062b7e572e0bcf9c994097bfb420d1ed0ac8b9e06c443ed08ac2f3e4080fdccb

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a0ff8468319b5fdc58c3c4142184ebf_JaffaCakes118.html
Size

29KB
MD5

8a0ff8468319b5fdc58c3c4142184ebf
SHA1

decd2e6ce4eb163abe2e9a2aed5458410921d119
SHA256

062b7e572e0bcf9c994097bfb420d1ed0ac8b9e06c443ed08ac2f3e4080fdccb
SHA512

f57bcce0871c1597caaa7553d1953114ff9ab34305337aec6bad2e79bf2f21cd868874268b32ec8fa9be0aa8b7a8ba4fbc27699d75c6c8fbe9b481ad275ea428
SSDEEP

192:uWzFDb5nEXAnQjxn5Q/SnQiehNn2nQOkEnt6UnQTbndnQXXCfAsaEeWcwqHALwQH:AQ/MQI03F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423396502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{844B57F1-1FFA-11EF-BADF-D62CE60191A1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1996	1284	iexplore.exe	28
PID 1284 wrote to memory of 1996	1284	iexplore.exe	28
PID 1284 wrote to memory of 1996	1284	iexplore.exe	28
PID 1284 wrote to memory of 1996	1284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a0ff8468319b5fdc58c3c4142184ebf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b63341a6b7dba56870de00b39f9151ec

SHA1
2ebd7e72af1b80a5baed4ed225355c241e40805c

SHA256
203e0cf2d09ca4af7dd40151493c8f96cd650c758b63e625281e9685c7eb5294

SHA512
9d586cd906d80cca4f52d863464f63e6f36692432d01eb9956b0d9c9e896d6e2a1c92fedad00106a8ac418d2982748ada8cb1a4858b66d5493c8257535773599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e4ece5b447e9b7845ce828cfe7493f3

SHA1
90672715492c4bb1a2f331fb510d78bb0e764ce0

SHA256
75a10faa40d3c01251cdf0f7c75110a7d9ed78be652d2a7050fa7aabc5ab3713

SHA512
d8a0e036d65fe4c3ead4a097cd56e02942723e78cf9a961ed32d75d24e47ce3edaa0779c4f8adc7a422cb94b226574587733997ff41f21bf231a5c8f3febfb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
346bd8051dc4981809b2250993312834

SHA1
9a77a9d12e52ec5176c95bd196f0ab9c3e5c06cd

SHA256
47fdffdfcecb44e28620fd96934e911b9b61d94e2f0d42d1b7707cafbdb1775a

SHA512
f0c1d5f566e0eaa6b99020f503e7ad32e8ae5cd20078c9eb34436211c739918f0e2c777e9af276a2ff3882770ac1def8186d9b451c5fd926f7de44f786026f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c95002636dec60eb398a6bac2160c036

SHA1
414c2f92f49892fbeb9dfc1815fb29efbe2b8348

SHA256
52014c7fc82691bbed456ccd7fbe6b330cf41e7495eb32d6a4ada6228e26e2ff

SHA512
03b1bf45ae49d20fad7dc5eb03045035542a2fc27e68b8ae878954c1a2e8d874816ce307a1326b93aef801614617272679e3369692b53305c5d6895430955865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c40c77975bbf85ad18c2c1ed9dde17d

SHA1
17c6f8a9479c99e3170471e98db3d86b3398c92b

SHA256
79a55a2fd64260a0af925d2d09d5d3076818239e26ff649920d81078cb4cc720

SHA512
ef3dcd36f17a2df8a09e953692324f7987e7b2fcd13e8fabf20bab18ce4394c0a19672e1785488b84289b154242bc755197ddf9b5b2842d98ead5b417fab8050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aceab0c2948691700a4cf22124b8f1ea

SHA1
6615a3b86964c267d5c6b25b8f2d4842cbee04ea

SHA256
fabca5e42efc9487ca1f8d667664c7e6346d1c139c5ae47eae79ba70d726c1f9

SHA512
93f27b598790ba771152d2bfca69bfb33a3da017a544c9394f1b56089ca0f15de813b93d2f62f54d84812efd85147ad9b2065bea25b476547dafa2aa2d87f65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ebec816d061c1ae1c50f3e65c47ae79

SHA1
d85bfbe718a1e20584b3320b16e978438000b370

SHA256
1487e068f73b2382d7c9b0ee88a7b657796c7690403454d1fae756939c55f7d0

SHA512
51552a103af01675eb1b53d29dc448ff87bfb0720bde66eb1103a8db4ab576c5a0cb5038c7045ca5a760c14e1ebeed82977775970733610a42e70fd207e1c044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c466564eebb874b9d6f2976cdf21fd2f

SHA1
cf86c708be597176aa8062dc12640f7209b6d5c2

SHA256
f52e055a92a80f592488fa42c66e5940f2d2e5aa41b8621033d680d39cf7528d

SHA512
8b08f06a4e59810ea4903eb88ddc4a4d88f77c003372bc626f93f24b1cc1c47bdce08316853b1203de1a3c6013ea925f28a5ba6551acc85c42077f89ed22f173

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FA0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4035.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit