5896a191d399cec41a404de259108575317b3f7485845a5f7f868d75b493422f

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff300b04f9a3f02e9819fd54600504e_JaffaCakes118.html
Size

15KB
MD5

8ff300b04f9a3f02e9819fd54600504e
SHA1

1dcdc570270c3d214c2994aabbb0cdc2574dfbd2
SHA256

5896a191d399cec41a404de259108575317b3f7485845a5f7f868d75b493422f
SHA512

b9f21dc427fa5af574f93edef5423b8d51b240a4eb4f9ce5228df49f95cff75693580a3313029cbd63fb44267d98ef0c9449861626568479ea502ed6e92916f5
SSDEEP

192:36uU8vrIzFFRRRRRIn1MBOyFKxH8C8b8H8G8d8I8HRRRcRRbRRRD0MeahwxROK36:1uhoctGLk0MeewxIK+KcKjqaP4x

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2CE8401-213F-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423536242"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2656	840	iexplore.exe	28
PID 840 wrote to memory of 2656	840	iexplore.exe	28
PID 840 wrote to memory of 2656	840	iexplore.exe	28
PID 840 wrote to memory of 2656	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ff300b04f9a3f02e9819fd54600504e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8441cc06f329e00c1ab59d9a9a9c700f

SHA1
1b2e76f055ec6aaf6e3d5ab8aa56012eb56cdacc

SHA256
d16c5401fc0d4c5e48a4e41a43f79ae748b7b5fe0103665a19060eaf5ab1e4d7

SHA512
7c946d58067aa06e1a2a32415f95e1d0d273b060fbb29b72575cdc7842eb73dee7dd862822376f181d9f3bce70ae75974696e601b22c3795d84bf5e86e129a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2f5abbce07b257de1217ef91f344ceb

SHA1
e5b978088d2db41dfe938108a7703d1f5d92efb2

SHA256
2862c2cf6cb2a7ce7ee980ce543d66eec9eb8e1085d31234ff4b859a90a1098a

SHA512
1a82b106f77bc055eea5ea37d590d57d0b77a249fb58ea035aab9d9b0b1ac5aa6d01066a748245682feecf3eabea03a7523dc61ee84d800a8d1b1248b731252c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c51015ca6da08d0e0a26c4fb0fe58121

SHA1
67acb4e05514d904725e5aa5215d7e377e74d872

SHA256
3edd56168dd9f0eeb85ea4e1994071d802fa86f99aff4b2ed314eaa1b1adc7aa

SHA512
666b50bd679fa950a84bb15e8a4ac4af67ab26b76ae84c5bb8e9b78f8462a1141946575460a328ecc86429c69acd364153db01711adabd10457cfc085abe5ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638ca63cfb143a81ae6a2e22485ee5ee

SHA1
9c4ac25836eb938e1e8f1369aafa345419a3515a

SHA256
0ef83e4c09c90a39e4b35292512b2a4ea6ce367b6397351f8933a73fce49e89f

SHA512
da14e1eb42e3fb2f5f71e273d1a185f9b615b207f0e3372d46b3c2c92b8c623b427d836b0310a9cb2e04be2996d30b0acf0e4ccf38521d991367f05101a497b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c44b17b838a12c1b1ac4143372057c6

SHA1
21c2f17faef2214704e8a2a4171e5df1e3e9b918

SHA256
8499a907d98382d1c82636b7f974d3059bc75c09e54d487234de000a8f619b4c

SHA512
7f6d9e90e4021818fc4919219b0dddb20b998b9557e64e80666e94d85714371a48ace32e4438d3803ec4bd81ef931b621ee4ebb3034e372f101013a9af8608fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd97d7990460650815bb01b6922650e4

SHA1
f9e9914195883a9b0c874b6f4e3f51fc3aab5125

SHA256
3a01c0cecad70ab198507ad407204839f5791edcad9753f46f244bc5f6342e6a

SHA512
e0923fcaec15814c3734250dd7836c007dc803e331783664cdc697fdc30b6416533156b76eebf948d92cc8420c8c72d103ef14bd078f30d5c1b83a41da82cda8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b03fcf992449e24d01282b6c80e8439

SHA1
08fc4aaa9ac92c720e3dc6911d5bc959944c7a61

SHA256
14f4313899ef8e3153451624fe1202cfc755ea8ee7f3a355d5b4ee0a893ed66f

SHA512
4658106e6e4f4f9ebbacd00a478e9b74c044ac4a5227268fc80f72acab7c565be2213b6f515ae65c041b74f921137be273b0a8fa3b0eac5bc9b7730405494a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f13f711e5819532f089576e1c9e1abd5

SHA1
b08b6a475b306b8ec25a8cbef4da72d2612e9878

SHA256
5d04324bc462c1fdb306587e1acafe26e5ac23663dc6813cef1c0f587d4f38ef

SHA512
78b44bdc9735bbaeb565c2525f7491c47e77c9ce9b6395c7ddc18f7949484b480d6f1430d464c9bc41b5deb1a494000d1f4888666dc36088d45590ff512f706b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d7cac54528b24a80a608504475d5455

SHA1
e8391d4cae3d48d3065432f64feb0437366a6ca0

SHA256
2db30a7d6efec27fc9595cee12facf318cfb6d17f0414aac2084a8d08e8de037

SHA512
1016a7ce0aa96a3aa19ba4c2d680304fb7c193f8376db8ca32c16751f0eb60c647ab99d5033ef8b106858fb55bc4cc2f8d0040b86d1ead41a5ec99f820ef2957

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1132.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1242.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit