7661050430aa54d9fed835073408d47f9eac2374e9b8bd947be222fcec07034d

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8af35e6d89b9d3c830bfb5b7ab37dfb0_JaffaCakes118.html
Size

31KB
MD5

8af35e6d89b9d3c830bfb5b7ab37dfb0
SHA1

257881d6401d0dc6c436e9635ab16cffe2255185
SHA256

7661050430aa54d9fed835073408d47f9eac2374e9b8bd947be222fcec07034d
SHA512

d5f2c96a968ba5d723fb9985b97998bb9492be2b2781fd8b6940cab07077b72e2a7680dd556995110d7725a0158749c61d36d8ee6b3fdeab914c5277a9c30c01
SSDEEP

192:uwk5Dq3KfOCMbb5n5W2b9Zso0kYRG6ZnQjxn5Q/jfnQie/KNnkJqnQOkEnttTew7:1Q/6RxNUa1t7KdV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423418792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D223EC1-202E-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1744	2348	iexplore.exe	28
PID 2348 wrote to memory of 1744	2348	iexplore.exe	28
PID 2348 wrote to memory of 1744	2348	iexplore.exe	28
PID 2348 wrote to memory of 1744	2348	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8af35e6d89b9d3c830bfb5b7ab37dfb0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cab22bb8d1bca24929b9ed4df486d491

SHA1
47530b57e56655c16f2f37de1bb59d90f7b52967

SHA256
d8d675b6dbd768d4035decf92f09f27a5a2682ef0c1cb544bca3217079b65ca4

SHA512
732c9b81879611a8252d5a5ab19ee016cd886eb6d6b19fb7f8313733db49b48d1a7baba80aeb68f2bc8f1d69ecb895f5394b923b3791f61532f849d555041c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22839dd7570ffba545ace48c57e08bf9

SHA1
19d01c2ce77123f2c1c44cac3739e9f4f581582e

SHA256
110d153901bfbeccb037547a97826b6a5477d6d8b88695543d3888c0f4bcec53

SHA512
a4e340023a450140dfadb219c86dbc79aeb66cacf3e9caf37f186d877a9aaec2be1f5a942f8c4fe4ea5b895afbf620d4989fe6149561cbcb3971caaa78f18ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d146511cb368b56dd54caec16e09b831

SHA1
fd93318a143a7a8f499676fcddc238a18cd6bb8b

SHA256
c89116d394338dfb8da4e7b61ac5123aaa222046494346d769f77d802e6e6f91

SHA512
01c728b973ae3f60c23317e5b79b9093c46bcd5c8105d54b76cff620ea89824e1b98c1fc3792da8c2c972fc6c9e15aace70f1fbcf1cae004cfe4fdc751ac8d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aef9f6e5e70a3ec2a36e238f683ba55

SHA1
63d4856c3ca353f0c925c416cd22c226a29f5233

SHA256
9597b579b414b4cfcb09a5128acd5a48f6a6ca0e911def724a5569f76fcfa458

SHA512
617effff701e741e9cbc294314c0d7cd9fe79d1b74c4b6027baf8fba0b4e958d554d599b03c2e56ea3371235c84fc0f66d9a3e23369c6e741f0c925a3bcc80d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e816c6a12bd2ed8cebeb65b52cee6c80

SHA1
4ec8ebc1ec7a0b771b34ebc996456a3c9c61a66d

SHA256
21f22e89dd8d5a6137ba9495368720e1c9041d4c3c07812ef45a401a1f9ba107

SHA512
282fde910485ada9b63338268c097e720a1a1cefab628161eb4791144069ca219f7225377eded7d85dbc679403e62ab2a3650a43bee5056b2aa66e247912987e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edaa374328f9d866147fc6db774d9c61

SHA1
e9ae546feeef2be0845a76cdb8b8cfbb88711223

SHA256
7ba4c3d54a9c5f13ef82a25f2fd4709ccdb232a8f3cb338daf20c543aba0df77

SHA512
54c972d6d5ff0c466b67617e50d85db394c4e1817b3a8c55c43d84c99628c605cf16f6c4dea21a74d717c87e2b1d6c1f200f8a7e56effa74a634c800c1fd9a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
754f903435e886e38cc0d2fd696d093d

SHA1
7516540916aa59fd5f06d52632b240d5d29528d4

SHA256
d7bb01dd2c70cceba2d5f994c113728e22e820ec75f1c465d90275b07ab45ff0

SHA512
4375bfebac0633a5843d3b2a966da69812189987744b9cd75c2e7d5b8dd5eb527930ce90bcde8c8d291bdc0d4ab57a27bf14153d40e577911755fda27725320b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ac1583ef9717405821588fb40ce71d1

SHA1
78f557c0e57e0c0b25e5e8c62c84c28b87eb637d

SHA256
b4bb004ed0395a938ae441801aae877b420c33edcc2267e36f23d3e8a0098acd

SHA512
ce6c2a74542c0fe5e9e78fa30d4f80c232e55df71dff77dd21d9026ed531a4959f7f4dc320ec11bca49656877ba0a31354dffbdd0e8a5d06752254daac58fb03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d54b81530337f523a8de2f86b07a2555

SHA1
fc0da7f0d70640a35e5b12745848ed563b7fe22f

SHA256
70088a59cbee8ad40a69af3c342763b6a8c512999e16caae43caada3119af022

SHA512
71ebc29084183afa4a90fa51e9a7e591dcc195e9cf63de92496f441973fb62b24a3779b1af335fc216cd95fa18c1d753d176e04cc8652f40d3c90505e1582f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab199A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A4D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit