4bb663854b182ab6638ae8c8253a1a98b6f80e63e3bbe00e18ae5cfa46ffe958

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cc8364fc1828c5959d474b69585b283_JaffaCakes118.html
Size

23KB
MD5

8cc8364fc1828c5959d474b69585b283
SHA1

5b5e9a38b95b4b765a90994451e3ba6b2e85aeac
SHA256

4bb663854b182ab6638ae8c8253a1a98b6f80e63e3bbe00e18ae5cfa46ffe958
SHA512

b0cfa89020f54e8060f81c97e3b23c4dbb90716798b51a9b004cfde0a12ed43ecf427a3688cd82454b06e063dd8d2e25f0e49f762df3beb3a84e0156a8349794
SSDEEP

192:uW7D7mWcb5nqunQjxn5Q/lnQiegNnRnQOkEntDPnnQTbnJnQ0jCnQtKwMBAqnYnC:7Q/Rqq9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{206B4E01-2092-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423461613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28
PID 1952 wrote to memory of 2508	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cc8364fc1828c5959d474b69585b283_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72a2f212ad057652cc68e48478e42810

SHA1
8dc43e83418cf46d09689463df19cfb0adefdc9b

SHA256
b9a039fbc3971d1a56c3a1b2a158d096cf4d1b50254071edd3ff44e2a684f984

SHA512
5afe0cad44c133f1b2e093bdec4a1e8be1db236c83f808de1de140cf3d52e6473fa3d6180f3206416d2caf6008a397b6cc1f33ee58fbde62422cc7104b046bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2516af7632adb082b28543c2178c2c1c

SHA1
3e2f369d84aa02be6bb6cafa54e7aaa2edbb62ae

SHA256
f43ceb139737e1f66b040ef6f53dce316efea58af03ad4a6bc4c5ccd85138405

SHA512
e9e615164f2456c7fe8a9e229585951eb80cbaeb5494231fbc68cc3021874c2eff65511fc23ac4479bef9007dbbac9e5018468216c299fc0360081042470f52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
404241eae8b270179b794dd1eabe9b05

SHA1
e26a652738d151aea78887850cc6f15b44d4d5ae

SHA256
bea62bd30b94aa57568501f7ed2d853ddd05d577fdde9b3b971d3edae36dae45

SHA512
a14a59f0158174d46698492cb6d59a90e2344de1953ab40f18cdd83ece1e6c6cfcc4c7d52080c443926f76b0b5db839b30f3424ace4a348b3e4def031830c0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c6871508ca7e054e4396fcab27cd1c

SHA1
91748e21d3d5357c0c61993f63c9a04082e6df32

SHA256
1aa441e1846958473a7007be486f74b753f7954836526c1ea83c804c8846ed27

SHA512
7039fce012790909472eb24c535cede5d76c5ab3c68335c5e8a1c310a0c870a76d8227f0733b03f14d841378cac8b28e275b33b548869eae53ea9abebcc0932c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88d2bb2e6fdfc445af01993fe3168b8f

SHA1
a6b40e2ae0ab2b6dc4237a354a6d5ee8436881c1

SHA256
8162571c93e1e4d93f6804d85ce7e6d8301c1d8633d2f42b2dba33f4b40f8b9a

SHA512
ade51032aca34f3f36bf323c8b0765e92e9be5d426bf1396e479a658199e3a6cc919de7dc76c5aac6766a36919bd7df64f85a3409bcc2a8f8017a355318fbcdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bb539d3faace26db82f051e7b0ea5e5

SHA1
4511cd77cffb0f5afa3c31abb47284a5888303dd

SHA256
9c611a7b8a278183ec79578901bbd131fb7b610f00a8d7601267f0e1bce65029

SHA512
6ffa4d71dcf630539e3c3c6a60a1e4e127e9fb7715858e468debda4c2fd5652ff275e0295e1c975c62d3533de919aeeed728853a7f03ef3152684448001464e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a63d2b71a4f97d25c697d6ea77a57f6a

SHA1
bd0c4fde8d9b9ad2b141e103e1139de4ebf749ea

SHA256
4252a647e0028f1b8ffb41a62aa573fd299c44980eff2767c64982bc3840e4de

SHA512
e5048253f51f6ac3d99c0501ad01400bc0100b84be3648bdf90de0e636aaaa0ff2101f715761478364a429d1e225b5ff065068a0ef15136b3f97a13403e158df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e70a8e40ef404ae2d2103016f115b6b2

SHA1
936846bb11a65dc329a1d699f7d3efc8953c11c1

SHA256
ec0d1be07d8ea930fa79e5779cf329abac4a47d8c25f8d954c905cf90289fab5

SHA512
e99de44e86d1e4a5f14f1c01ca813342da453dd1b62a2ecdefc65fc292cfa2d6516c1fcfd82a93f02d9b1de124f71dea64b04e83f36eaf2a510e95ba04719d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit