1beed8b242edbfa9cafa6beb57d726e2689a13ab806c8deb849699743841fb3c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2c4a508c6b1626e3f352a1be15b0d1_JaffaCakes118.html
Size

27KB
MD5

8b2c4a508c6b1626e3f352a1be15b0d1
SHA1

40b1f0f5cf6c4541441d6f61ac4de2f3a312cca5
SHA256

1beed8b242edbfa9cafa6beb57d726e2689a13ab806c8deb849699743841fb3c
SHA512

ad08fa4f30747258c36453eb7c2da024bb532328448a9ba680f32ab337394e69209e3f283a0ef9c05eb911435f9e7971e488e5e9681cb5404fdc7dff398261bb
SSDEEP

192:uq8z7eb5nwenQjxn5Q/rnQieSNn2WnnQOkEntpNnQTbn5nQICJVevo7NtJFo+NzU:nSQ/wWeygcq40f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423424067"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B54C57B1-203A-11EF-A30C-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2536	2168	iexplore.exe	28
PID 2168 wrote to memory of 2536	2168	iexplore.exe	28
PID 2168 wrote to memory of 2536	2168	iexplore.exe	28
PID 2168 wrote to memory of 2536	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b2c4a508c6b1626e3f352a1be15b0d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e7c11b100d884f6b2bce995ef52212f

SHA1
d043a8e6fdd30bf3492e1974961b7bbde3e87de5

SHA256
7616682680dcb820a8d7b78605123b3cdaa24ddef55c9ebddf92eb5161359eae

SHA512
e2ad8331f69c52e6e30aa303b9ef0062a662ba692a127e40f54ddf985055c3d21183d5c31d0b867144d726a5ff0de44eba0d6062122ada19a1111bb54a62e52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e93b272348b8918b7d7ecd3658ddb5

SHA1
8cc801a5fbee47ebfffd966c38bdbcec1b14a960

SHA256
141076c245d268632f189650b2c2a32a375857c710798e2489d725ed7854956c

SHA512
f80742126fca20e7f1376c0de660d4e3d04a73b30c7c8283c08b396dbc1df5f9c0deabed46ab1a4866cc81572453df02877a65e6445b93efabc295e2965799f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621959378a437a83d562d56ea8428b1d

SHA1
c8fd99615d65c603a265b6c907bc7d234053b350

SHA256
934923cabd726b787cbdbaaea5ead081b918dbabe0e8a7bf68843fba3e9b33ff

SHA512
f6f061fb9480e7bc7ad24cf643d555d6e2425da34a393018fd2b2e60b4b566eaef14727d4a7831142ef41a74a51ee5f4cdb65e79de9627242469377316cc1ba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4acc49058182583de8b544b1ce441e1

SHA1
9eb54ad1919af90fc05d0e294d36c6789cfdb523

SHA256
ff2c0ac3bce445062f0bba58069fd5062de3885101ea4fba0eb67ff0ce772e55

SHA512
4e9ae9fb19321124e69f189af36a9ea9824bc4c9a96afe50eb1d70a651e79af14e8f13a254053c5325bfcc2df53aefab6dd51ad39e0b6ee07d50eba54ecfe3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
239542d89d127d3c11cac90ee394598d

SHA1
cbd856cefc630c36e17c082d5470db797b570d2a

SHA256
bb797c6a3e4210b5e58c839f492ac60a398062d1b0c7b4d805929f8a49cfa285

SHA512
2885befbd6557d3fdba8cbf7402525334e5836a6b500e850380ed11094a543dabf95915974c0ec89e285c6e4c39a96fdef94c194e2f32704d11c98d13180bd31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b25775746abe5a59d6b6eb3c800d8203

SHA1
3ee6a9919291156f1bcbcbf6a6d88bde58f473a0

SHA256
627db895c99bafa4200c019bda58ac7e59317b5f5d02c6cf427032996ebb87ec

SHA512
3a48675938fa5ad32d7928ebf9af30ed3a7596f9d4827ac86428f630a825406bdda171f716898cb4df72e86cf25f986f9c6daf15ad817bbc3f8ef300e6f16f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea31a92a66e9faf8dd3740d6b77f1941

SHA1
578bcbdf11dacaeea1e56cad28e4b2d0981585f1

SHA256
e9bd1a30e2cac3fa95acab7bd40f444c6b63fe88403bce3a0a934a51fc43552e

SHA512
eb22cc18be27a551008d2965836960aecfba482d0da735413d62f17132ac7e9c3d9595d4d5ebfa5425d154fbddb981e9849fa00e25f53fa8e72b45995e7f8eb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ae8f5d1027732949b3d49799b4d12b6

SHA1
fc2824891da5ecba7b959b81cf1bef14d41fe723

SHA256
9ddcd0ed21dea7742f25356e627de907c38dbc564a52ac84e58a57524b10f7a0

SHA512
52c5f6efbc8a58415a95ae26668dd6829dac1b97afdfed7eebc3ef72b243e8b6ac73fb7ce374fe4be260e743dbaa87eb08d4b9c018ea5eeb7ed2e63844146672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d49b8044f279127503095481b6292b89

SHA1
78cfad88931b5030776db2d4593d7cf52c8477a2

SHA256
bfa7661d6cb4ac27ed81ece9655e05e47430ef4147712249e3039769c5dece9d

SHA512
01c4231177662d5588e7663fca4c658f16cf52cb216a534317128cd14ed4c5ee1a166c3a68a170515e205c67f6d4fd8915b21f8ee6868d5b036eac3ec850857f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E7B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit