08f50b231494f960a9ac2426b8c75e801e43f6e8fa0df8779a90de7bb083129a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ece1f16a6e2c93254bca4f13662fbaa_JaffaCakes118.html
Size

23KB
MD5

8ece1f16a6e2c93254bca4f13662fbaa
SHA1

226c02f46de557530a3e48696f90bfb86d3d5d08
SHA256

08f50b231494f960a9ac2426b8c75e801e43f6e8fa0df8779a90de7bb083129a
SHA512

8df1f99035ee45c69bf9c68e2394d57460463881c7d1d7fe3cbbfb2e189e0764d07efc9f8dfbb6d7433c6dfe03d9757b9901b7c76fc9c502d546eb9df238961a
SSDEEP

192:uWb4b5n46nQjxn5Q//nQieGNnHnQOkEntBVnQTbntnQQCnQtEwMBmqnYnQ7tnGYu:ZQ/b8n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9315FE31-2102-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423509909"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2004	1724	iexplore.exe	28
PID 1724 wrote to memory of 2004	1724	iexplore.exe	28
PID 1724 wrote to memory of 2004	1724	iexplore.exe	28
PID 1724 wrote to memory of 2004	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ece1f16a6e2c93254bca4f13662fbaa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d195f9e3a005a0a2eece60aae387f5b

SHA1
ef822fb649d076bdcde6c33e85c3fa1dad0154be

SHA256
5be3dfd52e0fc14ac820ee4b12fedaa7bb0130a0ac8026b60aabe2651a57de57

SHA512
5edf4c9cf98756a9f2971cdfdb026dafb1ea2d5834d8de0a12e00bc2a0cea6ee132dbdee54925b2e0487edfad2b9c1fe494213ce8bfcf2367d60c2fb48cf374d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb619f925fd5d87ee6635e7d96672af4

SHA1
9c58ee51bb5f3977137bca9f1701fe9120759494

SHA256
825e07f5e110b589dd9bb3268c1fad6a3d3a955bb2ed50f755bbb7df0625e041

SHA512
937c53d42c491324d125f75cb4939ac5d7d54ad88709b22085753430e17512533d3e966889863f7ca42eb7ed4c874c9e05b9dbfe1410cd98570eeb67fbc3849e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f7af4861911c75ecfeea772dfd7bf5

SHA1
32a9fd80fef5ff105359076d3f790a8678b35b38

SHA256
9b3b8f630b1a6f68e6f617b3854b75112bec52b695a82c93a2b9296a374158fb

SHA512
ee63bc28fcac638746a44e6f9627a18c22bd900c52a5bf4a7365f3d176cc89e970ca754d6f6632f53f8a79a6898791e8a443f49912c62c8d0ecbcf2057e1906a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4428cf131729529e6b5674b5ae8a29bc

SHA1
b11106d7a795e0956a9f64fa7bf467528d538e88

SHA256
21b8e2df3e5ce426f25b834fad2a14836a3161d9862ca0f5939a4e6eb5ee844d

SHA512
e4cbda0c27f301bfca6db99d7ce25c4a2a73931f8f90fa54e271d365d41018d38afcf2cf8ab499fb492b29d33e7fe4c7b8811a27f405c1594ddd1b5409af69cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717b90d82de1ca6a7e12c7e6d0ba2583

SHA1
65536148281098b3c314f4204a6e70eeb9a15cb2

SHA256
ce84f6c60f44ee0bb8cc3d4835efa0782d0338453eabd50da9e5bcfbc556b08d

SHA512
3cdc6b79a33f2dd40bd559bb6d6c4932966628d83497dd253d0ae1c7a41724cf7b4f44c8489cbc02981b53aac9c1b0400e60c7e32070f7af20a1233521d9ac78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deb76f6815707a92a1c3ffad21a96bef

SHA1
ea451b0f3fc29358092d2a4ca005b9cf0dc53ef3

SHA256
fea64d2f7c3ee73e78b7161b1ad7256b4663bfa5e732d5abac8f84ddd12c8e7f

SHA512
4b1120837309ac378536c5b3976fa038397b958e7d5d788937497b7bca45acd5f9bba10b161804aecd12fb4841e9bd7a7e9ba77244134677fa3cb02215b82b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0d21c06198795607e86cb17d12b3a89

SHA1
24f2dc09c57c501f9339210a0942ddd04a478425

SHA256
1aa3193992bcfb278a266c5303ed3417061bc515e8ccfad7c434edae87c57449

SHA512
37ea68928a54a9709fac761ccc8c8dbf2f9ebd89a69b0d32097723ccb3c1a168d7e977d647e86bd00c98994ff12dc6a602a5e0dd058a07da915919996bc46250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d4ee83385cf61367b64818395564565

SHA1
d61337f84d17fefa8b680cc9460a68620701c334

SHA256
b64c88c5733d70663414415a80769b88b97c3ba4505b4ca64522a1bcac579768

SHA512
4ab8152cc2262bd6750f328210a07b10bbc1dff3cdecef99e921c19f15d81daf7bcc1738fe80281a784e5c04b965bd22069f8dd03670718367dc4e6a68e0a92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db8e5b2d7664283a14fa7d1ac68261f7

SHA1
7d330157bc7e5b1f74086823f408868809d31773

SHA256
77926d937f4bf4c83815e804a4c1adb604f93d7cd420e018ca9fa36c9d6bb8e8

SHA512
ccd6c2ed5e768b27c5a5b9c1dc4eed25a16e7ce1d0f2fcd457e4fa449ea6d749a43068174b8124148942391622401e25fdd4199462f6caac7d353cfd3849c499

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab208D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2121.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit