6f49b3729b641bb3b6d51cba08173b1e11e2d0ff42b4b1263f73d8fcc4497ae0

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bde90b068da0687422ce1a80a26f231_JaffaCakes118.html
Size

30KB
MD5

8bde90b068da0687422ce1a80a26f231
SHA1

8b45e47ec8dfb21726115c822b20fa0d68779b90
SHA256

6f49b3729b641bb3b6d51cba08173b1e11e2d0ff42b4b1263f73d8fcc4497ae0
SHA512

6904f9396b96e52b4adca646d13c8e6a39f9d19753adea5383d25ce56315ae5565203d77c9ce7977b9f8e5421cf769b137d91a7dd7f01866a901f7da73965491
SSDEEP

192:uW/Eb5nj/nQjxn5Q/qnQiehNn+nQOkEntqgnQTbnxnQeMC/AaDn253gbiYxYJ/dJ:nQ/V9YQ9xYpyQ3ZbDbOw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423439787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F1EB081-205F-11EF-9CE2-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2284	2488	iexplore.exe	28
PID 2488 wrote to memory of 2284	2488	iexplore.exe	28
PID 2488 wrote to memory of 2284	2488	iexplore.exe	28
PID 2488 wrote to memory of 2284	2488	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bde90b068da0687422ce1a80a26f231_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cee8d09125a5e7645d133e074ab348a2

SHA1
566a9daf1afacab3ec0c750d46ad5d8f70c9e038

SHA256
5a32480c8b49601912f0f8188e0c5ec4773cd92f7b1b83829dda2eb7332264d4

SHA512
2816c370805446aaa9e273a5b2dbb6808514bf91cd589ebac71f5a0ae2e5b4f8c241d55ab16bf62c0c68100b04ffdc0223b884a9c6b297f5dd0fe6ca3275cee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e062777478893745c512e482969bf675

SHA1
d886c3015ba15b932649af359b72e0b908a9f4b1

SHA256
22492e51b26677e6e6d23b4e60fdbfda803bc59e3242bfcc75dc0895be6134e3

SHA512
cc9b75d94c8f7f59765fcb5444cc64252c914d7b0b8cfb1499af21281cb7ea1606d8d796aeb4244a5ed007ef4fc597f726ed9848e7b8261b34f5bab404890a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ae63d2ed2b63b345e026c5a1eab9b9

SHA1
32609cc96c50e005e32b4dd901e999142aacdafc

SHA256
8f7d571a340f31fab360c22bb6e4ca997ae1cb0eb9e1c20bcb14f10022fa01f9

SHA512
adf821c9867a04b2bf7773c4e068d3dbcaed54b308d022894db05f9b56b1f29ad0ed7ca659ffa6aec20d73dd27e2d46f282d4a669eba0e0f77a46d0c66c99953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95a9a1327eeab5591520d6b7df95c6cd

SHA1
01a31b27e2efd681abce82085e4f28afd9a4f2d5

SHA256
3a58429ce87fd54292fb4a236a49a29dde46fed9cc0690503c72ba8aa2ff4ab1

SHA512
7c1c803f1ab08f56732bcfed06dd53879ef79d3bbed1e4269ca25bcff486ebc561e0a20ee0a5323f239a6e090b51a68c4dcf6207b571322227c7a6aa7b0d800d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37dcaa63990ea40c5df6c36412b2055f

SHA1
e55bc05ab1a1a024c4d6a2442efcd46d07199a61

SHA256
93bf7bb2137f607f35a69aa476d5acdf0cb6db54ba5e260fdc7d6ae5e490decc

SHA512
19d8bd1a7c6d7f84fec781c30ac68ceb3bb5fde48331303d40fb1c23756dd22f5682f801e49eace6031d9f3ae3e48b1970b9abcda2102f119beff98562908798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd179efc0f651f0d3fe8b9a9cfb0d64

SHA1
94090eca49b5852d0aa2e4c7dc34a1c87ed3d1a5

SHA256
0cd94bbb8f3bce2e9adcb4bf936504b6a4a0f2e96346fbb4760d67270c5759d5

SHA512
b26613361f5c36a3a6b8aed7da94b2ce76392d491b84ed0022f3ea06e9c999e5626453950416d7924c7d018f2d610e8d012d2b1fc4e58057a1c63dfb5e48be43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efba9ec6b2507d1ec51636f4d95d551

SHA1
1b1905ebdb7b1d4f26f93f2adefae7e6d7cf49da

SHA256
6014af9bc8347c88c89f0ffdee2726331e060c42a47ce7a11f116aa2c93790a0

SHA512
3f4e69c72133847f20dbfad9f679fc9b99ea8623b18eff4fc47c6e9983e617c74d02d48b7dddf6c7dd16d10e5aea036995b32a1b49eadc53293185adb2006807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2cb7406c69e67d514df8959ca6758f6

SHA1
3ed8bf03f99679c1913e2b493207fb6e10292bb4

SHA256
2c9e8d03a170a02802b879bef87150db50b32f3fbb5dd8641a476add469730a9

SHA512
8802023eb2765fb1d4e9de21dd5c451d3190482a0af923c9c93f33bdde1c5ae3ca5438e1e54e7550c1edc3ae76ec4f12d22744d7f6b464f51837ede172123d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59fa7422cb5f9d177eefa42c271f20dd

SHA1
558c24f6b116ac7b6718add1b2e47b32c7f40c38

SHA256
bc26aacdf068df203661cb84ff22485817bf90c9435f8c1f3d3a97d463f5ef9c

SHA512
8846b6e50306dd3394fa7da030fe9ed3e92cd158086b343a681e5db2fb5fc4b4e8deaedd11a3f5ad75bd2dfe2a109403ddc4838f76b4b7f8645530d3121e51d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2416.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24E8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit