b7a3404ef5c089c0a682006d421b826e6336cf126f275930a7b7f14f328388ec

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b7d7362af324d12d57c46ee2bf6d741_JaffaCakes118.html
Size

36KB
MD5

8b7d7362af324d12d57c46ee2bf6d741
SHA1

22762abba67723eee664f986f490d3cd7dc0a42d
SHA256

b7a3404ef5c089c0a682006d421b826e6336cf126f275930a7b7f14f328388ec
SHA512

32d9775dc120a0dbfc034214c849b903664378183d789b80366e1d2e09ecc4cdfc378f7b2d185442745a1dc31d14a32f58b30fbdebd9dbfc0e42ddf0618140e5
SSDEEP

192:uWJnXgyPmb5nY2gxPjPexzaS7xzWnQjxn5Q/manQiey1NnsN5nQOkEnt88X9nQTE:AQ/ZOlXCjbXJqyWWsNkJHnS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9C4A111-204B-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423431375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28
PID 2368 wrote to memory of 2560	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b7d7362af324d12d57c46ee2bf6d741_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2878d7760c1de5f4c64179d56545e74c

SHA1
d5ef7e6b052b996745b217f2de4aa5eabf4266bd

SHA256
42cee1b13f032416b9d8e709ad73f24609d56b46000dd59c3f238f1fb4042de0

SHA512
eccb970b50ac7019cc20132bb4dd3a5aaf3c4eaf33d7871559a2dc135f3cbe1a77195258ba56fa6f8e6019261dae8ed05ba5a9f43c3f5421f0eee389dd568962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05cd65ee49a488d566d44ed201088d35

SHA1
d8406e420dfa1bd8de8f966f36c6c2aadaf37318

SHA256
b675ea2823167284826cb6e93fe248d219bd7ec302f11fde7e69445f7eee4d28

SHA512
f60bf8649dac7e70633073802ac8326a78ae424a0818ac34b51c527fd5eb5ef1a147325632a75fe32cba09a212665558b2abdaa0ccec33310c0e24b354299f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1edb6010ec837901bffe5a9f6721ded3

SHA1
8df2548fefd0c82c8cc8bf3ba2886c2a9783e1fb

SHA256
ec3ab963834bd8eb9eb4878097463be2c3386d7832371e5dceaf85a16e4f29bf

SHA512
a323a58196ca574a7d1a4777354eccd11e0c923c87d5b9853b531c0888f93b038854366aabf6e3c7e8c8531aad39224e41aa2bfca7999222ddbc35bf06e44639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf19c61d7b5b7f65da3ec300f57732e5

SHA1
a86a23ec772764258e750abcdebadae2fffd3ed3

SHA256
85f3dd3510dfa5780a09a4e678aa48fc3ddb0a2f8bd8633c8c15c585a2230e0d

SHA512
78f1c5de51c4dc1b8b7afc8941223cb25d871b6f44ec0a1f93daea99fe0e05f1c544e29a35edfe92aa25b139a1ab2c500e9dafb2dbc98829dcda9c93247919c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8ab55dd8172ee5f9a95e0854f4dde50

SHA1
642144a9693385eb90feeaf816b739b4deb2d7d3

SHA256
f1ed646ff165bb48351d889abf9a0898e4e8660971b256518f69b2e4c54ee0fc

SHA512
c2ad19adc0568aec81e6bfa37093d2eb802927d7a266227182cd878480cf108bc9b9bc7ee4798ec59bf7b88ef2a66a30872f12c04d74e938f26a05ce7982dcbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
221b3e703c6d175a9c96868dcc40bc44

SHA1
c726bb498e2abb0b5fe86e7fb73fd4e2df47c50c

SHA256
6c389767d9aa754962e26cc58f84d9f6500dec30a06910b193e455873165e1cc

SHA512
f47f609dc0c1ab7367d99f1c3e38e85aa53732c05ba3543260114ab1da04356cb48a2335fe7fe9da9a7b3d319b1dbe39bfcb26bbb91c0e8c703bfb12d5689487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
311bd822657c0d372361381a361e323b

SHA1
967628fd535ddd93f0d5740baf6767f62d85b90a

SHA256
a985ed7ffb24ee99aca9332bd37d13d66a3f87da95bb01b97709c3858ae23d4b

SHA512
d4a686f0bf8f6fc17612032ffe9b4dd18c3bf6c4299ae36f205a3b60048d288c98963b61935f37a863eadf07e2a52da5c1a23075505322ceb5a11057923669a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed8460bec642dbd4971dc41279ae84b4

SHA1
cf78ebbaa1892c8fc79a00958b5ef30307dedaf0

SHA256
cc234c0a5e131c77042247a4933ffa8f73b7e321e6c3a918bde7a0ea84ca89cf

SHA512
abf2c315ef00a84d522a9c7f2b7c84f8ba19c2b8ead1f89e14917a576325a7b4ffbc495eb0cb5776a76beb1f6da72194d44e34985d06bb55583d5ffede9610c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3056.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30D9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit