67e22214c2a5a2e3323835115aad04b8f558473f7dfa2109e65fc992a0513f31

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c217162bfefc581ef1824a72179b5a1_JaffaCakes118.html
Size

31KB
MD5

8c217162bfefc581ef1824a72179b5a1
SHA1

59d9202511493d6a2fd225d6640a1e8ae9760777
SHA256

67e22214c2a5a2e3323835115aad04b8f558473f7dfa2109e65fc992a0513f31
SHA512

798aac7aead0007a462b23a082166392cdd7432d917ef82bdf1b3fbf53bada3df9f51f16165c24741391b23ab539b9d68114620159759fe0a8ae26ed47ec9ddc
SSDEEP

192:uW7qb5nR2TznQjxn5Q/1nQieQNnonQOkEnt/DnQTbnxnQnXC/4AX3qRiv19UMs08:GQ/sg486RivUMNTZDP+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30259C31-206D-11EF-BDEB-D6E40795ECBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423445748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c217162bfefc581ef1824a72179b5a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
26c54006bf08b5eae888b5da4a906787

SHA1
074d5228cc41a721d7b887abf06f19a0e3781799

SHA256
96ba039bca3fde60c5991b2d073f70e98cc03e82a9e74c4509fc8f987841448e

SHA512
e4dad5a0999083411b0419e0ed3a676b333aa269be6bb0c3a569104e47f2c8dbd7809c94d85a66300b45c07f9a0971b3dffcceedac54fcfa67e89f69dc68259a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92febed61c7920ca024cce299a370042

SHA1
ba49159083d0ca66210bee6d45e6a231b5c7f56c

SHA256
a8b0f942d95a9a048a97477cf541ecb1c38c5f12e32232a5ca0d8126ac9429e0

SHA512
736ebc5f7957349332e6c46124a14e98b5bf297d28afcd641df584dd6bfa2516ee9b1373a09bd033cdd5782b3775b2dbd1aec3ede8b6f201f1a8d8756a5aa523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341a59f7e1ded5ac16765e5766367ce6

SHA1
a79a2dfe259a59f8bae07bfaf23218c9f9abf644

SHA256
fad57a9555265c35908740969cc471879c093fe4cf0aa14fb993874384897a74

SHA512
edc9eaa692d94f21d90c2569f787affd78a4f84df954ca04bd604d164ee8487ee0e5dd029341262ddca9cbb05b87aa9ab70b2ba49a9e398a6235845c450a0f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc5e9379e3a000197f987c449634a8a0

SHA1
0ebe3aa5df4a26b3644a90cffe0a246c17b998d4

SHA256
40781f7f0e7639d5046842e6b77b10e738ce202247fe7cd31636fdef7f9fcfc1

SHA512
772b5868e0b7f66151e495e8633ac11f365049232208e7f3e0e32773335db684efee0df420b5af8520729dc928c35889dce8af78c7e901ca42b49a11e687a1fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
242c2f4ad892b36691f1da6accc3dd40

SHA1
e95f1b9219f3440b2f69188f2d6a791fcb58f8b8

SHA256
1b89feacd546f8041a33851e7a42fdc88c9bc92138f5fc16bc8bc14072421f98

SHA512
62a44e3e2648efa75a1353e905715d0454548180b121bab0afa6c685b8351dfe707d6a89f030e130e7f117965eadb51a7eb1845d3cb4b1c3e224c124a110b2c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe7f6b403e42572c1d48a4a440b604f

SHA1
da137a6af231f5d12bfba68aabacad05f81f7786

SHA256
fee97c9ccd5b4b33bd3b6534fa464c19ec787c94d7eb494db2057184589261de

SHA512
5cea60914ea4643079fbee019ff2fcde1eb946054b289ef606c950e7d6b629ff9c91baa6ac5af75346b032cd4dc034b803c88f03a683ac948b13f81bd781b7ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c612e38a927c8920d8d2e1bdaa6b374

SHA1
b2bf17e31e7c27b50bae505eb5802551a7abbd5d

SHA256
0b42dac470897823d716a6d6f5fb0b86f63511e698157c8fce8462f9421ecd9f

SHA512
cd7b0724cf9521651d536e9e73edfa97cc83c04d00b99b73915b03952754ecec6d9c807e61faa2319e153dff2305c999b63f839d72f3469cd07dc39eb43065bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e54e087702f255346adb72912d99f37

SHA1
e43a087e7dd218a02d917e72d7da880b44bf5a8e

SHA256
c7f8eb139762fd5fc8b7a2754693f3503cfb3a2673ba1df91e83fd586c9095f9

SHA512
a6347ccac6fa471395a2d988e87d8bda696b5a97a2280b783dc6a4a0a1fe1b1263b6c14fa353379b3cbd3473971319f195617c4010d213e18e106672ecf5f164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f79a8e5c599091493827c419d7457d2e

SHA1
f3aeef4a3c585d61ddb3202807e90e7990e83bc7

SHA256
679d6dd4de0e69ba3844ae523ab6bdc893fb695c1123842c90687e6b45de48b1

SHA512
57a1d6c1e4ead3f38c3c1b4189415bd2868aa66c9d16b7ed1de17a896ee9973d203840c2d23fbded46d4d954b40e88967cfaa48008f347c426f3d7474a2e469a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca2eb39a996e424e768d33ee48bd0a01

SHA1
f88b0c4b278aa742a5c5eb2f6bfc5754c268892c

SHA256
781b3de349a5d9418d159e7d496fe35ed8413cf2004a732b4dfc9ef94ee38518

SHA512
02e2677c4c46f89b323a6cf6545db4cc740e8e1574f9022299b645903e91c0ae9f358f111b82b6db3126b2c5dffb0a7c680ff12086e94c4abda607876413385e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
28ad7212e7235aa46df8a27516213806

SHA1
c04424a8223ed29ce2afef5f13751cd58c599179

SHA256
bd54936944e43272e7441c7f450838c7f76c1120fdc784bc223d5fb52e5e8489

SHA512
0c2ccc9884dfb2e887f163103c303306b0c26b634f99f613dc86a9af3e1415c6d52a0f92a052fdfec628a9e10d07cd2f45a08b1951d092a4c359b5c8ce3cce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit