a5ffedc996f7a70d863acf47156ed4504a5b9bc917cf239480c04a54bc44753b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fe29eee744e2c1d55f7f3d4d6b07e43_JaffaCakes118.html
Size

27KB
MD5

8fe29eee744e2c1d55f7f3d4d6b07e43
SHA1

8d47f759c5f21128b2d6eab0c949fa54003609a6
SHA256

a5ffedc996f7a70d863acf47156ed4504a5b9bc917cf239480c04a54bc44753b
SHA512

fff3aa94cd97b2d91fa7670a55ef5de630c19e14682e29df0ad1bbe235aa5329872fed20a520ea74db9bea0eb73a77ff7ebfabe0c101b2ba57a8fdf5831a7d43
SSDEEP

192:uwzYb5nxWnQjxn5Q/0nQienNnDnQOkEntgSnQTbnJnQ9e/fm6lPRvQl7MBHqnYnE:YQ/TWB1RuSpCCl4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39CFF8A1-213C-11EF-A41C-62A1B34EBED1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423534670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1744	2204	iexplore.exe	28
PID 2204 wrote to memory of 1744	2204	iexplore.exe	28
PID 2204 wrote to memory of 1744	2204	iexplore.exe	28
PID 2204 wrote to memory of 1744	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fe29eee744e2c1d55f7f3d4d6b07e43_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3384f605279aeef3b7583cd6f208dcd

SHA1
6564bd4e0b81832e17f39417705e0bf3249688df

SHA256
fe568524da55cfb805464dfd68079a96408500c0b802d515fbdeb674b061b9f3

SHA512
7f8d0ea08af1babd847303a87a494d64a11e687c4deb83e54d880d3fc575b5837cb17adbd3023ba1855070d21888a2176dc607768a5d3578b2b90840301790e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b1d835154b25ab860e9a4c40af33c72

SHA1
4a8a9e82d965fedf97218196d4d52c5fbde3d2bc

SHA256
be12ed70ac849e5e88acb851a16b570d0fb8950153689f43740b9af6660aa8c6

SHA512
20d781504fa856bab6b6b8a61491161a313c59739527b568142245b7c08507d6bf93b699ecbe1c1989086803232ca840fa169a7640be8574bc8784a4a39b9ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f85f6aa94f5f87bddd254f0d203572a1

SHA1
9e287df4750d9584293c4dff38fd40348b349599

SHA256
7de144b921a015c823e6f45cb8a3707ca6df6e0843578f1a996b4bc6de283494

SHA512
9afb74a21d8651e217f1c79fcdf511b1192b057af31cba869842a2ca31db76c9a2c8cd78c54e01a123c0dfdc2284e7e494543835b18d166c6c6f89f54ebbc289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b99a9352aca237a09be2d33f2cec90ec

SHA1
f1c7acdee1d2aab70c0b94b950e133e90220b412

SHA256
6d1e463b4ffa425a6d9df29b9c6243306c034534b194b7b0157e26b5ff1ece9f

SHA512
5c09e9a7b399a89c717fd3daa5d04fc9a682e62c1c9f6e545684d090f37b6523b16d67e9878f54aac4775e99c7bdc5ce93cf12c3ff94ce3c88456cfc89337539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
309a79fde01819f41471aad6640c2c72

SHA1
c7b86a63e05221b2bd226f12f99affa16dc78b57

SHA256
5ae0bb6b66a0e1b63ba840c0924f9e704d203b8351e8ae76570170b8e6afaf69

SHA512
dfb325119853ca4ea33782de4c8213e371604b803b770b34474e5fd066d2d86272d03fe6a44e76359218edb944d30b65b1f8231d13d6ad401d2739170e38ab64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bc9c8c3e679aab93c3f0662429e7711

SHA1
ccdb7067ab97c0574ae4ff3786e80f9b40f54329

SHA256
5eb0edc6ebca641514d472fa919f2ba14a2e0b0e73c5e73880c37777a25fcd60

SHA512
d38f3a47274261d3ee0e3ffafbcd0214f0b0cfcc4ce1bce87aedfec1b60118d231ac55aac192ae47a7f6358126001265183af74d2452d228c1add9a92c1e64a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd04addc1a19b8fd417be450e74bd4b

SHA1
850f08dafa2d7cbdf3b1b702d56f51cbd13e3a48

SHA256
2f5397b6ea96e0bc892fe13f687b73dd281a37bbfbdcb5d516c4403ec5ad05ae

SHA512
13f867f8c3aa63acd44175126478491050cc99d3538766048ddba56f5ed9bf6955f151f9056007d565d606ffe39399d06684baff0d2d42cd79fc482e03c04d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
585ac2d60eb50c092c2631b402a939bb

SHA1
b70e9acf0e0c7a12ea5fe2baf1fe52e15cf08e50

SHA256
b2a069e457377e265c1c1ff127e94b346c43f58ef518064bb1414f0bd3ae7390

SHA512
b1529af1699398bc4b648aded6c4dbbcaa4657544318f33910d31d79e0e6918732b8c080c3ecc7c705f4ce60ab031e1780d9cd1b45986deec755f8ee8e88a6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e94259eaca4ad8d3975bd9cbe32ac0c0

SHA1
5e11654f25a12e71e763f41c5591889e3f6e2abd

SHA256
7c9a9e096a6833a7c28206bfb854e013c37c82774db075444713aa07b1980d7c

SHA512
df9ee0c3854f43104d95f8d29050b0962b55667780c616afc3549c79b3847d6b3adb93effed610cdd8c67bb19ee74c1fe1a3a4de953e3c35d0cb9a5288944726

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD98.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit