18e1f0790fb65093f4970d98dba33954599502ba5c5a5c6d42138a109552826e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a6ddf0d4215d9ee4ac7f8c03d7de3a5_JaffaCakes118.html
Size

19KB
MD5

8a6ddf0d4215d9ee4ac7f8c03d7de3a5
SHA1

7fea08836af93c5de3737ee657ad137e1dba3034
SHA256

18e1f0790fb65093f4970d98dba33954599502ba5c5a5c6d42138a109552826e
SHA512

e72630f055712cbfe37818a41a30ea2b5e46f3ff47376908cee8d074b945193b053c241af20d3c2b5e8060cdcdc5126384c0a8c5d40e5983b05292b23dd2b7bd
SSDEEP

192:uwzxb5n1tnQjxn5Q/0nQievNn3nQOkEnt0+nQTbnVnQmSgHMBPqnYnQ5mNnlnQVc:YQ/Mq6Nu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423405418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48D23A31-200F-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2548	3000	iexplore.exe	28
PID 3000 wrote to memory of 2548	3000	iexplore.exe	28
PID 3000 wrote to memory of 2548	3000	iexplore.exe	28
PID 3000 wrote to memory of 2548	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a6ddf0d4215d9ee4ac7f8c03d7de3a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7ab937d68648e777ebcfa667de353c1

SHA1
f2819aa353e2347e507e0aaf7f88de8ce15abbc0

SHA256
28ef04e3782fa329b55e85cd9674c8751fec55c46d1530cb5f2835f2439712cb

SHA512
82f4e4d8de5024f42916e9bb3a8668351648e543d93fd16b9d936b4443cff14f14dc966daafef4dce228f229dc4ad2ae1c11f2bbc23622af8b5bd525d92d4313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
819f7463b34d06a3d784122460f81ec1

SHA1
4874e029ddd939c4efe97f67cd3565343822b481

SHA256
1d0c366507e104c32e934cac8645299f2e98c100f161bff4d787f49eb15b5ac7

SHA512
5499e9e5702a74f3b45e00bf9066953a6c53567c33c282d5be782a8e32b1c5f29d38a2e2df839b059717b1adfe252035579f400ff0f53d0dd65bf7d821fc5730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41557f4910a8aef42fc1ea9eb1e6251d

SHA1
c8a2d49d393ee930def57efccc4081be09450d61

SHA256
6e53fa87e6ac1274ae2c6a269150b3b65d791ed24e45f1f8bc123d4a2eea0efa

SHA512
629b4a9fa67d3be8f083c82a6366fb29e60fc757e033e37a351216d76891a7ff829f8cb727bb8cd24def00997dbb010f0ea9407712f06e7e541498d6eee9cf04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e84604c283123b285b3d0ae2e19a7b4

SHA1
8348c14523634597df80621254ad952b8541760f

SHA256
0581cad2309fe8a28e54e61105247dc718f65d0a0ce4f2cd9755b6d6e0fd248b

SHA512
82246a52013e377e2d387c48634f331ae9da0232eec2de4836a65692587bcea163725c195a06407194e5bf71b42826c9d4d52de625f9ec7803a2ef8c1c759e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6568c56563b8df7e5272c94f590ae88d

SHA1
3e3fa13ef71d90a81f9c1e0f2e1e76c6f02e626a

SHA256
4243ac924b6b90dd97efc9ad4f11e05579574aacdc352659538b772df009ad17

SHA512
c5a6104380ab73b0e80bdcbb1e76e2e8dde58d15875b49d243bf8f47f1cdf8e24a2d28b9a51184a66da9e40f1faaa844f28ffe326c3ed75cd69e13da26aa078e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93eee972e087b7d7b372b828e74582e5

SHA1
4c1f507ca55a76596ff0eb46b1e3831b14379463

SHA256
217033811eaead6dd89eaaa6d737cd731a4907ad46cca0a96f9afbc8fb719f38

SHA512
27d5b3bbc4a2cee3d369ce10c920903bd8e4482f041092ef39cca8fe0f71776c89b8da4f01b345b362a846645d63aae8965a2d9ac23b431b08eaaba7f30fd1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
405ff53ce360df8630e6e4979084f893

SHA1
d6147d90699781ce5a4eb985d15ae9863ff657ed

SHA256
41f7326edda8c34a9fa65e5be915c7fa622eef1f04e0b10b1ef32f7144bead9b

SHA512
b26fcaae94261907636e17c32c034dfcfc4d7088e99e417ee6f35471a13fe5ef470536e899560c44da81f70cc4731a56a880b6c935a93d756adb3b874c2a818a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38202347e6781f6ae8d1f301fa5b9073

SHA1
46beffab6d41d859bdba4343741e36c0d0280f32

SHA256
1e559442b93a053436fba132cb52fa9121d56049670048d60d8e81dff26545c2

SHA512
8ce59131ed8eead5ee5d8a057881d56340e2ab93f83e01e5a4190f512712c141dc0ee2bcbfc736b057020e5e486090b0e6d8be8eccd0bcc75316dace46f335e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e92a4e9e104657266ba5ce7af6cef663

SHA1
50527771ccc0235447a9d02d3420612d18e16726

SHA256
b1d856afe507558e19261ea2f069fa54e22cc8e539f84754aa599895fe204a81

SHA512
abf2ad69f8f3195b7423f525bda02e3513f95437ece15d6b30ed1b0853bdb94ebad10d13b048a25e6f1143368e56c9a0afa2155c109087ccfa701ddba3320a95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B78.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C79.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit