d3a9748e4795f0d9481336e8a4345570464173725d43f4954b6b288954910060

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f309f270ba833c67e5e2cde9d6bfc2a_JaffaCakes118.html
Size

27KB
MD5

8f309f270ba833c67e5e2cde9d6bfc2a
SHA1

e9ec6dd85b72e4e1930a165ce4800a7f96fab1a6
SHA256

d3a9748e4795f0d9481336e8a4345570464173725d43f4954b6b288954910060
SHA512

5e3a97aa7d9cc96cb1df36d7f988a1cb6c9c47f465013a42cb999d6cbe0627dd5e843538d025222e84e163b4678381793286e807db0938b66e043e86b77d2c41
SSDEEP

192:uwTsb5ntCnQjxn5Q/EnQienNn7nQOkEntsmnQTbnlnQ9eXjm60XpTQl7MBHqnYnM:kQ/LyFMpqSNI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423518963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7B823D1-2117-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2696	1636	iexplore.exe	28
PID 1636 wrote to memory of 2696	1636	iexplore.exe	28
PID 1636 wrote to memory of 2696	1636	iexplore.exe	28
PID 1636 wrote to memory of 2696	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f309f270ba833c67e5e2cde9d6bfc2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90bca2ec61b3b26650ba000bd1d52905

SHA1
28f8504bebbcccc666cc643e2324081259865641

SHA256
d37432c93ddb8173b7c1e0b322c6e9286a456c5b351d6500c6e77d33af788d2b

SHA512
1ea293a8cf682c321086c07d96ef5a6e949674fadf312aca8422bc4fd4934d4adeb0460f014f0f6db1157858b91989f2707b10705103f139911aafd8052a8080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c60594018beaedc745026a2ab9642817

SHA1
17a5e6215429db7aa63250854286a8ac2b442138

SHA256
7f2584214f643099298685b5cc821bc52e97c27e5a1312ba4c924128233e3949

SHA512
e85af5d5dcbd1ccf5b3e315a6a49438526cdd14f1a7c1061c1a6fd28e2ab2e8a1b648ac53fe2f04337b8ea5365a0915bab6f956108102c4c6381623c5dc3db27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ec6890a496e557d7f39f11286bae340

SHA1
a66f3539b9ee051ec3eaa8653a33b25d067e241f

SHA256
ed13313fdbd6bba9cfdf1cad96e648a0540af26a62767b7ca60b705cc394674a

SHA512
e7903dafb5c61210ce916903eeb7e9f0cfb6ad2949dd5bac101d3ecb4e4f3db51b807aab980255e2f4775e17645f5b3dffc1aa4557766057ca2922dc5c6f17de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a71c3b1cccb4957160eee273dae0f3d

SHA1
8b64d064c911c59194b7d601891917fd144760f6

SHA256
26960869882242e87a4b627cd262e2f4ce5193aec6101e1b91563e23c867069f

SHA512
9ffd12279cd10bca991d26f89f5dbdd88d21a7999c9e8505e42c150208f2eccc74b04cc7bad6e511405d4effca92c8519fdd50e9cae6c8090d5ad83d27c508ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
349f5300fb4cbbad572ee36ed90bcd65

SHA1
339b9523eb5c569813834d50003ebcff6d546f18

SHA256
8e334784416dfd414e52ae601bcfeef8c04f70e0630839d4de696880d97ed485

SHA512
c5bcf45f60ad89eb6c9bc91cb153e1418177fe5d43e4be1d8ec03956e99788f8cdbd91abd192959de6eb1f740f8de268119a42ea42b10ea8e774b5cb87830566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d0a3a654f119bc4d06caeb94ac8796

SHA1
106c113e33a88b230daf0abf59ec023e5f70ccc8

SHA256
8c7454011adef16eb7ac238da14595b11fecdb7cffd869da01483339f24a3c00

SHA512
6e7abc54050474e5a941c885599fcc87a396e777d7b1a07d3a5305c0a3ce223c6ff1b6958fced05b90bd841fc7e5d76f05fc2370eca3e54490758eddead6f8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4329cbcfc11b8b15731b9838cebe4067

SHA1
4d71e8aa1f30f5c560b4221be14d77803b06aca3

SHA256
038638a8dc7e4daeda4e786656db8bb7930b8c245ac3919e0e17171d843bac78

SHA512
c9b26425c5558c188d5f7502187c0114e1fceea565e0e35dcb7288d1d59bf44bd6f2eeaec69db5037248ee4430bc71839393fedb099d4c227f88013c7a4e6540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
727483936425f45b00b0dfda74472950

SHA1
57070a758dd35a22f5445bdf7c06e110e64a458f

SHA256
58069e5a2acec765f521538bd1eb4275041600bb99a2a475010401bdbbd0fb8b

SHA512
d8ed36781322d0483d6ef64827c78b51717e256c83b3a55aa8b4c1e4f226ae109600f84d29ac66d57efb1ecbcbef40c4d82f5f274d9526926390528c8baa949e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bd5f6997b3dba2085788dd8e5c5cdd4

SHA1
bc71448a45c2fb704ef1920855d26125cbeb1bef

SHA256
4179ce19ef20ae1151a5fd9eff50c2363cb8cc38ffda069ea64c2437649eeeee

SHA512
5e47b637702068b652c17e0a5e520195808ae7600fccd368a7cb76fc10f9f4766838c278ecf081e28914eb8e80530348ad1048a0196a3fcab77d6fc23e8acdd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
887eea29e8e49f3069e90828c8407033

SHA1
199ca24f538b4b1579e532e31cef2cef007ac96e

SHA256
1ec2dc683b379e29b332f7b5839476161ae4db9576f85056c6e10b3c29f2f366

SHA512
a6e5c71f2b524ed7bd28d2944f9c69d3ef5bf57de683034d39a90d9e5911c62b18c3b1e80519865c47939a39f63d2e3beb134296a862c6d667cb955c7a12df00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab231C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23BF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit