4ee9471260e47bb17a7466835369680fd54e1f12abd4e1f45a942112b2644704

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8efe387bfa340d3b7d4cd0952592dfb7_JaffaCakes118.html
Size

34KB
MD5

8efe387bfa340d3b7d4cd0952592dfb7
SHA1

dc59fbe29da7165a25b9dea47962c5858b0bf5aa
SHA256

4ee9471260e47bb17a7466835369680fd54e1f12abd4e1f45a942112b2644704
SHA512

9302a89284d2d9817bf6e5c390319820522e02071657e21db6606bc6f0c80d33f3e0b484dbec2804f9bb212c0005f8d43304350e365fa9f64034e3b38a309fd1
SSDEEP

192:uw3sb5ngqnQjxn5Q/znQieaNnrnQOkEnt1NnQTbnlnQOgfcwqY6cwqYKcwqYQQG9:BQ/enao5QGGBq4tHj3Ad

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E79B481-210D-11EF-965F-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423514572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2216	2176	iexplore.exe	28
PID 2176 wrote to memory of 2216	2176	iexplore.exe	28
PID 2176 wrote to memory of 2216	2176	iexplore.exe	28
PID 2176 wrote to memory of 2216	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8efe387bfa340d3b7d4cd0952592dfb7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5401e6787e82f2d62873bb6a1e518a2

SHA1
b0093fc4f5d219c5461d59327f98f39fa6ae7aec

SHA256
d170aebb65a6cc9a14e839a9891c13e1956663a9df803c4c40cd712463133fb1

SHA512
30464e27358217524f65db2b50a6038ac4dcda86abab7408818b71be99d9507c5270470531f8e3d76a2730ec50ed38cd8b199f23f87c75a6089b4453ed2a2ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0991a392e69990d2e5e8d2673e2d14e9

SHA1
39399cc33b0a9c0d69e10b956381117660b8cb70

SHA256
40d053109bcc64ebc1d5045386d04eb2f38c9f2458dc1b5c380b91894a90cf52

SHA512
ea00c9eaa53fcc2edebd59c0d31627cbac46d15825d816ce14ffce2f0eaedab83efbac04b42dab6c531228786f8ef5592d3962364f85e940920e4c9494ade04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c546c4104687be804fa57354da4bd48

SHA1
94f4dc64d2845883c41df192d2248afdeb83af8e

SHA256
c0fcf971365cc0c087f1f9afb5870154a3439dc0de0558229d6ceac768927fe3

SHA512
3ca8e2f7623934bf6402dabb93ac79aa1df6b448d6bde099aaadeb0005292fedea7bf6edadbb3f0a202f0cab50915fa8c5faaadd1f41f4f1be53ae6302bb729c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e451ba01aece616268c39631f6e794b7

SHA1
24b3af961034cd0f3878654344e37bad2d553839

SHA256
0a446c0b25206dd6d19bb23ef2b25c7a9fa0016edade82ae05e8d48b82c2307c

SHA512
ebd31e3b9644bbf2d4e86ffefa519905c8bedf82f5c3f393b7f69053236ecc88a9f9b69ce2899123e4f536b84a30f666d15aae8df0069af11bb71cb7c4a8cdf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b161f28bf6ca9651f84a574bfa9c5d2

SHA1
69ec4f5af437d49472f5c6c8a5395501a0a7b19f

SHA256
2d53c15c55eacdacc66505527d24d9c48b6486fe7f857b5956599f6ddb3846ee

SHA512
f358c9f0edc2961de201757c566a01b45851ca9f9cb1dba4f379dbea6aa9217ec7af10318a92cafeca4856159be0441b8dbad2d5725c072dc3c99216141c9d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb9be9ece8f5c7905f10db7f2cb8e707

SHA1
ef89405f61a2312bfeebac616ae272b7c6804c2b

SHA256
836bef8d36d32fa93a0a485114c9f217508911c9898bd65a82a795809b81907a

SHA512
63ac9b72b741cb9539142de8e00c5c7bab1da601b3b9b40690407f12016e6e8879c5e68724d6fb1cf7f5566bcf928ade65d08b58ccf6716e1c5bf36a89d0ca59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb8d7a9f46d72f938ccf7de32a12f13c

SHA1
a1130087bb46b6762173b675f3e311c2d505efd8

SHA256
60deeda7b45b1b7eb541f9a526a5f3b8a5696dc37be26d09f9cc42be6a046297

SHA512
d4842e92b62b5fb21c4a8cc34cedc9e708e952cb3c77eb170165ed30d2b25fc49ca6a91286f547069fca4686e3de60db7e1e50a66b308c2e555a20571049ba00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4681dee47d54be1fa87d10e198ee09ed

SHA1
5d0d3c9c43031c57907c3ea1138b89bca67de1c8

SHA256
3f3c9e7299cf2b86e54936830df8132d6a08ae825565e278a3b534de2c65c6ea

SHA512
ff593f4d97490bc1bda744697a47b81d4724565e472e9ef42556b385561b92e2678ab17afa05f741d2c29ea45d7d80b385cc8b28cda809743fa4e728b6a65de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc675a46fa2771314bc5755e04ecd4d1

SHA1
a1dae32d0ba6398f3c0fa1d293621ccf0c75b9a1

SHA256
f2a630a72e93b5b431814eb8ea6109909580b112a1b976ba6258cc1231c46192

SHA512
7b11e24cb8aa0f959d923ff38ebadcda5c63c7449f34a47afea10da4c1668aa532a5da120dabc01e8285f2c441e0d114e3f7c5ef9790acdde51e21286a44f796

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ADA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B9C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit