37e9e8dba86bdb91d56e93eaff889249c1d3a017a8abc723f077ed886526e81c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c8b3a68604bb8791f4cb7dda3a67fc7_JaffaCakes118.html
Size

27KB
MD5

8c8b3a68604bb8791f4cb7dda3a67fc7
SHA1

a103704bc41acb989017a55f17a253324770f881
SHA256

37e9e8dba86bdb91d56e93eaff889249c1d3a017a8abc723f077ed886526e81c
SHA512

b2facaaa560eba6258b969e314c551d1879a05a7632ae2f0b53da8fcd95475e7ec52cfc4e64f582a0ee32b7b759d6d37d20bb2f0c92e766800f81a89834fd6e3
SSDEEP

192:uwfIb5nFWnQjxn5Q/8nQie/NnznQOkEntcanQTbn5nQ9eD3m60nNj4YQl7MBfqnK:kQ/HypMN2SBKI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDCB9161-2083-11EF-A68A-46FC6C3D459E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423455542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1748	2216	iexplore.exe	28
PID 2216 wrote to memory of 1748	2216	iexplore.exe	28
PID 2216 wrote to memory of 1748	2216	iexplore.exe	28
PID 2216 wrote to memory of 1748	2216	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c8b3a68604bb8791f4cb7dda3a67fc7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1d3db68d620c90b80d14c885af5ea5cf

SHA1
22053b27c7eeab71b41d0c115b03de604a56f50d

SHA256
ab0ae1511a8554990470c866d055aa218e82e91ad3313a541953446d5fd58e5f

SHA512
f4fd7cc66d7fb974e32bdd50ad840c8fd0a712b141985e4ce8a0e54edad2001bb928fdb52e9bc08e7c28965c4174d7ed5313bc8f1450eba0a4bd7d9a38a88af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1a288314c7d23b70a2509f62f83ccbd

SHA1
9bf6ce8b8d9b473ee70518af78de9f91ae9c07c7

SHA256
8e3333b0c89aabcc74582abba932d292d06a00871afddc8e6395a97a98511e70

SHA512
67b50bc6fdeed63339f25ff05848814d3d23b5f57d7394edf5d9927fae2c7cc5ed225acdba1a8fb4089b958aa46c1778d49fdb4bb0bdeb1694547685ee5e0a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2f742480444ad8689c2564478529a7

SHA1
be379c6c7517f2caafc00015913a8d44c1f852a1

SHA256
066fc57552667081a10952ee771120d9a6561e56e5e66b8027224cdc7ef80657

SHA512
7397dd0ac8e24a7d5c01a9766364b7dcd31037a62f5b1c986b24a33eb69e15f3f2c9cce6e66b453a320f67ab4d667d51e8b3f1917120d06dfde8eacd1ba00bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cbcfbc3c3537733d9e4ef892e53b206

SHA1
bea1d6151f8dae055651f294987185fa029964cc

SHA256
2c161b41df9d74a8f4c0da16690ba1f3fd135bda042880aff6d4083bc200f205

SHA512
29a5c317510150edaa2ef39c0649829f26191be3f367315a9d411092b1379bc6b0e7cccff34a80591dbe920e44f15ecf2665d883211ad0bddec87e2de6d96254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f7357f085440c90f9e369ac4ac6aa07

SHA1
5de243c6254b048740a0000ee756b185e458d706

SHA256
80636a5684f07925da8bd7df9cbccdd1ca5d04e42d0d206f5d72ae519ad106fc

SHA512
fe3090418801bf5ab15c19bbfd2b201ac156f6bec2e4dc6528619818a3776f4d94168c04662d488b1f7cedda8b64527e23523b26737e025d8ef1fc2318ad9a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66759a3a432df8ed38b2b0494474ecfb

SHA1
17bb2a3e30411fc23857ad12f88865fae08b7ad5

SHA256
25c21f97c5cd6288dd9312d6b97141d19728040bc215dafed581408bec329eb8

SHA512
24d03c9eafe72d3383dd322bc42d87b77555ea20225c9169d10c294f436b9ea4df6e1cdfe057be17d4044b10b2175878df2995b782e33c0cde5e6072e9bb4e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5331d3b8c2846a78919a42e708d02bf5

SHA1
20075d2f23151e42867f3622e1d1bfc1d37aef6d

SHA256
44e3fe56227933aae9e5fe98da3ed93a2a67aeeff5bc28f279b662e283ebf17f

SHA512
a256b8c7a975354bb1d2c87a41af577a499effebb6e68f947930593e94d9990e6547128009992ab3f16a3103945036660a505230bedd852e79d5d65408182088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f62e6f73a33b56810ddcbc3c6a0ac79

SHA1
f49a5b7f3047a1edebf59abec997f26bf3397bd8

SHA256
ea665c85b6346a3d7705b5c7ea9b7d89d176579d772dc614de6f1adb23062f2e

SHA512
fd7032ce6f84055a451557e4266faece15608590e8089055f10e0331fef392a5205363be53b87830eee32e761ea6572ca6ded450bb2d7feedacb4b09683276c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b27974b7492880475241af2483321a97

SHA1
488c619cf69545afc4e8e3659ea6548ce1630961

SHA256
19fc8710a340cbbda114bf7c0e9f5b18dacf60acd670b736b00b52cc6eb2a04e

SHA512
f0fc57863286f04fbc7fd15d8c78981f5b4ce973952c0dcd96e6f162985adf623c6354ba50e54e038c16a7b57f1bb0a7099d6478c1378c9d9cb3313956425f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201cd0369ed1e4bc35a9c512506dddbb

SHA1
a21956864a1f945e08b42fbb0b5f375f98e1eb5a

SHA256
e4eea6ed0979ecde2b90ae324bba3ace826ff01e850a2f558303dd269bd5217b

SHA512
541ab5051a1438e47655fc160d18bb0c2469965efeae648225d5ed8707b6bb1f4639b4c868eaf3b9a04f9153b2dee21d3c5f7366323a9b446f8e53f0493cbf4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8b5a5658b53fed10527d9dc6a275c576

SHA1
ed3740d775b22cca758e1bfc65292ae0b717eb20

SHA256
50f68a0c9d4d266da09af73acfb6be35af5ce604c2e8732443004c48f8e7331d

SHA512
b81c53bbe6aceaa41b7adfc88b5acc52c9eadb3b8241006ba2bc68ce209aefb542a8a441666c1b3a77debac140a5c223de244acc60fb894c33ff64fd418c9693

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit