3e9d27dbd91569d616592f4d192e157de9a25b6855645e00461fe16aec7421f8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b654ace4685cf526f2f54b501d3eb71_JaffaCakes118.html
Size

43KB
MD5

8b654ace4685cf526f2f54b501d3eb71
SHA1

8c19a715ebaad9dbbb69af70256740a972a7fbdc
SHA256

3e9d27dbd91569d616592f4d192e157de9a25b6855645e00461fe16aec7421f8
SHA512

12ad5040a168efdf48da87d43ff5d23cff7b03e25d87d14c93ab3e6347ea2bbcd19e3372bc2bc49597cc2b3fb6599ee47b9c05b8857f44c4ef3cdeca1d156ad5
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslst1FOs/wOen/:K+vt+0U+v5ikH/iOgOxFnYOI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4C45F11-2046-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423429247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1864	1368	iexplore.exe	28
PID 1368 wrote to memory of 1864	1368	iexplore.exe	28
PID 1368 wrote to memory of 1864	1368	iexplore.exe	28
PID 1368 wrote to memory of 1864	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b654ace4685cf526f2f54b501d3eb71_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d2e1b76ece1636a1b181f2fe794386

SHA1
de142ca231596ee097749b9d8f6e36cc3893f7e4

SHA256
effae700066279341b74876ca1c89d8146f6f643b1a741e322af040410ddada4

SHA512
9e1da19eabfdceec011ba6612dfebb5343a56888e39b2d89f133e98b92bb88791dd60f3cc18cf2ae55ace2555edb298477c34d4b33064af6bbd30433741b3e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5138ee331a2ba253094df7c824e2f7

SHA1
9a243bcdcdd1a73222df6a0a85929c51d7d04213

SHA256
8ab23305372af5656f89d356fe1639ff682ea7c5aac6e571b1a7e8a2ac4f37f5

SHA512
4c5c9d87ce84bfd6d8cfd4e3784f85b6ccad88274cd96da473e176c137b1c84de99772d1c38083e506d31ad1776fe5c4490b57279362248ff76ea4641152a6cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab30bd664e236cbeb9a25bf86d08592

SHA1
1aef4e51ae7e8d518dac20bc1f5cfa3673ee7205

SHA256
18ad67e94102a7d0a93751ce86cfd1f451313dab97d3bbfd03d916b2cf54755d

SHA512
57457ce14c3b731d3ec9469f5d23adb9d261f42e10f5239968b00defe3c729cac25fcd0876d8beb305b51eb1468100e1db94ff39f0171ad1b076342f77a85f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b2c93ad3e13b3fb32274a9545baa93a

SHA1
c62a54540af460ff219bb5836fb6a80bf5bba40b

SHA256
be3b050371bf47dd913679cb30cd512d7af2022245577ff25592a592d3e59cbc

SHA512
80f75ce12b1674b23655be8c89a9332f1fb1b0df9d2d43dfbb8ad9cadf3cbd0c5757250b2b4927a3fb191335f8e1d7f285391222d5b12bd7810c40d4eb7187bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
481272533935462b11cc417ff77e6183

SHA1
d72c6b0d8b331d581a009e6d348be4c4c670dfb5

SHA256
61f35a61da7c518e4a7a526e70a51b1a2880fe50ffb8a563980194070af6efab

SHA512
70cab502ce0487f508a962512fcf06b829f52434765a1ea4ec90d7cb48fab6430cdd78f9901164d07eac2112ebd9d74ee0284a983dffed5c7047919605948ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a622e275487b13ebe023e009474ac25

SHA1
c46e8d055666c02d8d8d4aba614a6db6b8c7a5da

SHA256
c871ff1244728741faba5b2e4f18f0da6e9d2444d416415108e03a4624d5f1f5

SHA512
9bea3c87ab7c182a1a81478ab5834740f148b4c4781c872bc9d01ecf036714728082bc7851bd32dd7225d44302a9b7409b72fd2787c5216324993310cc205edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f51124292afef22a309c7eb2eb06be53

SHA1
53c848e11fd7978d0fa472c06c925d48f345833b

SHA256
0778dd5665b38b1b46b045e76b8d5419a67ed1e8c84c74fcd63ee69f73743906

SHA512
ee59cae462ee54f90fdce6de80c2a516d6e531be2a92d7fed9021ed5608f39bac1fdb2f5b940fb3b7502fe8038d94073178e0bcae927e0476ddaf59fdcaabff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fa614fabfc8ccf328342e552a5a29b8

SHA1
83eea9a42094e510655bba6533acf3a203e435a7

SHA256
932954f22730263cf5e79b1f9e1852368a28e83aaa1f5219a3b3ef51e1b5b1bf

SHA512
29e3f28767df984da138563f8ebe08538d458a421c8b82df1a83d0c6876cbeed39f419243130c3e506ca0d8a8c5608c180e2a1531833ad4ef202ce382039c8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8883ff9137187fa1025ed3ffc58304ff

SHA1
f5bad7a559ab9828465cc73b473eaa9d1d7fbfbe

SHA256
4acf4838212f86c17a888bac9a1c40fd3eb8d881d1d834bbcc38ec62a1c4ff1e

SHA512
cd7cbb942b82a712d61377a3f44088f2379fbd17758f9010fe1a29c9a0a4327e7e470b5451e6a11f3c51956d778846488a989afb2a41f89a04c3f9bf79322e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30D0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3166.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit