6b8d9907bef3fd1b1bb5ec9d712e1237dcd0719a7090c48d604e4173b90ff4b1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

877c8d3c8292c94ba314575c706a166f_JaffaCakes118.html
Size

26KB
MD5

877c8d3c8292c94ba314575c706a166f
SHA1

bfd16e1595c13f0fdd63bf4beaaeab029cd3ce55
SHA256

6b8d9907bef3fd1b1bb5ec9d712e1237dcd0719a7090c48d604e4173b90ff4b1
SHA512

369bc3a3451fbed1fc811e53affb49c4fee105ec9d750bf6fc8110b098b91ada40ca71bbfaa3e596cc2d2b5c0f8759c4209e5d2336d17c924fffd1ee58e12d98
SSDEEP

192:uqbH3zb5nBSnQjxn5Q/8nQieXNn6nQOkEntIenQTbn9nQrCJVevo7NtCFo+NzQ4I:nvQ/yygcdh9aq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423331322"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4368C61-1F62-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28
PID 2120 wrote to memory of 2520	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\877c8d3c8292c94ba314575c706a166f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f1c0213d725a32ebe0faaff102fbcf4

SHA1
f8a4f848091036eaf54bd873fcec65c6948cf64b

SHA256
96355c0439015382bfbd9e5c30ea0e9e4e3bb85d067f4a2bd60a729d72b48994

SHA512
aaff42665290ecc3be058cf557a1c6e22d75ac137aea70f2ece538015def28437b92c396e55275dd88dddf43ceeb258c8385a485f295971953f972649e8ac0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4035ec49e47d67d66fe63eacefde88a4

SHA1
fc73e581b59d62e77bc80fd4f14c8238507cc788

SHA256
f5918503ac2af00d7867d289aeb1b76a45a6bd5c2f6cb1f863f4c31732ee211b

SHA512
1a7fe92abd26e68b4799ce31c8a25c78ca851b4bb15fd36ada0322f454ee8f2d2f45cf137e2ce3375f0e7cc5eaba60a57057fdb03b3741e4e22f16896eda25f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93605746df17bfb45ba46a962cd8ebd2

SHA1
2fe8cdffd2a74974e35ce9e04b655620e5e603db

SHA256
91db0eb7ff1955fb979921cad0a1c6f843b904a4017a7a111d2803f9c599ae28

SHA512
780c9faef6f2e867dddae23e48b23b690f058b444c88994a1041886fd662dc244c17e7132acf7fae61b9bb55c7b239caa973a1c8f344d99679d07528b4fe5042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4961ff0f4fc58b387c46d5304aee5e87

SHA1
9ef3861c0d8ba49254c72c2f74d6431ea7e06fa5

SHA256
52353e9dea2bbf63cd3841ca27ec570539dab55551a87aabd20da052e1720dac

SHA512
352aadc14f82ad568d472d10cd4613bd6b8f4e0b5bbbf80cd9df96576394fa945979bdca397cedf8f2c6369607be5d9e0b99929b52617f4c75a6575b4b7526f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20dc66c5f1f644d4822797d692f2028a

SHA1
178c4fbd30b80e437898ac28bfd8264970884184

SHA256
bc894814ddad8682a7442b230299ef29ceaf9d738c151fab9544d384b750a02f

SHA512
bd6c788a2b34bce6c457d17f9973d69c07f8e92e28c4fe0e8d9e3be09d816baa6414d3bef0574fc09eadda9a855dd7a50e2b7369c747e0d6ee629e0718803574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd7524da135dd5ac16e0dfe51526cd5

SHA1
c7b7a58e23b7dac32939e0eb0e04eedac79ba790

SHA256
2095d423f5c20b962164a432994a1bbce175c8688b869867eaa28e393a133dfb

SHA512
4c160fc2b571f73fd27b1e364d0f113570b89104d00a71baee79c6c434ad533cf23edf9594ae8d57999bc01c6d55a8ddc0bc06d1119044cba765747ffd1d2d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47fe836d7468a86bc80dc62c1f5a6d64

SHA1
95a67d49bd879dfb4780031525a6ae9d2716c2be

SHA256
3f8f49a4bde711b216c8b71a157b47f422a558eae9ac240dd5a812464b794bf6

SHA512
5d7162d74d147214836d23ea68f62e20cd6df955eebdce7bdd5c596f1a6527608ea40313a9487f4c2ecd8077db3b4033a253468c4e418c744b8f80c776f163c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca7c7e4c116e833fece3e7f4395d9162

SHA1
50659bc1111cae115faaed66adc5aeca7596fcf4

SHA256
8045bdbc756237a2121029b857056db4e319fdd76dbbeb311f9b4316f34a3168

SHA512
7010e1f81f0b34b51f668cbfe9860894a85181ba4c0642c6103ab44f6c870fbd73638057c08bc9e901b6f7f71b3976002a8112f1683e3303660bb095f3493623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6571084d2cc0f4c63f678bfd7cadc2a4

SHA1
723df45e2240260ea8766cfa5ff5b37759fc2456

SHA256
09df216a03a258d7805d88a0547d207827341c22768141b9ab6ccca7fbb63ba4

SHA512
575098fda0e99f0d73aeaa83ae5d54fa999a19e6af8ee734e4adda71786338a5179a10995d8780c2380840d1567e9dbcb33b4926aef8cb7b06309f5901a3ea05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad3aa6237e3b89f48cc52d9a201127e

SHA1
4436b48a91e86092faa5aa3ba4b83ae6c735ec6f

SHA256
dc0a8d74993f12c72ac92836e3789c0b61fa5c171dfb924062bae57c4efbecf9

SHA512
0a3a47729cd76addafef6c37c207947b7de75f7b3033624691e62f73c53145951898fe6a78c535fa095332052c9e6c96d9e21d69eb2ba727aec96e9f0f075e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6902.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A41.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit