09f513a18899026002096e9127bc7c5519c792e61b72996bc5a96b33c02e9681

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aced1775150cbfcb49a0b8b49698f55_JaffaCakes118.html
Size

23KB
MD5

8aced1775150cbfcb49a0b8b49698f55
SHA1

3cb87eb8ff8e005f70baf351efa98bcd89858a93
SHA256

09f513a18899026002096e9127bc7c5519c792e61b72996bc5a96b33c02e9681
SHA512

ece17b02ed777f4903407859aa334190d22e75cee0820968d1af77d103129fc15bfd49ebfd4b1266649a0119cbae829cfb9a79cf26e211831dac7c0a98611fe4
SSDEEP

192:uWrEb5nimnQjxn5Q/9nQieYNnwnQOkEntrXnQTbn5nQqCnQtywMB4qnYnQ7tneYN:LQ/eSg7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD7A4BF1-2026-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423415464"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8aced1775150cbfcb49a0b8b49698f55_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
950a4aea7c611654bb6c36f68800bb19

SHA1
e463144a3913c7d6e4556e4e008a0f2ead52c4e2

SHA256
f626a91d75ca25aa66f56bb2f6cf9f0609c063aca39006ec071f10009d6ff69e

SHA512
55b21000255fbd5bedeaae1fe5f0dcdabcd9dbc189c92efc576b0c49374cc1c028b3c9e54c26719f38f9341f8d0d4838479244dcf15681b142d9aa4cd3f73956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3527dca9baa14c41a786130f58499e9

SHA1
62401245974acc1dbb10f3a05fdcb5459dcb75b8

SHA256
22d6f30262e3545250314613b69c5fcccedd7a13b6c9158ed1858a6e5354ee03

SHA512
3687723cc5941302bdff88f81d06f1c36062226d839b09962db2c1023299d073d44440330a4e7ee16aeb8505321de40a2c58aa2f2a773d485ca75425e6139089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86ed9c4fbb4e4f7120256157aeecfaf

SHA1
36ae6a0a8534a50d570b949f04da1831f5561b90

SHA256
f7b8f73eb198b723b6f46df4184738b42f80467c6d5e6b858e9d98b88ed668d9

SHA512
fc5116e50fccfcbee84e40e98159b04b51f2c8bc2c01f65e5cf0a29ebabeadf08936bc1e54dfa752544b54166a72dc1a916e5abb32817e127cf8de6238dc20f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d723879001244e27c69d0a09e8c086e

SHA1
762c5454b5272f993d5d566fbfa88b21e6219747

SHA256
2de5a1640e18e0414b26266f44a08319443db6fef9f7ad014d094984437fddb3

SHA512
f4f9e10dcd02c920268b72c3821f1e344a8ff7cd3cab2538afac0b64a0ae0267f37529dec59a5a175155466b67ffd4c251ea2eaf7260db1bd67295b882e07a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f57239b6f91c9ebd961fccb888757fcf

SHA1
7cfc12490f3a93bea09da9cef57a53718942b205

SHA256
a3be6f7a62738848c6faa75b63b784545459dff9a0908408aa113ed709d5fa28

SHA512
ae7ee3f135277a8794bb7172a0804f7558263713902fb371b97294ff00e6f9d4d04a2c986096f4587784ddee092bef5f280b21ee6e4fc7768ee09707087533dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2ee6adc67628f47c5a67815e50ce81c

SHA1
9bcc16f0a3b1b9a127ca68be7d77c49a9f56542c

SHA256
81ed527fded3afbc5db0ee81b93fb5eb8f8030462da14b8eee9009d2d0ae1910

SHA512
fe3293308958b4fd6f291869df3d6e9ba46a86d32e596a4f93f1d0fdd5685b942284bee790aa5b83b12ff2d533a206638e19fa5e8ced881ab7d93b2eeb987dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f96e693fd6f9deab82b3b76bdfad46e6

SHA1
e0ca053695c7165c39161bf5e9f72856cb82058c

SHA256
3a02885c2927e864c0ea1605d26ef4469c1a3bd4444546dacc3ed0532716f28a

SHA512
8697065deb26e08e36e35d2b454acd173a9448eff9d049ce2c8993e31f1df33a30f700a842d82ab16ba235f5fdee3943cd985ecc9dccc995dd42f1eae86e610b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08fedcb20d4ec0b0207757a45c7cba16

SHA1
4f7cb4bf955dc95d24766d108e151313dc912260

SHA256
fc7688fbde2eb9d89b27764831d1bd703f5ae611c95ea6bce2a7f6803ace47d4

SHA512
606dbcc9d40cec3c2472590784faa30a93ceecbf55a68ddc474c458f8cd8ad16e321107c9c0adbfe45cac021c5928f8908ea70b9671c795ef79727e6c43f4fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b0b0532319eb67181bb5e82bba34037

SHA1
3ba7556528e2bc3fe96ebaa9b4341f521ca7139d

SHA256
1ddf2d3538278e0714f099e9f42981a30672d1c064cd8b95fed37368f5420bca

SHA512
02758f2ee14b3b8786b9b26cc3a89a102925f1aac9cc70fc0fbcd138ec43e0d3acd50b5f0b55ec554d6368f093f4be3f828dd935ea8a8f48a0ab30d84a593b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C02.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CF3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit