fd617fdff3cf37ad7e246f535b424b2b9d43b39362ff0c06c2575e3d47e950a9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d650e3b88f4ac736bd0074a66228fef_JaffaCakes118.html
Size

23KB
MD5

8d650e3b88f4ac736bd0074a66228fef
SHA1

ea72cfc98a9cec75f7e59104233c37506ca76a4a
SHA256

fd617fdff3cf37ad7e246f535b424b2b9d43b39362ff0c06c2575e3d47e950a9
SHA512

a046b69afce3d618e975b710dafc2ee34c23cee998b22ba5405d4200f084ed027c32c1a490955002e5be73cd60bf8d3171111452d08cb77baa543a21863e844b
SSDEEP

192:uWXhJ4mMb5nymnQjxn5Q/ZnQiemBNndonQOkEntzznQTbnRnQiCnQtiJwMBGBqn1:7Q/k2A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423477296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A43DB961-20B6-11EF-A346-76B743CBA6BC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28
PID 2028 wrote to memory of 2016	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d650e3b88f4ac736bd0074a66228fef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e2ea6b3e3a6573eda49e9fe6cb0d778

SHA1
c1fd3c914f5551e74471710a5d0b36874db71e6d

SHA256
2923c6c99674074a236823f7b2ce6d6b37c996e9a95a7b351ef0548945217abe

SHA512
f30eeaa0777366e45755b6153dd272f86fe51b6eca5363cd42c577f7721dedb86e737a3429544cc7e6176cfec1ec2458b031294958901f29586dc727316952ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70be03de6da7d001f62f2a312b05dede

SHA1
47fb6b395939a174776eb2aae31b0fefee4ed079

SHA256
2bfad194c4ecde349dacd8bd51aae6119c77605c44073a41ea31c09e980f25bf

SHA512
5e9811cf7522b7ce9607bdf858bc5ed88215687082c5cbd63bb9e8cecf98ea8a103b614669432537cfbf7f180eeeadc8a44786572935512e95fe57a8a047e946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c58f279bc6d0fa1584d20e6ee0910b80

SHA1
b0481b2facc46cad7aeea6398a5e56f40d91bad8

SHA256
6fe0bc80016306d78f09b7b83e34677eb0ffae396f074442c16b8e4f774a0f34

SHA512
e9db4fe2e8cbe965c289809553cf526c5636916a33f4c0787de087b53a5cfa71b1accd194f647c97ce531a9fa0d8a8bbfb98f028f3015a2f056467bd15289578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c85360a24cf7972b2c98555ae363d6c5

SHA1
c012c64653c83766c27b93b7406a780c79a70ecb

SHA256
f30b75c323e76a49bd3f2e153d05b85f149c3f39b98f87afcb246724ddaa42ad

SHA512
115efea7f62fe9f830e75b07b29f49e72188f92e400a4a6b7e9439e84f782a087bb34b583c80bee55730098b9e81f07b5ea3e1d514db73ffc44339ce04fcac27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0d2acebabfcfcc2da75ca2a4129351a

SHA1
e145f4f1e002fa6789fa2d02e7b5a2ac98d87ed6

SHA256
c56d31badedf5b530ce2eb4a6be93af5a64c314d9294c708f6c02f025f3632db

SHA512
61d097668a8429b6980916bd0e0aba5c3aa020b272b48761caacf41ea568f7b6fe1ae1c8f94ed0e76801a8264a25f1b08c75e9862797605dcfe712fafa536b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f703c7c40c8ac5b99d58b91d4ff601e4

SHA1
b008fb438bbb0c4d314b7e18f1386c54ab015707

SHA256
ce33240f8e74f7882b37bdadc003ff0428c7340d141df9cb6c8061fda0b7ab8c

SHA512
5e05fe140bdc61ddbd9856e7b0fb4e6fb50e37998ab67351d3a4bc94257a5898d94a5c643b4c974a7be7a5e90d092f6152056ee2b5b4a55b49928138f0e7e5f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3761a2752ad595a0967873de560b582e

SHA1
ec709178466f37f815365859a103de90b705988a

SHA256
30d4dd531ffe9c7773a8d6e1fa05a4f474cd620549cd813c189502e27899abe6

SHA512
95ec8ad34bc05cec056374eae16a79f1b5386c6317e8051f4b9abda6f125bdbd893fb9ba69551748033a96b9bbe01f65eab269b6f8933c62e534a9ead2da23ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86a4b2f6f3241b23ebac684aec00f54

SHA1
246b43a3510e18f5023c49bf4d1e42f9ba345339

SHA256
665ae0023ea865693e96c6048b9c85c9150717fc0edb1c7b0d6572e638bc8972

SHA512
e6f6b57b2fb9236ec239da22342c54515948064931a75ca7834fb29fd30f14e922d444dcae023c19e19f2656adfca543f0da1fd7bc7f56a9cc8e8c499db057d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcbb10e783eeba35581bfdfec505847c

SHA1
3d646a941d11fe55f9e85dd6063d1590259ee81f

SHA256
b9154e3b312201a23e538537374b9d90466cf43c783e1da5d769749d4c204480

SHA512
ae457d656fbf69080b18857921e9780687f87d26ab7e2eea8f52ba2827a58c9109c07bb6f6e91780bfd14f857f3c42c07f1102feb8d68c19eea6339b1c869843

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab428.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit