6d0776d227068f606504d2bfce5564eab03ab7005b55f07f519733341ab69493

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ad25bdce9f2e0686434dedca8c0b980_JaffaCakes118.html
Size

26KB
MD5

8ad25bdce9f2e0686434dedca8c0b980
SHA1

e4ba8dd306bc1d614093d3ab45479b8c189085e0
SHA256

6d0776d227068f606504d2bfce5564eab03ab7005b55f07f519733341ab69493
SHA512

0933d6a1ed4bf3bdfa76e5bf82c1d1720e21cfef9c8845a4de791935e262345120a5ed60d3c3b74f7b75074e07c0a3736af04e7f7752924b42aa9f83d3cfc87b
SSDEEP

192:uW3TQb5nhWLAnQjxn5Q/ZnQieUNnsnQOkEntnXnQTbnRnQ/YXCWAJpdEb4cwqHX/:dQ/31G8OY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B32E2E1-2027-11EF-A04B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423415835"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28
PID 2084 wrote to memory of 2632	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ad25bdce9f2e0686434dedca8c0b980_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
828144acbdcc9c7441e092c8e40903bb

SHA1
8af71998dd4b4570713381db59a62d28d47aae22

SHA256
44aa9f54c54f2efd839eb9f70e94d541b5f471810f031256afc2b8a9cd6cb5a7

SHA512
f2250a478c901b1f489658b2041d97a78d40034164a48825b0d661e9c2cdf1815c59c48c389bdab7d53a638d7b739e14e35d20b3a300b2cb7068c1bf1fd77a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f929a98d92284fad33836209b0c8444b

SHA1
817e5e7539e64819e3cb36a7ddb02bbb1eb6381b

SHA256
7c893e801da5333f9bb362e6356bddc2aaa4a37eedbd33fd1674bb537e9feecc

SHA512
082625ad229857a18cecf72f269659755cdfac1c5d12a1defe04d1a77330c5c7d4e8ef4265e78f67fcebc7b15237416dae1a06e6367f2da4427199df1093e8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c71acbb2f809221c14b9156fd58f9c04

SHA1
925aafef15da6d6d1edc32ff65f124766fc365e8

SHA256
8311fb9aa60e010338890a2590c3bf7438a3190a8305d42d8629c86cdbcd94f8

SHA512
b6f4fba823b10f9364d478755b332db91a5422303099f5a62289c8a689adf2f63c5c8c508b0cb0ccf043527097367a4500ce86c349d18aca9451bbb4b36925a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba626bf1d296ebac257272b8c844cb17

SHA1
dd3785b99338c1a42d233cd0480492f42f428e9c

SHA256
86f86c34a110bb3e559b360bcc05c125e03d686a723f9137ee5bd69265c56ed0

SHA512
64a46208b9b93f8dec293d633fd42df7a4e36e75461d76701e4b991cd7f6e14b94b4057bd8c8e4a3022bb3fc522f5030c14e4e34af68e4619ecaefaf5b7df689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767659d332d659f535a0d95d0acc3da4

SHA1
ffdccdec49c4a97f602628a0da966bfaf9968161

SHA256
f443ac2c5b2fbef76f9524e57cc246977b790961fa84ad284dbbe32d3cd80c7f

SHA512
07c4b55b1f4ac7df4e3c40c747dfa998ad4e4ddb9b3ac07a6e44d12080a020ac33c5c78be2a49cb571d95383e26515ab25329d4ae04c7a3027a6e89b5c1ba1af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba45d68ea41b61a5f1578d93af829c24

SHA1
dfb432f44d995fa46f8f78401d0355180199ae59

SHA256
abafa8de7119c002cd6c768ecdbbda914fb7bad27acb2a34830a2a9447a8771d

SHA512
622b80368e87e069188eadc039772cc64951c11efd7129db6a2b6c16a4fbf0c4a27d126f6df44ed9523acba45ff123fdff6892f8414174732c955c0e006946af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635e6345e136a9c196c62ddabd384e1b

SHA1
0191bb7e24419410832623e25b2a4475cf47670d

SHA256
914a516057a6bd0571038463bb9740334a508d1edbd804299b25f54d3c311aed

SHA512
186b9b1b7c9d5d51e2ec41d58d0a49b1be5e194bba583d7c840874415a20c503149f4a302f244517a5cb28256c7198f62111793c0efc65beb7c256f8a0fd8c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f7377a5c8fd2bbafa43cf95910c30d2

SHA1
0bddabb5e18847e385e50630c72b80522b1a1d2e

SHA256
c78780067f1d7a9ba0040d439840374592d355b3e8377ce5bfed5d45758c0cac

SHA512
8ba9bdcaea8e84dffad1a4d05712cd8339727a14a0ac9af28861e03ac137d54e7ac28671f62a62b33eec44a4ff19b072c4e7583d5b2c2a4165312e1c5759f3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a84a146e49c6adbd1a79b6920047b3a2

SHA1
474268a9dbf982dc0f6c60e980f5d492dfcb61b1

SHA256
2a23f1d9582257e4025a3c187714b5c158fd859b34ff8ee998888c31e4149f94

SHA512
f6614262af373bc463095b4849e125a9341dc84cb4c863711da54f7cdb73605293e6aee07d6c6b04e1995da6a135d6c8b676bb0c682fee6ca826d16af2cf245a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1281.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit