7c275855b7e83d32e6db535970f6f78dd9b65b52626609fd734532156affc4ef

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a21805a70469cefe8ee8533138da6be_JaffaCakes118.html
Size

214KB
MD5

8a21805a70469cefe8ee8533138da6be
SHA1

019ba5e36252ca5923dcd819c017a221e00c6528
SHA256

7c275855b7e83d32e6db535970f6f78dd9b65b52626609fd734532156affc4ef
SHA512

1fac4f29fa97e5ce0ffcaeda8c6abbabe0501c758d65b34893e1f750b9272fb6c98928f7bfd829717b875fe91db10e3f0ddabd4c37c022d1dafbe1dab881bf8b
SSDEEP

3072:GTrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJm:G3z9VxLY7iAVLTBQJlm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423398181"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70035EB1-1FFE-11EF-87B3-6E1D43634CD3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3044	2344	iexplore.exe	28
PID 2344 wrote to memory of 3044	2344	iexplore.exe	28
PID 2344 wrote to memory of 3044	2344	iexplore.exe	28
PID 2344 wrote to memory of 3044	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a21805a70469cefe8ee8533138da6be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
03679ac5556a522b66162f4a2cde6978

SHA1
73900520443296c136d46b820e079bffd004e736

SHA256
fd3b556e3076e3d6206eefde52e3fe2d5dc4ccf3f6755556ce0b7c4d6484be04

SHA512
7553c817a06398108530bf315ef9b35a842a7962d08c46b697f5c315ab67e1b0f7a0ec4711af7ef6580ee196fd9c79400e31f0804cd60c87e39a1702e791a6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
215461cf0cb4950e8d46f28d07ded8d1

SHA1
f049028a870dd2b80a58d920b9383fbc17b2c6a2

SHA256
78161d81a1f9d27defa75059c0641c961af4bcf7dbfc4251f6fd944314723dad

SHA512
2099037d4f71e12f52046c1165a138a393d3c47852e6a5dcf038af636db451531025847185e93641a6f26299d8e99ebe9ad03b05c8d97bf0a21b3aad428d0f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ef23b6e801e040f91a25cd59b30553

SHA1
717b901352db7456a5b3a1149204add4dd194d12

SHA256
8c5c2fb68cb8e8cd7b397df818876dde633c2a7b9d5ccf821b9ad6a0f2eeef3f

SHA512
9da2e40733b26c1942c91dd6011beca829177dde09b870842bedd10eb4b0b7879371b3ed712f728486cafb92ae1a76993aed62c6fcd4a365ad2ab33dba5b8100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aba29d6e45b25ca6aa56dd878a344ce1

SHA1
4d49a860397bbd04b49e65cf2975ba66f50cc22f

SHA256
bf03e8b9586bf973b6564f50ab7b11929b17eee339e7ffeb2feae2b7d58e0116

SHA512
68c0b357aa5ed3f2a4bd9873dcfa348011609711a9b1c4d52eecb67a289c52e11ca7e8f80f5ccf3bd28d2a68c047f08a0db41573d4236df439f0734498227b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe0426b21a454f247de3c64a4a4b83cd

SHA1
e5e236a13fe7affa763655efee49162d928578d7

SHA256
cab5509f25bfacf42f0692229a028060b86c7c99ce74459ba650dd3c73e74353

SHA512
34a0e34c4ae108b1bcfb3eef99ea650c7e86ec2fab21de741cf28d698e6b7cf21d7b5f85b380c4db16181533bc9594f0af38253e5c0c5648b769b409124c21b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6ff8ac1c684c8af4fc0397e48ee355

SHA1
658681659228273e5208e1ba0221b58db49b64cd

SHA256
25c24d5b3eee84705967a811f9f37558272a85680d2f39a7bda9df09cb055bab

SHA512
01684c1f837abeffc419764cfb74df03447ed4b81398d3b4015103dc5d618b59509f21aa729ba3641cd3bd63050df032339a16ccefb9b09d3b08a27296b57d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f2e12e89e9b8934bb2716aa25a3eb8f

SHA1
832592db8c4c4631b63b7cbdec255f5824a6a853

SHA256
609810df6e74d40aec70c0ec3fa77776fb2eb61ea1e73067b740ee1d730ddd76

SHA512
66fc375857caed5affffffd0e0975c1fdbd7067346385507252428a9097cf527f4826680ba758c5d32fffef1b4bcd4796f5a924d72e7242b2c76a2e51a633e54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc318895e99131a63e2585d62d95c13

SHA1
c3a3ec87727ff552e94e8e6bb0bd3faa8dd41fc6

SHA256
fedffcf7259c3c9a57612cf33c9579509cff4a2316a6fd0215d2897c8897eac7

SHA512
f58afe052933899a65ef6c785291e90a6f126c33f3d49d5b358ea8ccb35dacc243e62432657014686b0bebf192ea09e604e6b24637043bf6e7c22f699e82942f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3111400d580ab990e34a47e886658abf

SHA1
7a279b015055160dc4490d8fe377753b2052c375

SHA256
15541a192f728a0b0c00e5ab425ef926240ef3e1a5555e060c460da68f94f120

SHA512
8b155b19fdb062101ab32094841b606ab1add89da3bf2294cfff941ccf28b283f57a06f2747639e803a8a6b18ca776fab822334fded6ff6f09f4828e72de5b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff849a4c1071ee2845b1d0c5772336e

SHA1
84205c1af74ab0616c9ba92ca94512265f24dc07

SHA256
cf78519f817fa29d4eddf918660b41c4a1ac747457a51b53e8116c4416876d49

SHA512
4a6bb295701b6c553337d907223d5a43144d917eb89c5ad68096c8f276380a92abed95e326ae56815f34f7d5983cbbc48eb76b3788fdeee55a7c96de47f7a7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b8502b751394ee9cb40e952f8af63617

SHA1
38c818b5fb6f5ffdded3d537583dda6443a2c2a2

SHA256
f93700ac0b415ec59fa5ad8533002c17dc934fa92e674b06b61ddf547b7915cf

SHA512
6c4e02214154717f819c90f06a6fa579f4f6de0bed397461cfe1b4008114cfb2b6f9cd182eb84e0fdbb2eca73ecd51140c2c42962219a81609f874a65b607714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1861.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19AD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit