1cb27175276e5559b876ced5a7b61bc5def5837ce07b212900e5b6eda41ede7e

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dffdeae2843a8c36971740a70761575_JaffaCakes118.html
Size

19KB
MD5

8dffdeae2843a8c36971740a70761575
SHA1

619c023f8c9f8963d9ed2799c54520daa71e3d84
SHA256

1cb27175276e5559b876ced5a7b61bc5def5837ce07b212900e5b6eda41ede7e
SHA512

457456374fea83c5e4e0a66b9d10e576a89cf93bb078fe870c8b73ace8144db2f468966699ff151fab86253626a44c42dfe1a45dc7c2978f779aa02374a54cdf
SSDEEP

192:uw3+b5nREGnQjxn5Q/0nQiefNnPnQOkEntoenQTbnFnQmSgHMB/qnYnQ5CNnlnQo:tQ/Eq6qV9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7ADFCEC1-20D7-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423491400"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8dffdeae2843a8c36971740a70761575_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06b64df5fee83c12f5c89b02f9e89b16

SHA1
b05336ec21aac36792bb107b76a62fec6c22cf0d

SHA256
76f66aa24e826752fd1e883eda9400174c75c88dfea11438b1593b2faa086bcb

SHA512
60e79224ecb707e069ca4181c269513c8f530f2783a065d726ba2e0aec98d2ee9b9cb4907856aef7e1dc89a244079853f4aef898f495d1626c2c7453f92fe176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001cc0992a770b95a1b76c5bb5aff3f0

SHA1
881074cec77639c8978920455bc143190c62e1b5

SHA256
8cf5232a86f9d7ecd916bbe36b58193ef9e3324206a3062da61717fb8811352e

SHA512
72ff20d7a275a09c7292091e5e9f6debebb4e39b5e63217524b088c55674c09c62eb83e9e7216d586bb7dcd1169a44dc0f0daa35d0e8a1835f78cdfea721a865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf8883802f2e5d5ef39d7bff19c3db50

SHA1
4c408623b2de2ab483928aab59c79aae33a0c528

SHA256
0119eeb5dfe06d96b12eaec1c58b4562f886b1ee22777ae4dd10cecc0f2087c9

SHA512
442a37042ab9efe0dbc054f33dc79f0284498ea1c5f717db368a0552dbc7116444c667a0b7803856384e04b65a5a807eb225ccca99c816c60e84e2f60768fd8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b2956cfb275382f716473d8705189b

SHA1
40f4e0ed3feb5832ec4114742484c7d8296868b8

SHA256
c34d2948487248121c8bedef3e03bf46cfd9b068e967d65e8c82e23e68792846

SHA512
0fba645860e7d12ffd1edbf2a2e5c301f539937e5c20b84a15fbea992701b159b54bfda99906bc12495a54c2d4623af9da2e90a3e65c8999d54d9038767b04fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f1c9ba0e50d4b9866babc60b9962f4d

SHA1
91c47e0f4ab06dc72b631b4b0a275ea1708b4429

SHA256
9cb52310bf2f3ac360baee4749a7bbeec3e3e1bc6a218f409ad331020a47b33b

SHA512
af2ae8580448e791f07a40db67096011fa35fc99d191f186720f412075a823d49994a10cccfd2a73c1f89d4551c2618b4b3874c44bfc6a24b3a2735ded98f281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c106522382b2cc989a7f5c0ae41b9389

SHA1
5ebf6f8724cdf4ceb054737b348b6d81daabf3cb

SHA256
83b446a0e06a37635b422fa09c0eeedd9c33d9c465629b5dfe908f5c1f35ad1f

SHA512
5b05745eb0ea8cf5d829c02a75168196ab095b62e942a6e75581bd0d772e8fdfa4f2c7733bd829bb0fb67291455153750ef399b76898b23cf439855f353fe087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfde8af2d4d88c2111e61d9691010bca

SHA1
060de44486b52e26cb37fb649dc9ad22fd7f0616

SHA256
1a30161ce351b2e0882eb0997542a1bb55e29e39a56dfcec253237160d2f7a83

SHA512
4dd8a59535d66be0c18ef70fb73d8a052531427b919092df724783172bd44f928e4ac813374937a340e5066d0e59f73ed6e5ae3ae58bb248ea0924eaf5409527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6af0514af748a0a7a463c264bb5cd22c

SHA1
dea02e91c606709666a00fff0ef2417268aee671

SHA256
8e5c9a4e92b623b2853a61a1c08d1de2b79448791352ee236922019dfc0a0248

SHA512
10688cd3297aa5a67127b86f68d6b9334714e6fcd6e9febf3ef5cd0f850a2052d5c9e35ab1372decb72ace03d7ae1faed6b012e25d7f8fa64fdcfcc076c71935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2ad52a0860d93ed264047e03445d155

SHA1
3b7958eb69cd629d90461afdcb10802ad6a455ef

SHA256
376ce67b4b3f514734ec6aa7b6a00bef4fed205dab053c89ff3d5dea257f3848

SHA512
38533cdb4b1ffe93b1e50be64709c26be5f6eb54f4e11c2dc69ceb8e522fb493f54a8995dceef67004c88d42f343553f19a7617c34f9cbca014e6b3c34c9025a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25EA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar267D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit