1f3935be69a18d1f06d45c12b1a6a0288f652acbcd97505c073065a90b360aa2

Analysis

max time kernel
129s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f4345303a2ac9191b9de4459762a77d_JaffaCakes118.html
Size

19KB
MD5

8f4345303a2ac9191b9de4459762a77d
SHA1

d76cd9179fef623c1ea8c4ea9ee6db397f426bb9
SHA256

1f3935be69a18d1f06d45c12b1a6a0288f652acbcd97505c073065a90b360aa2
SHA512

03f95d76fc299fd3bfe4d34267c03a574c3e763e2be7bb07aaa8ed2ff7e5cebafd042a958af018682112620c0da6d27a450f3cc2885027fd0f3e4c8a15e5beb5
SSDEEP

192:uw3nb5nlS/tnQjxn5Q/tnQieYNn+XnQOkEnt7rnQTbnRnQmSgHMB4qnYnQ51Nnl/:HQ/08qBqQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423520713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA168B81-211B-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2516	3036	iexplore.exe	28
PID 3036 wrote to memory of 2516	3036	iexplore.exe	28
PID 3036 wrote to memory of 2516	3036	iexplore.exe	28
PID 3036 wrote to memory of 2516	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f4345303a2ac9191b9de4459762a77d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1aa737b16d6cfe474de87ce9744d027

SHA1
9a74e1465a9c2b13b91e9582028a5cb96085ad00

SHA256
4e789916306b5fd907cfee573a66c07f39ce56e3325bad0f0d5f8079499ebd54

SHA512
e5434b1a7c0800b2896855d41e3889a8949cb1bbbfdef93645a87a271b6484f7f7f3b2657f94bc262068e4003ad87e7b0c9dca2fd30d33a92b7eb57d823d60bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bfb105afa7cd5760646b8d8402ca5d1

SHA1
2a41c81e12d761ef224f01c27bf0626e473b8146

SHA256
5ad0f07f2c27b7768b7975b25df2f0cc44028f5f02e7198e8829fdaad5351510

SHA512
3a820f4e559e1df1c39f244fd237b6783b012d7bb61bebcce42f9d041112f29489bfec020da9281c16fa978d0fdc4926ab008c35624b3872f73306799f8d7d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa94b1cfb33209911259d078fe977f75

SHA1
cc00da8aacc023153dd66ed56f1e8b11b07b77fd

SHA256
5c9f654529b081715147950f5dd6ed3dbceef05ad2f2b7ed7dd0233a9c7e7807

SHA512
838f70d1029666bb9a543112d7cf1ffbbe2ca72023b4e8d7d0031f49aead17824152415e69991ff8c3a1ebd5981dad50b190d7f7bc163bbbe0b8d9537247cfa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
605e1fd117e25e35e3c226a2b97e530b

SHA1
67868765169ae69a86cf8e54061409cbdef793d0

SHA256
1dd0ea55daaa90ca8716c193e444d78ad90f9dcd3aa7b7c8e8dbb9df2ad3d07e

SHA512
1c235791d2793d1168ee359680c6aca199195fc7ec4354ac51063fe8b92e31ad3e2c0b6231b720db65bf14c8eb0d802185c45d94aae68d32b0efe33b370121d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6272c7918ff807d66974ad03a7dd93c9

SHA1
137da597a2b2a3a8a6371915c9ad119d4aceade9

SHA256
d08d61d91d56ff3ee900c6dc7a6016ca85bcfb8cb0ff1bda9bca4f7cbe31ff10

SHA512
0dc8f74ea560388ff8ef03ddff88f1ebaf0eea7f9dd849de2f1a9db928e208120881ce2c29e4160db27eb7683fdce823d102e89455e6082a7c0f1fd5215bd76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a193b0560feef0afe1e5561bf63d6fa4

SHA1
ea61ae16debb2cc7f3d344d8f3b640772e60d5b8

SHA256
d079862b49c655e4db0d2438c634a5738e1d28f0d558d758c3fd648a669ba8f9

SHA512
f0160b182946022cc9b7336e114942744815304d440cbecd59c7d2f7d90ec23969273cbc95d399876437dc42712332081ff2557b55c4918397940a6b6734f70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca2131a54b0c627035e7c5067de5f74f

SHA1
24a8ee213aee3775e4ca0277e063e9632c5ceef5

SHA256
6341a25be01d243452552e4a5d5ab2ead0b6b949ef7affa1d9a6c4e378573853

SHA512
6bbba0b956c248bd9ae1a2d98af03fc31481b67fc749f818ea22a30b211f9e16f4154a4f363a0e005bf33f0475a6adfd43457918a2354ed016a73e30c3db66b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d54baac4d7d902638dd8fd2fdcb9b12

SHA1
67692ebf287199020fcfc534222dffd23843d6d4

SHA256
026f96396e2cc217f087efdacc3353112930014f2aa4f77673d4c806025262ff

SHA512
389e2da6ba65bafd94ca86126a36d2ae36e82d7fdd6c79d471fd3162ed61dd90176448eaa93b865c4771cd764973ec6aa42efa6f6bb9af60e67874e283de104b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6EEA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FEC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit