eab79f8a882ec09b5e6a4afea5be316c6afc659ab1d8be0528c72bdcfc5e6b8d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

919d5c5f5466cdf5d80aa3335c8155ba_JaffaCakes118.html
Size

23KB
MD5

919d5c5f5466cdf5d80aa3335c8155ba
SHA1

deb50b45c2ca03a4725512b3dbd7f1e34dc62d25
SHA256

eab79f8a882ec09b5e6a4afea5be316c6afc659ab1d8be0528c72bdcfc5e6b8d
SHA512

e08aa18f7e7a593fccd1fad5f8437e2c79ef9817ac38ebab4f3e135ba5f3de5be6cfb30ea0cd34bd233341177c952faf00621a9b1f43b8f012b1ea70cc4e1846
SSDEEP

192:uWbQb5nK+nQjxn5Q/NnQiewNnlnQOkEntnjnQTbnRnQ+CnQtiwMBQqnYnQ7tnGY8:HQ/JyP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423575958"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5ACCAAC1-219C-11EF-A5E3-DA219DA76A91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2560	2008	iexplore.exe	28
PID 2008 wrote to memory of 2560	2008	iexplore.exe	28
PID 2008 wrote to memory of 2560	2008	iexplore.exe	28
PID 2008 wrote to memory of 2560	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\919d5c5f5466cdf5d80aa3335c8155ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f217110d79c9be38c3c1809831df30a

SHA1
728deb8f8de161d955d57e9b5f3537f63944ef9e

SHA256
952a8a3a1b026fd5b026cdf171dc5bf466b01e8564c1877473c8e807f299be5c

SHA512
6e008d2f3f185a384faf678dea63a63a3e93e02587366d5baa8859fc2c2f77f1a0197ad8a7af0b284afc8a547d5dc097ccfdb9f6cbf62cc8afcc5d14ae2d887c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19413cec6e1dd3bb9459931e71a763e5

SHA1
a1d916f0399ea68bd65452bc40cc868b3500b345

SHA256
bde4fabb231278dfda108874b0dbcb9bb5a4dd9bb21450f0adb73c42f215904b

SHA512
88dc5b8697462aa93d96fc538df7eeb7902960b4bdefdcaab1d5bae31e5161609031ff8086370f7c6cf9d9c4bc8f978d586877a9ff577b7bd9fea99ed6feb82f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
725ab320738b85238ac6eb49cfee2997

SHA1
c714aaeef6891307b9c7713cff6e16ae48cf79e5

SHA256
4e4e51416a9d302eddd9df829aaba7299018b12b86c620e26cbd6ff5f46b2089

SHA512
f9a021206880473876641b242d3d0c5cab6e642c1d3a97695a2b4a4a25b2cb4d17660650b68f9c3c5412ff1ec08a72af82ab40b35c2c80994cf41f16d978109f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23859dc14d8474ca80704e57db3a9ebc

SHA1
4851a5926a47071c4b41b8b09d001f248af98af8

SHA256
cbb86edb349ef47fe779a19b026589c4bbce0105187a692ed941637999e7e274

SHA512
2db519bceae0dd9c560948abe03273f7d987e2a1e657d02f7ec0797a25a1f01ad465938351693ea0aa9332881fc7947e0cf37058b154cb8a7addcf5d2821070d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68b1fb09151a5722124ba794fdaafafe

SHA1
b224fae6342b0a18ea561659d3b82c230365c022

SHA256
1971330bafcba5c5f58c3b0a4a3da8fb90378f90f37cbc704dda5060cbe4e079

SHA512
c0e20d42967e6f36d2606ad998484fbac5fcc75314033712fe09119bdab6de6999148b0ddc9fe9232b2909094d42dcf7a2d70b85d627b5372906263c9dcfbab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c187c77c6257964637da99a455a7f1b

SHA1
8be398aeb12ff9d2e98a8b341226db245d65c5a9

SHA256
b9dadc6f7c80ab5d028c9abeb9acaf12719b5a22cdf9f3181766620c272ec4b7

SHA512
bf437230cfdb64e6cbf4da013b2620d3a8d448c2568c6b9f94e89e914c1974c68287fe8670264342573c9b3c8d03fdf067033e9118ae6ec393398c5073fa2a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05c9646c66599f6620c8e60746852a08

SHA1
5ef764e30fbcad5801a5a17b04806dc1ad26c19a

SHA256
91c25c1a2364cb191501a2f844e9b8f0e234722ad337530b04c489029a896a17

SHA512
db01252f352d5dc9649ce2fbdc2837fcc884a6eba2c82ee792742aa59be9d38e2e6dcc0c4b7caa1269abcf72d9ed483650067c93f54f6c2d8f1cd1d2426d6dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
882eef4c9e6ab2f50be6bc5e0582f2e0

SHA1
a2e0be161c4b90e16a3da03c1c23806c620d56be

SHA256
f6e25f9ea3ad4664e86f2b45a353302830254df60824174296ac19a610d01616

SHA512
099b3907ed5cb4bcd8691a876e8193c095258fe9044d7d9e1af2460d5d2b773a201b48b04de3b2be38179163701cba97fa356540b16aa0bac3ec175b9eb1aefd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62978dbda17ccc28a5836709bb626994

SHA1
e6cb14c5beac26909e7cd335f8135b15aaf03ac2

SHA256
f0da6f75676e9401c8ffb7865c6b3699435f482393b59d5b52e8c83eca77088f

SHA512
babed808aea7b6c19ab630a2efbcb843b40a359010cd259d6a0c6d4ec4358d4268cf6c017ea64e84a55c39199768da36b293668b9f8ff453c1c39db6af28557d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12C8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar135B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit