8ef2c9217e3589be4a7dd5a86a5b6f183c75a3a3b7b661d9b9f1a75ad46fba7c

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

968e1f9c5f31c1d5a516f5889dd5d7e7_JaffaCakes118.html
Size

26KB
MD5

968e1f9c5f31c1d5a516f5889dd5d7e7
SHA1

948874c6aa88baeed8fe44eae10b67add9f6d158
SHA256

8ef2c9217e3589be4a7dd5a86a5b6f183c75a3a3b7b661d9b9f1a75ad46fba7c
SHA512

bb26063a56817628b55a6612056603e2175295e7a40e89b6949836ff4aae21dd1abd0936259851f4e1252ad5c4677140445905e2c9c59ab55996cfb40b5e4586
SSDEEP

192:uq/HXHb5n1GnQjxn5Q/UnQieHNngnQOkEnt8ynQTbnpnQsOCJVevo7NteFo+NzQD:nLQ/kygcZ5Jr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423704262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{167DF321-22C7-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\968e1f9c5f31c1d5a516f5889dd5d7e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37f88c072fd82bf68e6aa4a18586df4e

SHA1
0e744b7aa053abefbac359b98b97237de53a7757

SHA256
1051e1032a83685c951a9993ff182ff5757ce81497549c3791fde39eed89f2d1

SHA512
bd7b0e6555d6f3a713c3d55c12b8f5e0f7acc7e37f29189d0af753d80282f838a8168fed44eb1b142dadf9f337d0e805cc623021714460359c530266f1ea6669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3947b202dbb5ffff1b579aa5be5dffea

SHA1
94e92c02896e827ef11fbf464c6cfa1b7131ec2d

SHA256
38694f582c52f63bee0442260173461688680dd8250d78df5585ff05632b8324

SHA512
da012020d743b9b3094af77b60989c42e02a6404a3ea8d47fcf867f347c7ded4c900cce9033e1ef5586c74c73693e9a5a5a206272605253197a05e3e5459f95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659609d42919762b9d0798ccaf95bb39

SHA1
181b4bc178f5301102c0acb92627d35d6f83bb6e

SHA256
302b7cd8949d080ee3e6fbe602c31d0683c158644bf9ddedb04a69063b443c17

SHA512
630115dd0c3cb8ce6ee562d2b66a2284932a4fac032e3a237d404063062f7da6ab43bf54c309ddfc0801d50a4bd848b8f21257ac4aa146ba9f1ad8692ce77e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83226c36c495a608bb21c37b27703ed5

SHA1
de671a057e7ed52eddf4688f3e94b0443495964b

SHA256
95102fb5d5d68a6a1a1c8285b64d44891e3f599c8b89498b5e384c96ee4185e4

SHA512
3caffabf071ad7acf6227900ce46b00e5ec6495008ba3bbb3a8dc6ebeda53e7be06dee9b684fd9108f6385b39b0f6630a0c36969c95ba88dbf6eae385d5c965a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74d6dc4dd56260970778a7c9b9ea9db6

SHA1
a61a0b923bd7a0b2a4d338abdd3ba635409b8a14

SHA256
30d56bc53ef2747801f4a0416a5340145037bf5db59f31fdab9a68ecd7754ec5

SHA512
aa285899412f3c9c8485d9656cf853fa487ffc2d6f1e502c0ecb8c8805351959dae0b5691332ed7f1f163fecefb88e7c4d4b7ed8e67d36a9ab072cce692f5157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90030c95c3b7271088abb29a44fc0284

SHA1
b790b97f9145b7e38ab0a76c8ae088c1df8384d1

SHA256
cecac9a1fa4072da4d6d6481939813e6ac917010565885ec105e5a9db7c0d758

SHA512
7ae70bf0af835583a8ad0a9574a274bf82caa25172946f4843d5864574d8c00ed119da3635d93e54e09a53437ed7dc233acd7c9ca3091527fb061d530c620456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33adc6bcb4e181659eef1d714c11eca9

SHA1
7788b2baf132f5b49389a5db4dd0bdfdea1ba190

SHA256
7a51715c0fe97af7c94f6c347c6086a92e5010c71614afffc4c5716de7e9af41

SHA512
774ea2a0cd8ae9604e802977b88028ba999f7f118c773fe8c04656f6de9eff77ae6b54bc45c4dc6199c624e5f6b01fe34ed410a3f78ad643bdec209d0989ddd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7126d3f410e1d71b867be603c13f74

SHA1
cc2a429a92052e2fae58226f76aa4b63a13e5e61

SHA256
21cbdfd54f76cfe94e5bfa2317a5e6908587e1465aa82ba002ec8d18a32ec1c5

SHA512
2ee75593bcda161577d870957736cc2be95e1186f3a2b6e46b879def268b02e39d3a60be01b647e485aaabf27f61ea750e2e00fc7c69d7b3b8576ed769637b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7085048a6e9a76922c7ac3dd001d3b4

SHA1
9009ac1534886e3006d68f59acda0059d2e6e6e5

SHA256
5664424aa6ffc3c8a5dfde88b3f14917d248f69a1f585c8b8189c26f0914704b

SHA512
3edc0b72cff6e7499034dcbf68fb7db65551eaa1086079d940bae41383bbf91c13709bca8692308d5b1283cc25520a518987b0ff9f079af43b34cf34caf14e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit