d5b9887e32f8129c999ce129850c5a8c6c799e9e0db83929421f950622d728a0

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e0f372837dc519e9a4937df559a7b37_JaffaCakes118.html
Size

36KB
MD5

8e0f372837dc519e9a4937df559a7b37
SHA1

e405e77c24b4c5376925f2667420440c6b35cc6b
SHA256

d5b9887e32f8129c999ce129850c5a8c6c799e9e0db83929421f950622d728a0
SHA512

47cf39593e6fb257b9f2cb60c2a52ac4823520549e84b51358e08e5087fa5195412eb90692c5f4b66fb89a8966dd2e9f42c41e4be68f46df69cee7dbf3e055e9
SSDEEP

768:kFMbL1bhWnb2vb+PqTM/J9bk78Hww3oGe+01JI4J1YAX2VA5MP:kFMltWnSqPqTMf478Hww3M4mZGi2P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423492800"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCC53981-20DA-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1096	1100	iexplore.exe	28
PID 1100 wrote to memory of 1096	1100	iexplore.exe	28
PID 1100 wrote to memory of 1096	1100	iexplore.exe	28
PID 1100 wrote to memory of 1096	1100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e0f372837dc519e9a4937df559a7b37_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0e1cea1be53e1fd716db9903f1be38

SHA1
05e9f1234aea731806e7761999cb88963f94912d

SHA256
11ba043f5d3c8f0f7fd45abc613a9303ac52bd9a9f4e7122e26a863277109b6b

SHA512
15aaadd3b21269043202a42019d14d363f4bbb4eebca1e643bdad83c9b02473ddbdcb0e80479d19f4ffa50ce378ed9b44593a45c78505a489c7ac34f3763e007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
332fe6a86c4d08d0aa3888390473e1e1

SHA1
2ff0cacde0cecc00930afebd603835cedf6883a1

SHA256
90da8f8a03034dd58e46b8905c5f74de025ca20a27330588b2be3e161f970538

SHA512
01e11faa22d6fadaf5bf0953a64e882416d19c137b77f9843b906fc53633c569ce46c46bb1b45a45b0c9b930e2480576ea57163a25c596666e30bb616c75b9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01d9c895b771f5fe61da6009b12268a3

SHA1
30f5b150a7f26fde993707a22fd2cba73288deba

SHA256
ba01af618af093cec3ede5a993e7f0b6098713667e3cc1c37b80e420e4c0ccc0

SHA512
e187156cb6baabae78d38909af32357ed99e7a2cb22c9388930d3a98e73e2c92ac222b70f5f3619572de1e0ddd28083cbda5b6cb93d7bc9a4118fcead4d31aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b57a79183b8de8bdec2eff3a283de9

SHA1
97d469b9201b73dfb7325ace2a4e8cbd10502bfe

SHA256
97962cae618ae50940911e9b5887caa3dd459a22e2ba798ddec27b7f8fb6a7f3

SHA512
8bad405bafe93af662bc6a23bc34c5e3a00795c5b605fc3f83496736ceea0898094f4b984b4d1c4d2473b7691be43eefc2a91fc1f00f830d8da4064a2fd089bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fd59f6efebb15803bea0aea645341e5

SHA1
08afd2fedd9dcca360bee0296ede4dd5217708f1

SHA256
82c37917a1cf87d26f8acf89022253f92f0ccbf2368510af0e96903e1d86e85c

SHA512
27cacf988d5587efdabace69d48c69dfd992a40a5da167a12046420489ef531c00d482a19281fbe80be46f22d94c69d5b3f254d0d4aee433e7deeb60069cc9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ab49b9c91947044dac951199d1580e

SHA1
0fea9f35825e73af75dacde621c471c191dd963c

SHA256
971d2cd9f4e215fa707862935a2ef0dfc1f312b4e43b03112368213754d844a5

SHA512
98e046a4797f3f7b8278654b8d8cf1990a1e86376d80701f0485d5d0f639f0491d9247aaf522acf64ea65cefa387f7602542e053b6ac391f99b8526faedae9a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a6433efd0fbc09b9f82428cdf6ce67

SHA1
98338387ea470381cd805466bc4e08bc5dd253d3

SHA256
b1f0de694b3000b557d808c178dd1eee89e71693a9b33ddeda4f5296e3ab15ec

SHA512
799e9ed5b09c297ae52eea5705fac8c4bbecafac074d7238b3c2d224f43e861b4e90e1864547ae59cbb60b7e604eded559ba66c0c48cd44cbafa6e49636f4a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53e5f4f52efe731cbe1eb8cb5302acce

SHA1
0dc345616d878302f9cf6cf26f6bee6430200549

SHA256
5d4daa1cff4b12954bbb2204134ea493ce417cc0fafd867280fe9ac79846e174

SHA512
5826f813b1f62f356a38e6827b982d3d0c99852af144cc93fdae13bc0fb9c5fba455a820ac97e472256c579d7eefd24e77bef3aa597bf5eceaa223f5c10abc73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e70a77f96420fc024e52853ebf3949d3

SHA1
38172f4f08d533a4c9792ba69e65b289fc703809

SHA256
ed83d81d47ba9cc12ffaa9a6926a2bffa659fc71b9b47cb55500605b6819851e

SHA512
f158b9ad67a34a434364bd957841a61c06bf494d4627bcb3a0bb9f9b756186ed1d5c1b5f83d0b7177c2bf4146b0dec73bd1f500a5d9e8fce550898cd4b3298f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit