adccbe5ffef708de592288974ad0bbc011d3996763176913698c99bf3be22b28

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eed8c8d38932e7666107f79c3dff14a_JaffaCakes118.html
Size

34KB
MD5

8eed8c8d38932e7666107f79c3dff14a
SHA1

159292c2db562d0ce11da937863f01b6cba28bad
SHA256

adccbe5ffef708de592288974ad0bbc011d3996763176913698c99bf3be22b28
SHA512

9fa0a2b9a9371f9d036379db2d4905de10e068cba6308d1c1271ae728fddbdd1c53fa995b935676d07efbf23068d391d60a99a98e61a90fdfd6bcb7321d45b0c
SSDEEP

384:rl18C7JQcj4NhJ9cLwKVoETQ/JY7cSTxVzOM++RMux+M5LuLILMUHlMjtdMCd0Ml:x0e568YbgSvlRJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423512868"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{776523D1-2109-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eed8c8d38932e7666107f79c3dff14a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
155af0bd7563325119204d7c027f28a3

SHA1
393b10da72942020e24ff89ee87960addd8443ce

SHA256
58fe468a4039d88ad79208d39f36b0aeb146451894b73c2aeb822d17f60356fc

SHA512
6ccbb6b95f37c7448c80c1710a23db3dda06f847aa8d32994ab99178c86a0f3db102251f128312827a135257409eea1a3267808ba6c49950d56a6757e21d5154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e98573a3fd9bc9af60f21366515b3b6e

SHA1
5dd1fab39d1823e0f9ad5f3aa5aa63f44c0c3215

SHA256
f662e47454370add739cedc6693173e763269d95317fe6142072766440a43980

SHA512
a002354e8de735251fb066a87169691398b653ae7386cab4b29edababeee6d0aec9edfc5a21293435f2f3b888115d8eaef8be42abac2e1730e118bba526ed281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdba346efd18b3db7b1b7b20fd6904c5

SHA1
21f9103bfc27d69c5251d9818021ebb7f0497a64

SHA256
9347e8be2dac6f1c2a40f7912046dbd234ff322c42134c95481dd1857ca2c20b

SHA512
80e61acc269e125411462a84c4f5a19154c8fb74eb094491d1595933256d27d0ef81c64a39b8c931018e496d90263e21e8af6dd5d55fb159ea3621d01cb383f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a592abcd69ccfc74ce2e0d7ae1b1dd5

SHA1
af53e9232de4f34882b59cae3a9b106037f8d487

SHA256
be46afe0b1225df6df61014ad2f650c07ccb62fc3f8a2839bdc389ad5e2aa65f

SHA512
112c9039e802f4a9ea1f8ac2b5b28974359099ef8bc5506fe1a79d74881a908adab44f3fe83b941b66d06a368a983d638f5267be51cf39564037bce2b4df7983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dce579fc07d30178bd6a7d4d6e45ac9

SHA1
0ded618c7974b2c6bdc7a0391e3efa0d7b4ae897

SHA256
d08d00ec4b1456fa41e02e74362654c7252b2a95d82e2f84cc495ca2878f56bd

SHA512
04b6c8e41ebcb21af23d8a5f153bf5d86e6fe117b932766d5cda2e87ccc4614db81c5dec294535c3198632750e8e5c1eaeb7c7d7fc39191cbbd5462ebccdbb6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db53e8cb3ae6539afe2753530ff1237e

SHA1
5f7bc9a6ed0558f67f8fc0d04e38252b11b3f8e4

SHA256
1dd98358bc675fc6b3a95339bdd5031a592611109c761f6db8fe9b6d61e95352

SHA512
2bc6e6b7efaee9c6c21f1666bd99396fbfd5cb21487b681a2b4103946f6c4c6077dda1c3948321738cea98b982ce99fee1486c57f20348b2da1f14857cbdad7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2340555956dfd4d4d6c40a5971f916b0

SHA1
cabf393aa9de7dbf3c2d142d21d7ef8ae14398f2

SHA256
0291a8f06f654931123202e15113d8bb6db3fce9b1c55f2f4ff09b4040be598c

SHA512
98935f100aa82c0cfd3307aeaa1ddfbb94ede1ecb121f44202ba077fecda9e629d394fce2c09a8617b8161ae8e0855a58e87c5eae8c9bb633fab7d076fff0594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c63e3f1d862978a360a40a6b90abeb3

SHA1
cbb6cf2a41985fd250367aac6ea375d045b5e2b5

SHA256
bd50b0221e75e9556ed7e0e3a85538dc910f5dac6c541178a660d024232b69c1

SHA512
eb83a61be6a7259130c60b16c70820625155f31f254ebebb9aa619dcec8b21da34854ea26c5ecf361ae8bb7b0cc9719be6a09cb362f8a4fb921fecf0477e82b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13990c1421cd136d15efe82a217d37fa

SHA1
8b1e04174349e18da88ae751ce48326683950127

SHA256
9f3a1b6192ca19f09de44d833410b5f6f4c6912fea62d258febb5c308b1976c3

SHA512
e4283bc3885c11ce68aca3c191498b467bad2db427a417812bc1cdb5af200ca71b7c2a1afd7a6730ce21d5fcd5f6535466c154e52899242f44defbb842469e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2213.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22A7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit