b0a58bc9e2c232cf04951ef99b78d8269f682f6f18eb5303406762daa369d017

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eccaf84aa6eb3727fd989874d00625a_JaffaCakes118.html
Size

19KB
MD5

8eccaf84aa6eb3727fd989874d00625a
SHA1

20f36b9b61b800c2be32e29e9a87382fb1a96602
SHA256

b0a58bc9e2c232cf04951ef99b78d8269f682f6f18eb5303406762daa369d017
SHA512

b846f3a6f1edda36d4ab70faf3d462b4ddd63084d7502f23bf0b379960ae0e582c2e949c57d91a440957c8b23eddd531e67cbcaa724d62739a60a6a290e18e86
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIw4IzUnjBh0u82qDB8:SIMd0I5nvHhsv0dxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423509768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F0DE871-2102-11EF-AB07-4AE872E97954} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2292	1996	iexplore.exe	28
PID 1996 wrote to memory of 2292	1996	iexplore.exe	28
PID 1996 wrote to memory of 2292	1996	iexplore.exe	28
PID 1996 wrote to memory of 2292	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eccaf84aa6eb3727fd989874d00625a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ddb85598e99a4e75b689d9bd1dda371

SHA1
ae9cbc7963183918ca0930cd53df9456f80bf460

SHA256
3031ca8b3600f86530687c20776cbc70bd2e9b3828be23cd6e6c6929c52b31f9

SHA512
bc376827518eb35ecbba50ac7b011f4d9deceff478e755510153bedc1115cedab24eb86600bf862f54bdc540eb13f58c6d473cbdf824e6afcb085524170f7a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4776b99df59c554a9a77866f60b45148

SHA1
2624491e2056b4be0544cf412274ff0fdbf24916

SHA256
bf9ba3e521f81bc09cf2c245684fe296dbbcdd2493e935227619a3f55216cf69

SHA512
1bc0561cc76ebbb2e6b5db114266b50cd79891af0bfa06a52655a4a6afbb74603408529f4d90c4e9f3a4f062f56f6cf97ee5bca2ee70d40e628d1ca1b9537744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
256325eff8759331a9fb3e9cdc6c2f26

SHA1
a89764e787c9494e9edc160b861278a7f6670777

SHA256
962800187523d402fcd8222afa85f9a89be6576dd0d95dd53f84deb1bb33e5d2

SHA512
26bb93db5d6cee9ba99397e6996d5242d4462ff9c2ec9f8bbcf5b42b85c9aef9181876f6881e63f38d219d547c8c4435888e4753df9ba33291b5f4078d972903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8604dc7f3f6d367c579f0371b1f6a68

SHA1
87f1040fcfce72f615bda39937a151a7236f0d38

SHA256
eaefacfbc33c6c4235825be17eacce1e6f82e683c7939151b42f547e90cd1fda

SHA512
69c8cbcfab2411026cd224f6dd3de1ddf3ff87e65d0f27884a86e848f720f762f3d4b99775f9aae399885e6376b23607a3c4a65b9b4c924f11407bdc3238fa1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d7c86e436c69bc8b5e5c87e0ddd01e0

SHA1
ccdb1bf7d22f1d34c91948f7df89ff81a314dbff

SHA256
91fa899e1cbc535db6aa59dd3411be2083e83000d04d3e615c9e40c17eb85460

SHA512
95e14ea81aa94e81be05e4597ac090b887710745e68a8056f90bf1bfea3d0640a3154f1fdcb20a38d3a6667173f17652aa32e38363a289abfad7156cc1b7e874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c34333a68927b29353422754805e510

SHA1
9fd1d6bc26fac5a754d0b7c4ffcd5cbe155f8207

SHA256
a543b4b28e048116af1a4492bc1b21ba162179a463e1f50d0ea71beb54815dff

SHA512
b1cbe8ce765ce624f0b0f2bea9b4d405dd700c26109dd7270d05e2575de9726d7c137e7f7171d3c73f9f820396b94e1db8d52eeefeab6cfc5834c86afad5a6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80bf3c1d4470d986097a9f09e0cd4a24

SHA1
ae87fb059db755705ffecd10d28f29833c6837e2

SHA256
a18e7f9015f9d9ee70738e1ae3f2a58e910efbfdda9979732a38f1b67447115a

SHA512
d653060dc430b358856b394cbd9a15dbfeabfef78fa84c09116bcf549c7852377ec0fce824339c0f596dc6f36b94ff76e4ad0120913953c45fe7200701a69387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd699c62c71dab4198045c9e252ffc3d

SHA1
5495be4c7246aed92f9db166b10cfd961f38cd37

SHA256
a8a41ca98224f44153b7fafd74f96f8bd8e65e37924fcdf45b6da88b43d3a40c

SHA512
95e47c4c8c3f54aa1a5f2e8382b1289d3ed3828a72c8b8b84b9945b1385aa8771649da9f2e0e9d5eb9a03b190ef2b3a9a8f35dcdbcb92d27bfe8b3878fcafe0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d41b255587b16db3b1153da49eb58a8

SHA1
5b885ed51654c21f867e986216515d41cef32972

SHA256
d5d1b68b10f502ed071948fb515a330f3aaa570d4dadd629b89364cbe8c4e118

SHA512
dd198706bc466e03d6c1e5adf179ee124cc094fb265d8b8690a49d20ab2247137aef62e8901eb26fef252dd1cc6dd530486c6575988a5c41f280c3ca2ac162db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2751.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2832.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit