864e95dabb51eb29fa9ead7210a4dfad18dea18f1d48e255ffeb23ca66e3712e

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c825ca69ab5ce9f447f06b6c18b0067_JaffaCakes118.html
Size

27KB
MD5

8c825ca69ab5ce9f447f06b6c18b0067
SHA1

bb615d104c4ebb40f15ba1883ddb856cf3d0ac02
SHA256

864e95dabb51eb29fa9ead7210a4dfad18dea18f1d48e255ffeb23ca66e3712e
SHA512

8b2aab56f6a20466990e888eec5eedd137306591a4b717af1326a6d3c046dbf3aeec7f357c528fa4b25879044c7c3f5fca6bf9fc192cb1e423a3b9bbd2711181
SSDEEP

192:uw7Ub5nemnQjxn5Q/GKnQie0NnxnQOkEntgMbnQTbnhnQ9eS4m6udoiQl7MBUqnt:TQ/G9uvgco1SOZBe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2701C741-2082-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423454753"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28
PID 2876 wrote to memory of 2860	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c825ca69ab5ce9f447f06b6c18b0067_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb9d3fe52e3ff91551ab1aa9c8b4f79

SHA1
ee60c6dbf3fc8f48937c87338b6f0869f474d621

SHA256
489c9d9694256d394c83998b7e66a6fe11e664abda3e783aa060856e8e156d1d

SHA512
6df8047a4a9a1d80a4b6120b6eccbed63cf10a0010f1df4d113d66db6cbfa8bd2350221d93afe9195a634e268f12297da9a08496ba8ddc1e83c959cc1c00fb60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
548b4a325b2ce9407376846d3df4eb22

SHA1
13ca5ce4a3e979f9ef182f9f0f97d9f1dbd3e6c0

SHA256
95d99bc1955846c3058519d38de088ed42c04aa7b186620d03f81726c844d662

SHA512
e58f724827c4a82c16d27137a7ce81c3077c68c2c72690f52b13798636d91745179103f44750dc615b3cc689058fe8c3b23572cfd50a8b7af65427952ef07499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b837563f0057040a614948e3315a973

SHA1
af6c717e4ecb3ed8ee3316394e947d4dab4519b4

SHA256
8f3cbbf478211cb251832ad2fa4c0d52f591dfbe5cfcc7b0660f78320f0e14da

SHA512
999b563c540cc57daa5ce1ee1740ab505106ef20ed5486cea6b8a3be82cebe05bdae875b098123863314a872d2374594d2e8346b3deaf14c8f9703cd2e572b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e30232f43e8b30bdc18e0b4b8ee3c855

SHA1
4830cf3c1e44c7f59870a515e33ed949451b19b8

SHA256
d72cf39c2fa9123e3d405ccd8cec8a38ddeffb10e75756d7920fe398fb8f1285

SHA512
d6dc64fb7832dd1dc5a93beac15e728afef273b4deab93e1054f58fe5ddca18cdec9bf23e3a1ad78d8cdb77424770f847fe5dad5035856ac3b5e4d827aa6eaa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fc72250c133c85d1e7e6f290140ccd1

SHA1
8e28b135775f039a00d16b28a1aa1b2fd43a399c

SHA256
b2888d3462b2b6d44dfd4dfea038caa0ac790d2110be5c6ca08c3a225ff431af

SHA512
5eb14993ec577c9f04f8884f8278241911420f7ce4a3acc7ade16819eb8558303333f2efd330a5330f34504b6e688bcb1f22e492a4d316b75e72e89c6efb7a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c6d67157bce6bd177e38d2e31815206

SHA1
6a998a21be74d5194945ad7b6898b88ed2a32ee1

SHA256
e3544d91bc9bd15e595e53556e37f224d48b81c8180bb4bcde526f9640924c7b

SHA512
65fd4c4a2e76ed4bc35a83f04787c8259c0f5581a7287d726e01e02551fc3881f01aebb0def2d25e0afaf0f4995ab285e04873c835d815e19b25d37cd06d8a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8149625ab57151c2407dbed7028002f

SHA1
1fae73b9366e34adc12188bce7fbbf81e0225b81

SHA256
122919df5bf828a0c194d425d68e8e68f90767478989057aad2ed124510d879c

SHA512
8430b5bde9f7fc12190703a1128dbd95a965853b0ed28102da75afe72ca0919d30bb3bd6032dfa739de12fdcce81a8c36967ee0027a694e062691b08cec0d8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1366005e30fd9f345ccc541f99271f2

SHA1
08a914fa5306c167e2cfd39a19c89f29dc708418

SHA256
34bafc82c441984203fd3b298391cc8b2cddc68facb3c1a945cd4e2b6d31e165

SHA512
9b431885bc5fc90d9623551c18e6cd3588feaa9f7ff15de4558db62199189a05701e712fcbb74515477fc7b66b799b38ce004c0b505f3e1a914de50fdc595acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
917ec405f653484cd0e04f99b88b3746

SHA1
294bdaef8dc60fb0a737efa6b7193b7644d5e0cf

SHA256
21f73209a9729ac7208a2a4209754e35932bb880a553693ba642d14b26af212a

SHA512
e2c2f0cd7f0100f7540c39c8a757d7b4d0ce0920fed8b76c1933f74791f29baaf51494ae34e2089ab69094ef874481dde48045af1431e50a0c8f5c5972c851cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92DF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93EF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit