846ab9b91afe33854fa7abcbd9084cf9167810ba28941fba2f48cd735d402a80

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bb1b59062f4038cce3348e8831c6fcd_JaffaCakes118.html
Size

34KB
MD5

8bb1b59062f4038cce3348e8831c6fcd
SHA1

17fd04f223c5f56f391d6626d101a97314faf7fa
SHA256

846ab9b91afe33854fa7abcbd9084cf9167810ba28941fba2f48cd735d402a80
SHA512

561434001c8bf5f5bfb85159b663103abf3bc290bdddc5631b72d0897cf7c5ed2255155910796232380f5ce9032aa828802e5b1c2c1fa81b46cd27c9ce9ab253
SSDEEP

192:uwn5b5n/enQjxn5Q/+nQie9NnmnQOkEntO2DnQTbnBnQOgkfvcwqYO7CcwqYVqWs:zQ/rohP5FtnAldGqwJXfj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423435783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC9AB101-2055-11EF-BAF4-4AADDC6219DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28
PID 2856 wrote to memory of 2964	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bb1b59062f4038cce3348e8831c6fcd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3269f40aa5d9517db7a1ffeec3ccce63

SHA1
f565083983ecea98766a19b5ac2a40293ad44f0f

SHA256
12a0f9bbf8e544a434395dc728eb91d013ba3b16f56855b11831538a13e317ec

SHA512
1fe8837fc77f320c088eec552d4e3a791c47472690b48dff900c8acedc8f144463a2af42202e605a8e56e257d874606eb559cc8962182be499aa007d4e9a7393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09cff16361587daebab2f0b8fc6966de

SHA1
28a3bc44b9e0609707910db3ac79f1a91872a069

SHA256
e478d9d484f3b9d759794db1d6c54164acba51b6bfefdf0839dc50f336775b77

SHA512
ed6b5c65fa42413582d1343d8512c76baa2c89a9cb7edec41989bc67a0d437d03b0e3ddb3010ee0532eaef763cecce20eb4578b4687207b74c7631a08d1d00c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79bcc2a0427f2de6bb842e33685e04e5

SHA1
a85e2122f989ff4977d69ba6102fbb6f46389780

SHA256
394ae16e76d3b0fafff3e2434fb719524313473e2d5ea959be43c67d25462849

SHA512
3e42fdc9dd68f3659fa3b2ceebe9773b5f314ebaeeb286cb0a8f85be044e28fb3473e1d1b15dced0caaba58ef7a3c0593b3bc42cff56ec53b8089b28ad0bc877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc71461c92fb6f1ec8a5cc20ad1dcc95

SHA1
f419adb98801e891c654f7682a3c4e624c0f44c1

SHA256
ef5578cc5fcf8996027c9889bd1d439cb85a11f701b8b4a12d0353145e5c9c67

SHA512
733fbe6ec179d67c104da8a40475540ec2ae6694411bd5286d929ad522b049adc7e948e868dd018b92c3b36faf97bc1bc3f2c798bc648ddcfa45a1b5c09fe852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9143dd38931a0685ff9f2d6a553fda4f

SHA1
e2493e15c51ab3b5f6d08e8bf93790c4d45a53ef

SHA256
486e1a0ed56eba74f155491eb94c42b264fe7b4f32f9c9e4fd1669411ba4bfad

SHA512
74c2985862255473c336209b8c102d0108df6f31a9e7e39602c2e34cd4dc476df1cb823f069b0fc7120762badfa9acd2e0d5e204798a9aa61a348b478a71f250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6596edaca1420bec9e9e9f558b9cb64

SHA1
732c234128674c6ff447dc8fa8dfd2faf7150059

SHA256
c708a2b822c387c53be41c65b565a8d8ebca9ef23e1216df086496b338d875f5

SHA512
7aad0326af42c206ecc77dd93a6e7ec4b6232693605997f82763d92d6ca66b3b40dff2b81d65ec942f8e16d1806ba06b24bfc8d11667df8da83c2c0833b5fde4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80929ee358a62c560f268c2a105e5755

SHA1
2fa5deb6e6da6bca113afbc51dc49cab04076633

SHA256
945057c386a2223e9203280af120ec3d55bdce4d9e3c034ba032092e791a4384

SHA512
e9180fbe7947f104795b10cfa364f411690b4635a45daa98f20d407a13ed0c7510c1bf515b2e46aba055c37e7060d37734ba0795a360f00a20bc8383781e5da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56455a059479f52f2624a143328e287e

SHA1
9c4d06c2d57897aef5074b407a818c58e7b2ba1e

SHA256
077764e112ef9b40a3119f21d9d9b90b23b763e1d90f8c0547a4b4165ac0b8a2

SHA512
8d88b439789cbaed64b13430f94c684f5fe8d560a85b5d0fca417efd57dfdcf599ff410cff2adecc8936b898187fe0f124b7b64ee090077ae8969622b117c51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2719.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit