eec3ce381d0fc23fe7bd492a326134df4e38507473f4d86619c9dc1a4be69e83

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8776ee63cb0d0e1e60c8f8278f1173da_JaffaCakes118.html
Size

23KB
MD5

8776ee63cb0d0e1e60c8f8278f1173da
SHA1

878c0346423c315017ce53737fb51f3f518798f1
SHA256

eec3ce381d0fc23fe7bd492a326134df4e38507473f4d86619c9dc1a4be69e83
SHA512

7a8978f8875e32778db5809442eb8736ff7782758187b67e3eb1898c4d1c2144b1fb07ede5920c5a6bdfd7d95b8ddf0ba15cd034bac5ce4ad179cf93a174ca15
SSDEEP

192:uWLIb5nvEBwnQjxn5Q/fnQieONnNnQOkEntJdnQTbn9nQICnQtkwMBuqnYnQ7tng:bQ/tm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85699A51-1F61-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423330786"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2476	3008	iexplore.exe	28
PID 3008 wrote to memory of 2476	3008	iexplore.exe	28
PID 3008 wrote to memory of 2476	3008	iexplore.exe	28
PID 3008 wrote to memory of 2476	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8776ee63cb0d0e1e60c8f8278f1173da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ad6d90fcdb1160a83d8cbc7962c2cfc

SHA1
5d9176797678e8a0002f5ecb4befcd807ded41b7

SHA256
81a47575dbcd5c2da08be0eb96160c3e3883c10d3d30153c4a6a3e6e1072e8bc

SHA512
2c9e77684d88e7f0c8eea461b2aeab55f3dd45cb89d1c61ed69e2efa0760ef4bae7c986a93f7864536f774693e99a419d1af8b534c8efb73572253e4eca74c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bce2e557f92ac7e1fcfff79d8bffd4b

SHA1
a359b5ab10954a8ad57f5c6cffbfb67253ebcb01

SHA256
6967eec7681569441086949e1ce855e53dcd52e5a7a7062f19642392509d7844

SHA512
0c1d8379a54a0a1f984cc99ebfe4692e890ff0fe05c636d08c231b850925604973b79eecac9b68b30348d59d2bab8cfe5ea8005e2074652374d9b7e9f1ef975d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72bbcbba97037946d4603d5ee34bab94

SHA1
1a7412f283c8cdcc86f5993dd7c1915a26268c7c

SHA256
2ce6ca1cfda447ae6c019d43e3b578087e7c82cc8ef435e4a55f464e9ff6243e

SHA512
6c03975965b0906421e1dce253328592506b6622248cbe89f77a57a0c2b280a567b87937cbe28d21459ada4aa93588b71bd19abf8c9d8b88a02bbb855e79caae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6766c66a6072c1a3c86a5429513b173c

SHA1
24eb5f6017b9b542a97ad22a301a7555c9d82276

SHA256
2422697fa81970236b11ebe2e4cfe462ec0862ebcd280862903e2e150e60a212

SHA512
0369676dd61a9fd467c64122b371f2c9934cbf16390d8b414ceef1263ff235f882cc83343b8db0ae94db7af13ac203a8ef4e4780af098f1990c9ee04937d3908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c634ab199b162a7a6dec4b349d523a0f

SHA1
fd6076fa7b5a96fffeeffd962c197ae09d80d66c

SHA256
9d9a6a9ee8597c2c03f080f011320970d1bf9e773cc4c039dd98fa2fa6b72cc7

SHA512
9e78a3b64ab7e1e92858a1fc153b76dc4668d1630b72a1d86ae3a79decd1dc0abecd8fb752f86dbaf6f463e1fc123f45d8916a6d28cd02a8b0d7a0cf851651b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb3529a0374070a540971a372e7e738e

SHA1
492eff7e79d47bed9af50e15d413f0ef08d4232b

SHA256
4fe0467b3f8bb2b82742297290197d29bfe3835393e97e1755f90d4a81444717

SHA512
e935f99ecd5fdd3ca9042a3e2494590db2d05a31548d4c50436f3b0c91c3822cc6441f657e949605403fadd07410aa110c2eee1efd1a0f42f7b8858b871fb29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba6311f3f7a4c5bd42b2aff3d22863e

SHA1
5ff1e8ca2f3aa5dc8c66e3444f9d87a65202280c

SHA256
233ad975ae34b4a64bc6b3479468e3eff7ad81080ccbf6b6a7fa42fc023d8c62

SHA512
2efc626c1201a3fe4c2064f55a8de8328f610768f1f986f4e9eba87b79be6cd188c131c200c6125b616bb563a0002e607a5aa75a206d04559238944f7fc970a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34ce8eeb1a0beb519c977e18eef037f

SHA1
c0ad19b1b46bfb44b0602984e8ae7a4a59e3a423

SHA256
048e0f7657c101d2bc808301a857a8b4d7442d0dadec3a47beac43b9f2d722ef

SHA512
8543c9946b88f56b873069d80e621a1963912252201e08090e9b299d3809e5f00988ffda8678bf328af0c1434cc3b0efb4b8a7b7956ff77640a52e616d715188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fea48337e812d0b6fb176477964ac038

SHA1
516f914f0dc30541a643dc156c40298828edcd3a

SHA256
ee563d9b92ee4d2f292ae9e1186cd08fa05a5875b251d95dbd585f1f3c682c1e

SHA512
931763c34fc9b905efabb28e745b6583e0cc930b328eff0d602d4b2e55b190e007638ed3637ee33851d500b9a3a7bd7e40cc9e6264ef01c0491effb77bffc365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit