788ca14ab4e1da3f57bf69c7df5ad5777502c1f78b68bcae1c2622e9c14b266f9b5bc72e2e7df04a0402597707d4f5d79170825c1e6a76dce262cf25137568c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c55fd6a47910771a5471d3e5c8608713

SHA1
169eda31b4a83b29089a889ac3c524b25a2fc1d3

SHA256
29eec8d703674541c8dd26d7223f5ae2f983000aaee0f69dd306c00fcfb95e65

SHA512
50350d33e79f79e4cd83084f2b4827125a7b41e53985c45130f6b33206626f5763bdde184237a13e19cc08d043d86e071f66a2c7ff8c3715c10d6dfa2d143aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862f0125af539addf6211305aafc9725

SHA1
22230826fa03c7b5012d6d0efda123e07901605a

SHA256
3edabee54c74ec6d8b231038c194182b11b0d749d7588830a6d8f06becbf07c2

SHA512
94c99710bb69c024e0e919c0ce3f10d470bae3aadff9ef4df32e4553dd5ba8e61aed3af52f88515b1bb90d820507ac85dcd8554414cac9f41cfd7c9453c05b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4cabcb2a4b9391fc783af79e657bf04

SHA1
d0ac64c275a493412fd083e037d62b001cf34d01

SHA256
d06aadf2981499a75f187f2d3db0f4c77a0fd5235a4d7eb5c1177c5a46f6afda

SHA512
a8555f14d91c872c14613f26c6ac540847f696c1cfc2eed304e633edb11b4af69c0cca8a07b59600e0ef9d96e73cc0c69027267ef1be1102123263328d30c1c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c075c9177ab1b51eaccac108c138e65

SHA1
19b2c9e621d44608d629becfafd46971255b7380

SHA256
eef6195e6d3d2be5d245e736b9f7fe8ed81b8fe027a2e7bcbf7c62189507d6d9

SHA512
acce194a3534a74e7d064e72fa32932c020a091b75d12b7c2675aa1555e47b774c086f54e0b2a6a52712fcc7d10954a2de6eac8fe682f20c5b8cad951b0c5899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa2b28b7ec7a3e4700f0559d9821d03

SHA1
6ec0bb61a33cd5927827b1a04e3eb74be2e23090

SHA256
7873e989064d389518b799a9d1a9f906f9110817f79f8bcc0fda4be257bbefce

SHA512
7f352668e353e71322616506210feec1ef7870eef5b40e43ebe200def2e4092f5c12d11bb6a3b52f03c2e059db3d370da5ce446a41210fd10cefa786c824cd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31d3a76efa98d3929a13ededf5c4e513

SHA1
d6912069105d3382ec4ee0e1308d70dd7f1ca8f3

SHA256
e7cc561b8dc4efd49056fdb34196da99ca16ab33db5c1a33f0d9c55f94757b9f

SHA512
961d3edf0ced74667d3f9d55ff9c45306218f138254c363c57116aab9c7ebea0fcfa4f18cc1a7e41d30aab2c70d1027b307c401570e9904519983360f82edb36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f19faf99401c16fdd5f6b7cfbbfd3de

SHA1
52992f26cb4322a09e016e5c76d49e94b75be991

SHA256
3df1e6ebfa420a16c241ab23183f3d80cbb34214798a90c2fd5a3ab05e41a5c2

SHA512
3e6bad8555555f13e4dce24efad77c554a6241b6ca7c0d56ad83d43f0d4f51f25f197061ff93954a4c50e0a0b3f17be091286495ce96080d8f4a6b17c56e0ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67ccffb48152a89cfea615efb351b32

SHA1
9077de04cab824a1f04b189a262ea373310d538b

SHA256
e5a12203c52f293102692a421477456899c03201474148a7094120d2ee4e93d9

SHA512
11a2a46071c50e06382f764c3152a29aaa7a59bc7b6c432a59fbbaccef71f0301de0ca92d0b3d9e3ae2ddea99194cb7c65acdba5bceae53d46293148a16a43e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee8f345cd34e07b62d6158cc94742f50

SHA1
73fe4c68b7ce1bee48d3bff2f78603707bfaf01c

SHA256
1fab6e155439609ec42141687860e2fd5be28c06453a32905d0c5c13e209afc7

SHA512
a1d12873fdb7642ceb90130f9e333f03e998c2235d9370dfdf9fd33d53c7a6ad988c2b61ac4e76fcd08825b45d580aa9ff5e4b0951041a8c75defea4f29342b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
869ec0fd958316ade04aa9535028c164

SHA1
977e6ea77edb80a17c10bfef3f934334993882c2

SHA256
88c75b665f149e2dc0baf49a22ad763a01bc985eb27e0b72eda6c9856d7fddb2

SHA512
3a1d2294060479c1d2c93a5e8276805a88b8f2a66f7e0249f8245df2e6690d293b7739a0a85f825f199b3105db9f5f17f0a22a283cecdf06da7052c12844f1b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab901F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9032.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar920E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit