5846a9f3d3c195bb5f314052b28299b95a39dd9a31bc15fa30e925efcb4465b5

Analysis

max time kernel
134s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8944ad66910925e7db6c7f5e0a1fd4c0_JaffaCakes118.html
Size

29KB
MD5

8944ad66910925e7db6c7f5e0a1fd4c0
SHA1

b89646a27f2d37e253953d08bb87801cb647b932
SHA256

5846a9f3d3c195bb5f314052b28299b95a39dd9a31bc15fa30e925efcb4465b5
SHA512

ef05ed47d63cd8687a2cab19133b00703e06308aae5e9b09c1df859f63ed37e094018bac1d2cb5f5247fcdab7d4a70fe3ca9b2039ce14f544151916abeab5764
SSDEEP

192:uWSM8Tio5J2fTWb5nbXEwI0zzbiWlcnLqnQjxn5Q/tKnQieplNnWf8nQOkEnt/Mq:PQ/zn5Xl290e8CGO8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA77FAF1-1FC8-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423375221"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28
PID 2236 wrote to memory of 2240	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8944ad66910925e7db6c7f5e0a1fd4c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4682fee7a4970b3ff3f6be615427eaf9

SHA1
3573cff64db7d8c5a5c1f9110a2db163b79e8477

SHA256
7eb92c8450721f0ee4110d5ed546ab68b2408f4ac366e1d1a7a4387609d0f8a8

SHA512
cfc5aabb1885aedb905c1cbf71839e0d72395d9be2ade35b9b02235f9eafd07ccf5348183d73bf4e87f026eab2c7c2835005bc8f5c1831c7da74dfdd2e8664b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33a65c29209c5119267d8a3eeecd6f45

SHA1
19cb01b19f389d043c8f3bd72265249b5e561606

SHA256
47de4f65e369754ecca8d0778c2168220bce04e67dcda182230dfd5508a92a3e

SHA512
496fc57ca66f03d2160781605274d43211dbbd83143b32733ac66caae51446fa79eab17ac2b2d51fee0800a71c41ed4fe6656b5eb1814349af7cd13db16e0330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e95890619de41c5abfecc69093a9ee2

SHA1
c6f9d8d90d82cccb574bd24c5c8eeb6519a36efe

SHA256
b031a4e711508b90889ba39b72f75c1cc60170a3458c9708a467ac40040663c1

SHA512
503794436af02294971b79343d6c825aafb2cd31d2d22adb346c829fc6025dc0a762296c644b145b9ee89c9a4ea1ac77f43f8c3f9591c06f5dbcebb02febe815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
321dc8a0c1e9e54e305cd5788c7ca5a9

SHA1
9765d802ffc55d47ae42cc028fff5fbf68831269

SHA256
c2b12ea0de5484f60c97fa80046a2d561a617035697086e96a8812ea518b83b9

SHA512
53441ba7fa60df0e32dbab8785f3e4a8037766d5521fbe34f9ccc71db8976216c9f58eb66e407b4b849ae5d2c785bc9a7dd36e4eb255b6f9c4749e213707804a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf6cad6b1e837b52e218fee228e0da5

SHA1
6c2798b57d4eb54fa578e9f0cbda6f8b33e1c194

SHA256
a0017abaf75bd9ef99dfd25be861cc67dff0bfaba6bdf577782920103840094c

SHA512
f227c4580dcc2e544b462088b34edb33f1c5d44b5b981fbd3a8f8cb9d64e8e3e91ed1f88308c6eb8cece10e63eada0c9fae604d042b949677694fc0c7faa864d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd02f6658ebe7a9cb493ecfdde780dd

SHA1
fc2db498b7c96d05b32e7e4a386539cb1eb59825

SHA256
b069df07491845d8633d94129fe38704a54237dde66cc2ebd390600dd98462c5

SHA512
66f107fd71d26d13851b10b60ae3518df2605fe759618e1a0cca4a5576c71c334044d4adc4c99cc50dd95e327211ac1e6a77be21db6c16814b06d042ca590aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd39c38c7f7c764f58a331f449c3bdf

SHA1
62702ace81187666b217d3afb61abef4d0bfb771

SHA256
0694f604e953c32a08e5bdb1d7623a158b205ea863d5a9c86f63f4db7e5cae22

SHA512
ebe0ccc7a6e094f73f1820c04378da7d3f655dbd6229f52418ae0e708e17f605a16fc3bf23142b79f35b716f520e4e094d5c1a90f09d54af235511f7ea066a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68fc0b94a83e17aa0b3e48ae75ed13c

SHA1
100ffbf13eb4987290df61af166ef9420ba62151

SHA256
97e1d5eb954a7e2660f92afba50d54c68be940a40197e22a44b9c93b24e35c76

SHA512
5f643c35d299abdf66e965da8910efd2d0adb2c5370759818914bddd323f4db5949de47f804e8a8d8fd362b82d6695f6bf93967bb6784001414d3420275a3c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45f98788d94a1f76a02ce9fb79e4e76a

SHA1
a0b999232d2744833d6b766f2977e500b884d63c

SHA256
13c1860a3474207d8dbd8e4c17b452048280f1b954391348ca6d91716d4cfe9a

SHA512
151247ea580dd65afce11a01af2b0c13367eb184339e3a3f0abc3cbd9943f5ecf50d4cea17934ee6d2b7dd47ea82d758e20772c37626ee0ee6ec14b8c06edd16

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB277.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit