82dcf99df293dea41f4ff7a7e69e6916d1f77f50150114edd27275db946c0cef

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fcecd00a455f43772fa84c1db147641_JaffaCakes118.html
Size

44KB
MD5

8fcecd00a455f43772fa84c1db147641
SHA1

3237a99e7b6962b4e623202093d29bdfecf20c9b
SHA256

82dcf99df293dea41f4ff7a7e69e6916d1f77f50150114edd27275db946c0cef
SHA512

dc9dbe90308803f3bd9bbdcafb02d6d03e772dc8c594409268893d70ccc4973fcf619d36e823e38f2d9eaf07a51bc867f5f56d28da48ff16a4fc2622f70093cc
SSDEEP

192:uw7Qb5nMlnQjxn5Q/TnQieKNn1nQOkEnt9BnQTbnNnQmSZxV12PvHQclYPgiQswY:sQ/k4x4wnLa/bpANPqDoBxL06D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3144491-2137-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423532754"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28
PID 1612 wrote to memory of 3012	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fcecd00a455f43772fa84c1db147641_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4a1c6bbea3a09f268db22f6a69f94ae

SHA1
8c3c7b6811101c89b90f4f71ba89f922462fa19d

SHA256
494de7f747e368d0c4d947e0aad32fc6762c2bc27cc4d06ad867076f1e307faa

SHA512
5130c84618f85d43e80bcef319d182d16efa76a6e95e163e39c15db1fdbcd7b71fa36ae65695164f8eb84031443d1545e31de8ab08c9c3b9b457f489024f7194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53cebc49011b61dbd0ea3b58ed60f223

SHA1
4f7aee3f04bf4eaa7c8f9deb4fa7b1cf4cd3d653

SHA256
b519d070fab9beb070bfac79120f4b486c0578d04725caa42a7341b3236b56c3

SHA512
12745f881d612095a866e8faa5eacf9a2ab97a4105c172c369ae78436324be2946121cc1a5f9349a41105d69f79e51afd13024f3a1a1186a7c9c56f1a709a179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7baa847120c7c97d5e2d19b3b2c5aaf

SHA1
53ab63b6b7fdd555e62b6ecf7c498d8312c11df7

SHA256
2e1c4d9c5240437ddf39079721bce746e2d112da839e7d18f263408d68c2fdb3

SHA512
bcaac77647679ae50de3426679b606cc1489fb7ec3a588bb9c0b4869461dbe4398e50a7515b7268fb8f25dab055b2dfda198c783e573976740ecbbda64c224d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a62dd6ad1112b4619c63e4c1527eecb

SHA1
c5550ae9f3b4dc1efe255d4830d3396e750f746c

SHA256
dd4500287ee59ffc53ee401b20154fbae34798112161d9e1fa6eaf2003aa2881

SHA512
291c7b4c8385eace9feeed99113e7885bfd40378cc83dd3a19e3999de91ef485c663bb39df748e231269096c6af2a95d22257d6c59e0b2a7e59e90432607d5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fe832302539d1f8bdca4d840bfcec5e

SHA1
20926934d8a9d82c659888c9b5c61a0df1bde1e4

SHA256
8f91d6171fee79a7bd316de5a7650d68ed1d52be265e8e94cf7b747cd5acdb97

SHA512
4673f5f4363dc09c17ee5bc7331d0601702a192793f4c2d07266867ab910d5a2b808ce0469faf64f321cf2669778bfc226d26fe2fad5348274dd66c43d5965f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
357797c52760d40ff8d023b47c8805c2

SHA1
35d616914090cf7540c2031b2a3aa595f5ae3aa4

SHA256
d0b2ad66227ae6c9f636194172331467015b9a3ca44680792edf6b4e74859921

SHA512
ce14dc7e104e9ff3849e4e4bb0d932bde4cc50aa1a6adeaabf9c5c504d785ccf972de5fadc4824ab18d61c9fd60e67abc863f23100b27bde2331f4c513490ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d35ff3560aef55d75b708897188aa1a4

SHA1
0b5824436a53f2a005bc32c5317cf3c24aa1a0a4

SHA256
c9c74e070c529135f30737f982bf1c18d9f228b0a8da9f8555f7533705f08721

SHA512
65aa3677ae060d6123f117dc91fb09d441e939e01d6c940d9d3a080c1baf2544bd8a87547ef7aec4c912650285efb1eacc33ca18b068e4d518c5ee9c5dd34648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66544dc63c17931706425d34dc054061

SHA1
23b0d85019c7ec2fdfaf246932a8d95e6ca0c810

SHA256
f1ef94086c30c23a8d85a2631e51144c9678acd6c701a49f94013ecc7ce72052

SHA512
876a590b079e472ed4a5ed265d1f2018bb40f17880450cc4be024d78091c7fbe1cf36e444e69f8a527ba701e21c3c248a7cb7a93a6cc7b956b6e2b7943698b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab903E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar919E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit