26ad27670ce111d8e58c6cd077d55339855e5c59a441b7a7cf30376e13c122bc

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bdb2a38a26548991d0512765cda79df_JaffaCakes118.html
Size

27KB
MD5

8bdb2a38a26548991d0512765cda79df
SHA1

fd42d8866533dc47825f31b658764a2a163f7d92
SHA256

26ad27670ce111d8e58c6cd077d55339855e5c59a441b7a7cf30376e13c122bc
SHA512

fdadef8b7eb34544d8a0f9a7dbcc1c5ef2f326792044935d335369b4147232b4481592e3e0f3aed1441fda5fc26123f7fdb6d0c7cbd9af5c4c955256b3121552
SSDEEP

192:uwXsb5nV0JnQjxn5Q/4nQiejNntnQOkEntcSnQTbn9nQ9evPm60nB/Ql7MBDqnY+:d6Q/9Cx4B+SJCz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423439439"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E5E4281-205E-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 3004	1704	iexplore.exe	28
PID 1704 wrote to memory of 3004	1704	iexplore.exe	28
PID 1704 wrote to memory of 3004	1704	iexplore.exe	28
PID 1704 wrote to memory of 3004	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bdb2a38a26548991d0512765cda79df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d347c3c8d92b34881cdc80ac50df97c4

SHA1
4762dc22aafdb661ab1d04949b060bc5d68f5341

SHA256
287a9810c4cd3320cb075c680c666261585bcbb66acc3aa89266d0cdfa7e04d9

SHA512
9e6aca09c61fc9fd6cbd20e3f4f6d1538611776c6f083df5fd769e7e8afefd25bffd83105dcc7502dfdd5258c58b93778dc91c03b05f21cb3bef5bb351a92896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec070934e46200aba1f9fc2851f1db98

SHA1
73e24cfddd197df43b8d5118df6c10d558b8e2ef

SHA256
fb044e21ccbb730a2cd894a880a902ebe2dae65da1166770d915154ba7b8fd79

SHA512
52f3d9ab59bb8fd60863d36ee759ef3c3e363e8c1efa776b72af5eda92fc886d767eb64bd70a9ae015bf46dfa2d38e77c473baab86a1ccf033ddcb1dbe7bccc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b779181d9029554b00eea26262ec4065

SHA1
97bbe3af3c4b366e92e666bfb1c537191bd3326f

SHA256
b15f89f8b60a4bf284dc12d8e707bfcd6a1017e4c550fe1fcd1e7b0ff9ffcee5

SHA512
80ffd22fef8f0010aaa388c5bee7751391f749359ff636133e6025fc9a2c3a801d6cc1e55a2eaed76927dc053deca822ee7363ed0756e5d79571861acdf9542e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1183f0dc855802db6b200385ca178a9

SHA1
b549f044ffb6e5f85d5cff93e8d0a32588456e7b

SHA256
157ea6a7caa478b7cfff4283cc71f22a4b7e57306f6d6a276d0eb500a336ef9a

SHA512
a72e69aa09478de9a7c00f0bca3989eb5e1022fc0ed59c34ca68869aecf6325809ed275cb7c606a83fbe8db2ff4b048be2f0e890d41a50e901c9941bad37e0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302c8edc64e61e071263b30da5a4e060

SHA1
cb28ba7c019f706dbeb9d1b5eae1eb930ecebc27

SHA256
5fd3223b55f1944d8967517fd8b94bc174442f3a587642fd1a49e0df183a8a42

SHA512
02c22acecd810071d211ab8d2da060a7433d38a5b611e63d1fc4cf91ae72c13ca56c18cd682fd96349d45074dfb1dd8aac4bdc708a41504e6b2c7a406bc2b204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bca54c25074bebad4f997ab9ae16911

SHA1
a3ae7a40ad582a7d37a268a90becc49fdf4dbc46

SHA256
93d4c6a2fe5c15bf5fb9207674b3345034425f8595d19918f30c107099e3d541

SHA512
310c39b81ea07fc63ee501c9050768790f66e2ab79bbbb704d48e29f849088b361840dae311e11d3c648072b7464da9177528ec73952b07868b98461c9b81e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae63bddab07cfa0b1cefddb3bd54b0ef

SHA1
befd1a7cf63d1988b21ef5ba271fce254ebcd05d

SHA256
b9c090ccb84edb03c6bdbaee1181ad7ff44822d2451d840c8533151719a9de25

SHA512
0b994430cf1e50e11e31204e09eadcc0bd3d18070117f7fd424773bf55ac35b341ff1a5fed0b4e1a349254d2efe07bf8161e5089afc467301642e927ed853916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3c559ede08da4743c6492c1a6bfd559

SHA1
5cbebe8760a1d05390904b584aa778a005a28fc8

SHA256
e6cd2f7cb6869ae9a00b746184513c23afd962dd7bb27f442a0ef83e36627dfa

SHA512
21df15ab97742e142ec584a409ae00464667b106828c66bd883898459897b35ba707594b0821d4d46abe35ea253f8c5f9c52d9e6b8a61a0951fbc32140f781b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0fad2e67a535b1e25207332a1796306

SHA1
a8654bc84d6da9c59a3f4defc065b979684bbe28

SHA256
67c4d28e6a701559dd17d4c118f16b86030550b230690d0c75844c5be913a7bd

SHA512
c3b0f5f7526af95b0640338d005961fa1dfcd2a7d42e4a1ed25c1240cd5b6504eb5f2e9984eaccacd1c82611d9c1464c15169f8006ff0dfe390520720ce951e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E2C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8EFB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F2E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit