70c1924c80829d52b5915894559d2c5614a0306457ed1037f8407bb9d996c0dc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d59797562034a728f9a5b721fbb12c8_JaffaCakes118.html
Size

31KB
MD5

8d59797562034a728f9a5b721fbb12c8
SHA1

e822b8b127f536db89e82279ba6fd67d81539070
SHA256

70c1924c80829d52b5915894559d2c5614a0306457ed1037f8407bb9d996c0dc
SHA512

f7b6b6a4ef6e0eee21b40ea083182e363cb92dba799e3e96f52fe919f27d0dbb89b5bd31bf51369e554b37e5d61b7d017d5cd46c2500e29bb7ff5cf95b178090
SSDEEP

192:uwXMb5nVCnQjxn5Q/fnQie2NnUnQOkEnt5pnQTbnVnQmIwxtOufbfAG/H8XiJyDd:mQ/5Vx/X/HuLKFij

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{562852A1-20B4-11EF-9A67-52FD63057C4C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423476305"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2724	2976	iexplore.exe	28
PID 2976 wrote to memory of 2724	2976	iexplore.exe	28
PID 2976 wrote to memory of 2724	2976	iexplore.exe	28
PID 2976 wrote to memory of 2724	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d59797562034a728f9a5b721fbb12c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66e729b63716c67b6f44382162a9dac

SHA1
b6ca9f2d4c11fe5dc2efae54db5222543ead691d

SHA256
b146804493c9b467e2ebbd8c9b58a0c7029941426ee6c777f6c25dc9e756753c

SHA512
3f5def9a55ff8e35a58439833eba47bd6ae3f7a91db9d2422b3d61b64532df2c164597bbcf33dea442b0e39bd58b399034592b707bea729e9271eba32460752a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad40f55a4494625d1b4b694fde2a15af

SHA1
99d23cc5f2c2c83fc47a598a382df10c7547cca8

SHA256
d5276aed37da58c5a56ccc196735ed7200e0dc67d20a96cd1d5e0de7a16212bf

SHA512
558de2c396e66962ac066eac3bf0b75a262ab16b326a04e88502bddd41ad56bfff6a71882192a468b186e1d80b57448db36b13d3ff9b0fbed5753f535d18aea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78aaa6e8c1b5354b2fad8f2d577bc53

SHA1
0ea3a1fe642671de55a3e7653fc4da938b76e65d

SHA256
3e5535e1ef79f85edbad6c43d87c0e3eaf0f857bba1c9cb78bbc84a9d4382e0d

SHA512
ee25e3fdbcae3745cc663c45951874331e3efc1b953b08a07ce02e3e4ecebde245b057f335d6a86be738df1445d94376317f93eb63929050587355dafca8b0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4c6299b3a4ecd26de5e853cc7a691a6

SHA1
f4704763a26c2029da635716758ca33f3dbf0de2

SHA256
949b814d239ba3eea1bf32be9871a668dc47dc5841f87f2e8ab3e7327709b32e

SHA512
f455679767928e12ff30e66c48f5d647cad36d65fb7ed0d28e31568ece8ad58a6bee35e13519f947d621b2d4515ad45f84a6d44f01bb45a57244963ae2d703f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5e1d3473934306513871bf26d9967cc

SHA1
cdc18ad10ea922f19152682845dde70115a8ede5

SHA256
e4471011a0233706576923a171c7b8c4161d28f5f896fa5741e42e09eae84732

SHA512
05471d591cd708b4f5f01738c5fa8b0b3e2efb76d3f9daa729d7aaf517f2b036eec4331cfaedbfe424bce0e67c31690b092071cb7cff7bb071bfac70cae076b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06444309fee800a0dd1ab68e98994712

SHA1
4deeee46da79c510e1d4dd18eb9881023e9a52a3

SHA256
43508f24763a8c70ae8c5220e74f0a6388d9abba70629a97656d66b7e35fc923

SHA512
ae6063396c3acdd9a509da0dfcf7211d4f0f37e6cae3461b7aa0458711e9a6eeee70bb9ef8a7aabb37d9b0cf151f6fe185b70782b657730a314953954f297ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc14c42e381339216189aa9aac257c87

SHA1
033b52699c125e32397af392f2dda1c3de4d6184

SHA256
c2b5237d80d1423a97cdf964a0142531d66dfc53bcedeea4d50a291a79900e23

SHA512
3c52e940ed07c484180e5b493e43ffff8ee5d713c57232b1f5cbe7674d87f754302456b505c281e7570b27c78e58ba214a28a9f66de43e6d8d3eef07a1f75590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceac2bc0539a9b64e1ef1b13654c1367

SHA1
a1be9839a99bad97b964de19f7c158059f600a03

SHA256
605cc3d50ecae13eb674163d30f67d9111e9714cce485637f8543de79ce25ede

SHA512
8f3f52198657bd47d3ac061d68792fab5f0f2f62960b69e942b2124aad05b9a75ede0b3575a0bc0d3170e88914e2e2b4741dc31edf247ed1627f650dbade67e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db21e50fdb1ab7546b80a42267396b1f

SHA1
edb8424835b75a8cd9fe91ceec2f51890eb22619

SHA256
5c23089b4dc17dba91cb8d021dc2b85bca1a2fb47386b2a5db53c9cadb72ba96

SHA512
7f5774d6d77bc4070581874bd6b340d01b3d4be827cf49d20f58a4bb2e6ff325449e8df8a661fe882544376f4325395f6a5a8ee7da237dd8b8430edd98b8ab46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b434d8bce68dff7b34e43a8c8ebcdf

SHA1
f1b8c1a6e14dabe08821563fe98a322fcea01c87

SHA256
b61500e72581d85ce79c6db6e58fec80f5f37b4f9c527f7d185aa742294152cc

SHA512
81e291cce06eda62abecfc79f059a124970a74a7fda3b0f5b7fee88f315f8291ae3d0990bf51c274f346743d165d5553c4eb537a23cb0bffeb161d1f28076c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab485.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar519.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit