396a3cf78afd00bad8ee838858d01aaed679fcf39c225f84519aafa6ffd2ca6d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bd22e131010aa1fedfa2b56f43a223f_JaffaCakes118.html
Size

159KB
MD5

8bd22e131010aa1fedfa2b56f43a223f
SHA1

6552e3361807d5c0a9251f22e51457e109f446aa
SHA256

396a3cf78afd00bad8ee838858d01aaed679fcf39c225f84519aafa6ffd2ca6d
SHA512

fb9f992a7e3d883c79ac3d1570ddb019e387175fdec7629186ab51bd6fa8687f7b6076fc51521251c9d93e79a9c067578e6c586348ed8898d4204682f08c270d
SSDEEP

1536:3d/X64bdL0lyDNEFO2P1EFQEFaEFOEF5EFxEFVncVa0q6050b3C+UJjdw5owpLWY:35dL0lyDwwg1UBdw5owN24P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423438612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92C29B11-205C-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2580	1868	iexplore.exe	28
PID 1868 wrote to memory of 2580	1868	iexplore.exe	28
PID 1868 wrote to memory of 2580	1868	iexplore.exe	28
PID 1868 wrote to memory of 2580	1868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bd22e131010aa1fedfa2b56f43a223f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ff559607ba3fbd57c2b547211ce097

SHA1
eb58589ccd8f1f731b9ced4016a01fa3c60be025

SHA256
48e9cee05a23044b83cd013c0ed9ccc522f377f0ebe6fb025a5475d0d7c8e78d

SHA512
164d7251e262d8d1b64f39fa01e1b582d181702f9c4f857baf615cdc021ca08f944003a9c921db74445ecd6296bdcb5cb70c245a66e5230dc172662582891414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc6af42dec4c08977e5c75935d6f257e

SHA1
4312333daecc6406000b28477a93882e8f4c9520

SHA256
4f62a48a16ec448db55c5a1e679b62b87659fc91422aeb8dba7b8ebb3cb89e6d

SHA512
19222db95dbeef28bfb01649fb49434aaf5e49443774ffa768f958e19980127f8bdb1e38cb2f54c47409da11e1ac1303ff10cea2a684e20800018f91e101493e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee4a6fef1ccd91b214ed1683013fddac

SHA1
6edd737d836bf03e600fd3239e201beea56754b0

SHA256
47c6e5b2e5b5be69b8665f46c445b8123485daaf90b4e52866703c6da5035890

SHA512
7c284297640af1360ee6723e35f203d573ea21a4fc42106bfbb8ebe424c6075df8d27bd430a8ebf4f8e4b05ebd298466918186c970b86c2052f601e77c54bd24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a528bf22f200e0418bb8bed8b67b674a

SHA1
011a5bb402c904e58cfd00d815fe8ecb45508b08

SHA256
ba3c43f3a4eaed7bbcc6e11d5124c93155b3b10af115837e596190a8d156a29f

SHA512
73bb94cc947c19450278970435707fd9067a711cc7a64bfab4d77c598bac15d87a674189aaf247438c8ba5737aeb148813dfdd60ada36f064dd11932b808370d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70583b11ffdb31fab8c998c012aae2bc

SHA1
199c8eb8ca8d3774304a9904ac1097b965f9d22c

SHA256
2b7b88cf396cb7b0f0acf9af1aeeeb7c72e1b137134eb11db532cd3772061a01

SHA512
c4ae56b36839a43eb160221b49b783a30937c29862903f761da9ee82d975f85094de67857f01c2ec9ffef7e442a23df36dd7ae5d5f586460e6bbb646d10374b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
555e5038aab01694fd5a3d7f1fb4d612

SHA1
98efc6e83c16057e2f3bd59a29acabac12644c5c

SHA256
3046dd1d22c597faa07ad42abcd4c709d13371e8236b4229e9e68e45c5e9710b

SHA512
a77a5c2471466bd5c62988d2a5cbf46dd54356912d641c5d25fc1a1f68b350a74541c6211e76be915c45fbab192b47cbd868e398055ccdef883812e644b7219c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a10b82d0ef9d526ead1fec76f0c1621

SHA1
abb745bc1227bdcadf5dd3ceb6a2b77776d1e735

SHA256
4db2a523afe248fae55879749a2e447b70aca0bc07fbd901d193fc551550ad51

SHA512
9ecdbcfc590b581c2f032abcc9fce5dab460f5e7bc7692f87af070b91aafbaac3623ad8c7ee0a74a9c8eb55faf12713c31b0e85ea49419a761ebc3d2518c5f21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37d6c82b5ab2d6b9c1cc17c4d457acce

SHA1
e05902b9df3ea416101e77743ef00ca943950b42

SHA256
08c53ac5f4e789a0beba956b4f82029526089802dc0e5c8a4f2172dce95f419c

SHA512
ec3e48b18c344eee656467f9c49091ecf749ea45a0790b32091c71540cbcd99d93ffd0b4250def8976748e2922199513e61a2255e49d4b1af09af5b7ae1b09c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37c1ba8bc7653e7562be1a73dbf321a2

SHA1
092102ffe4cb7f3cfdbac93c60466b5dbdf47a77

SHA256
6934c5a0f5215433b01d0ad5313d8b92c918ec679484ecd7cdf4a888b305c0df

SHA512
6603835be27f5bd7f564b553284b6ef0596a062079346a347b3ef90d9b28b72dbb2a4b72e7496fa140ec6c305cac4d0a21fed95b25e8357d17a32d9e444a90ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1739.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit