96bc3bd42ffe1f39059d83e8e355d35cf4d8174fc8d93e051c60924a74ecaf6e

Analysis

max time kernel
129s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a6d8822b96412f74376e0b1a0eed8a7_JaffaCakes118.html
Size

23KB
MD5

8a6d8822b96412f74376e0b1a0eed8a7
SHA1

932bc95b5a93ef4a999a4800e95d9233a08f902b
SHA256

96bc3bd42ffe1f39059d83e8e355d35cf4d8174fc8d93e051c60924a74ecaf6e
SHA512

10e3d2a28a070ef30324eecfc717ee2c8bb1636a06e4a730d1bc6b649a2d76dc763e59ab0533e88c4a4459b63f1c20f8a9ffde9204334a5978ec84bd03eb21e2
SSDEEP

192:uWXgb5nQGnQjxn5Q//nQie+NnXnQOkEnt19nQTbnJnQ8CnQtEwMBeqnYnQ7tniYl:1Q/Lg8r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{319AAF51-200F-11EF-9A09-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423405379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2908	2656	iexplore.exe	28
PID 2656 wrote to memory of 2908	2656	iexplore.exe	28
PID 2656 wrote to memory of 2908	2656	iexplore.exe	28
PID 2656 wrote to memory of 2908	2656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a6d8822b96412f74376e0b1a0eed8a7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bdd598d9732e4dda4694faf85e194c2

SHA1
c8735fa89bc31011647e224e0952933861dfb6aa

SHA256
aaab89238bfd613204157b4c1ca0de7b79d6df9c91bde4520e8720a164280a46

SHA512
faaefaec0944023a92c036d4989f2f050253dbc05092b08970c4836cd3f2b3616b5a0e22a8554af80c01232c22b2be09ce61b0ff934306262850db6f9f9d373a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
849fc35ac05c79c59484843c4fcb5c97

SHA1
114b9ea625c068be65a7deac2db9c66071fe3661

SHA256
d8595f3af62c303cbe4fb504a7f05e8a8ea6df21fc5a71cb3f8e06c669f9b2ed

SHA512
4668a802d273b4c91e18de25f5b051094e5d16d569c287fcb357b39fec696ff43e5bc3ce9eaba4089c67988dd6d953bb4f491580a9167495cefa7d8e5e810dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
819395bf077d50cde3f37a0121f6fe29

SHA1
dc35f1e70ce39b3f60f90f4d804da6488e8c5e13

SHA256
c231a930117f8b8b5591fbcb22f1b99ea7ae02266b046166d539591bad95d755

SHA512
461e0daa0be49be0105b3b1479d215534ed4b9d585949c8d686fffad4bd250815ac4ad2460f3a57e6822b7ad9c094598a4de867a7a1242e846557215646bff8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67bd8a9e6b520286b3b24c9ab14f14e7

SHA1
9b4240f8f3dfd238ef46a847d0bd6d43d88b26f3

SHA256
7f345a0f6b16ea94309531cda8d70a8ea21f863a9da80e7912e59af0c2880693

SHA512
2ff8b9c871fb6c55fd32f562e5218d6afe07b76d1e4dd165fd397b02cd5b368174893c4befe701d92e29763a281de0c8531dd363580fd042c75732a374038c18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b8a4fe07a8748d27ccd3e58521392f

SHA1
9668d030e2017dbe2e7a821d38047eccd2ea978e

SHA256
5acfec10e08c60a6a420f9b679554b15d2a5818b0ed1c809bb415bb6fe1256c8

SHA512
543ed9de0db575244002acda2ef29ab82ba74ce1073bc2eab10b7c2cfe5690a62d92311b9bef0d83179edd266736aed02f2b3b17ac34fc157668632f5b2c58c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5afd06e71fa4070ece2ebd5fca55b4

SHA1
c2b46ca276dcc544ac4a7dc82a1682d31af5ce70

SHA256
73d4b17397fbd281ea89a204f6037f02713da805f4e8bee8c3c7893e196bb544

SHA512
d0a851a127440645998845f648a19d3399d416c3c55de6f21ab81919f1bcc054332dc3032c011b0c672d2ff23e9b99aec38a1c0580fb0e03106aca7a2186799c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea3c0b96eb1ada7d3c60fe7c625913ad

SHA1
fa2fdc75424d6dce9f84be5de21f890af2e4d9e9

SHA256
57964cd932650f35772ce842b5b0820c919da12feec4bd8a6f2bed338c3cada5

SHA512
ddaa381889830167fbc3fa258ceeb77e19137c1fac9af13e1fdf88a27127df7b934c61537954a20c6b6e8b1283f7d5db21ff5685c3a482c575b805f251629b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4526fc9569c697b138cd261864a0237f

SHA1
f79f0ca0ebb55c59c6f5c777d98f5b5c337828d5

SHA256
2903b861f0ed5566fee8d93f8348fee30cc8a1b536ca4845cb55fa1d1d65985d

SHA512
67675831b9af8103f151d5c6e54be0fc0060be0d7e22aa28160d7decb486e075fd277c66182753ee4a49e3eae7c74a67582d6eb13dc1f8d31f1c1ae36f9c8162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c73c59fc4a4d2538bf91ff2679e877

SHA1
69d9add0a871b4280eca905617cbabd161e2479d

SHA256
80efc26cb4c10fe31dae99f13388bbadd20213fc32909d8ab0aac03330b86d87

SHA512
2e76465a5243732263b7e76e399c26b2c108451e9a43ec8af155eda65af02dc9b4b126f02f2059c0ef12bec5d5c9267e8eb10b07430028fd685cac13502978d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a36e455fc56d1a1e7d63194e870b9a

SHA1
9ec53069f7b86feb22b99bbc28f6e2e7fbb303d4

SHA256
6e14fd48a6e4e82229fb0710fa2119cce3463caabb49662f57d1a3f64c458400

SHA512
7e9eebb8e7a324d5a502b7eaaa3611ea1da3a24ededb1d75b205d81b335bb2b03df3aa67f77cf84d8f722e91ef3e0c4b714dbbb383ef19e7c2de1841982a5e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7893.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit