2e6a398296971b232410477ea6d9f3671b09698c53aa63660c41a6dbfbea34ea

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8adc09f00b2c90af56afa9e84e9686b6_JaffaCakes118.html
Size

32KB
MD5

8adc09f00b2c90af56afa9e84e9686b6
SHA1

13d247287241ac42874a1555abd6ee57cb5c813c
SHA256

2e6a398296971b232410477ea6d9f3671b09698c53aa63660c41a6dbfbea34ea
SHA512

098f8226f2bbb7d9e80f3643721aeef18ef85895b32f9970dba1f478549521727c14fe0939714d0d85d489b449f180bcf91f2475c312a2dca55a3e9e68048d73
SSDEEP

768:BVh4q+AbYo/cZlJ5YLb29YkXQe3woi7/6qLMC7krKTiLOFbHEn9BrJ3MKPv:Nfkzkw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E833AF41-2029-11EF-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423416851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28
PID 1032 wrote to memory of 1680	1032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8adc09f00b2c90af56afa9e84e9686b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7777671af82fdf7315e73e53064a60f

SHA1
be621e5e81e0536db6b15b8af6c7c31570636905

SHA256
dd22d89fdcd349aa6ac7c9886049e9cefb432686fd2ec59f2f9fa8c61e4d7db0

SHA512
f9ca0a0379aac73e1c73d479f58091c318a87c3053f5388be05df2c733358c20100405b2452253a3f804af7cd3ac4cbb27c07e0f6863777fe32babaaac16a859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed630f9822eb186bfef22a123999a2fa

SHA1
0f9d8998d507beaf70c405971a84f289f03456c5

SHA256
3badf62a22917f69aa60ce1d76a84f0c5c35898f1c5bc0b89ec25c932c46b0d9

SHA512
fdab55d86edd441e98b791682cdffe9345d21b9d0f958dfe259bb0ebadb91a6e3369e86830026ac8083c8d35a5b5e499e827f4d33e64dabe1acd284ee8744fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb4f3f3e259fb885a2c203a82471a6a

SHA1
7ff76030af8c820bebb85b5c38b95b8b0ead9ebf

SHA256
a85ac2fe60ece76ca7d40886ee06ae99cdc186e399766df1df30e1ed8dbb91ee

SHA512
03863fa045fe792a975398e6d0bd283f03d4f4c92a56b7202cf167103dbfc6dfb7dea255455ac902b68cb7fd037d10979434deebc4fc29e1e7c42f4db96575e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c836bdb9dccf585099649ebbe128861

SHA1
6fe0be2672ad501d99f195e46df1f2e8b56a6fd4

SHA256
c10c0c96896f3c070fb231cabcd541f931d55b24efa2d25b68c78d6339f8e4b7

SHA512
f7409f91d52e7d2365c88d8fdbe0020e66539827d297fc2a2529a3567eb761a4abaed029ec7b4fe3f2a1f8fb67c7b604c4b10b918873138edbb00f79266c5bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30c8f0fd0f9b546e108a93dcbcfb22f5

SHA1
0e2df1bb7ccf40b2ddad97245be37191276f4e24

SHA256
8b5e7e1cd34a133295ec32ff7da82dc38062ca8a24de25ce094b2430124df8fa

SHA512
6c95b05be2e42b6f38eeda887f0ebc91ecb6ce2f6695b4bb50bbe29f37781cab93365e291ddd44eb395b2731fdb5509d027ce012f73526e5412526cb006d572a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25351633b92c8b6c26b0a0581b9c951c

SHA1
163a5f39e9f04a846820d64d5b25ccb696cdd6a6

SHA256
d676b546948ecbcc8f067a24d53afbbe17b5baf87ccaf6000ecb89d4af3725f6

SHA512
005a0c220a777273cffb3aca8f45ed07a501fd8e2de5d5a5d3a1d8e8f3901c66dcea9912ab82bfd81176ecf444fbedb8feafd63dd98787bda5b6003ac3648465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d1a43a3deb4a50ddf9197de401a2c62

SHA1
aaad31280eb1a521a9ea17765ef7a486bb1558a2

SHA256
27356dea56d259e93075a8541183dbe42765df4945da73930ec1f482bf4ace68

SHA512
b8c301ffb01fbb62c4e684026dd6a771d2e9052a23e922adfb1885f919a223de15cccb0bc2cb0165a30294d7b00d18f50354082d6e6ce8a52da7911fbfdf03c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6155116a4254b764a25d5c7d0410fda

SHA1
7770b5655131d02acc475984a05f0f5ce1e04c0b

SHA256
02d4bdb3e3bdb9535ca4e94c127ebc0b49c6903e88ba6ea9609d891973a9eb4d

SHA512
19acb7f4bf4cdbdd88427392c8f45b25a632e83ddbc1b9a47c312bd9cfcea01f4b98bd9f5ddbf5bdff2698b1de7473cb6daa71916e87f5a1ec2c4f76a9a1464e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e87426397fac9f5f23d46ac033d8737

SHA1
531fc2211f7606ce904fbab682dd9c2996a7809d

SHA256
d3ef6b1071f55301e018f352fa00a8d894cdc53aaf426dab04639cc5528ebfd0

SHA512
874352235b39b37162e7204d3961c4e6c91ee5cd632ad96dd431507021524ed250970c90aaceb77a3276430d0ce7bad1d8c18057d84b6b73d9a587d7564e5786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee60427393426565559e1bce03dad19b

SHA1
d2fb8aee40cf56958d89f80f07aab6588039c8c2

SHA256
1fdf150a2cff9b645ecb01d63bccb8ef9e2f9e539df94588b25a1f533e18cab1

SHA512
37b07bd389435e7a56334fc185e24f736e12267c92e80c73be79115562af2dc4a4c3c937fb7dc5f5a30cb5378e3c359828aadcf1d2ffec8f3d22e5ed9ef4acc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab196C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit