3fbc5bf9e13d33a5ff041bf9d765fea853ef2e4cf6ac56d5bab639310d7d903d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

940bc7f6fe5977ec25af2339b8c9d95d_JaffaCakes118.html
Size

27KB
MD5

940bc7f6fe5977ec25af2339b8c9d95d
SHA1

703097c69ea98843e77e31c9886ade945b181aef
SHA256

3fbc5bf9e13d33a5ff041bf9d765fea853ef2e4cf6ac56d5bab639310d7d903d
SHA512

da3c36c77ae7e84305cc60921bd216e540a32689bf6841bcab8c4d9e409426f63b0829eb8eaf6bbff6cb68486415097087683dbea343e69d671242eddbfde508
SSDEEP

192:uwz4b5npOnQjxn5Q/snQie3NnmnQOkEntoynQTbnxnQ9enXm6lXBPQl7MBXqnYnl:YQ/4+JFBOShV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A62F5E41-2246-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423649098"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\940bc7f6fe5977ec25af2339b8c9d95d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
317cb50eb027cc882913de6e4153126c

SHA1
69232f6a908c8c4d8cac86313c2bc1f99b5c9aa3

SHA256
d20e364173437bc9269ada4b73c04ed04d6e1797c87858ef45a94d12a7dc90fd

SHA512
8453564dee551ac044503a1da9a30ab1c596638be5a91777d0705d9dbd9cd7a63c0f2b6459850a0fd55feca6a7ef289a99e3c6b4ddb617cdf94da960b9d343e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19b4bade6790d0592bcbbceadfe62e1e

SHA1
ed85f1b93fb2c92a167e9b915287898f53f95ee0

SHA256
3ed8f91c3ad1d8192b15d0bfdd01e5dc8dc45b31bae3622009e7f3cc5d833c04

SHA512
558e90d5575e57ade8884cf536a65b7e4b4ccabcd2bf02753fa8651854f96e537adde57bda897b1bccb389fc097a7367b39ed1270c68a8d0c1bcb91f108af79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59570eb052dc2b43fdb6b9422111c2a5

SHA1
aa5d16838c288c9e1f557cfd94a36a62640a37fe

SHA256
ba34730c463c62f2e875ad00d0da54ff67a9e6b25912bf06fd7fb63786e7e92c

SHA512
df60a9ad2a6150bcaca7aed2ef45959c4061ee6f2ef1394c20c1b8ef0d4c3bb8192970af78458b850c476b68e10806790fb57809ece5e6411f91e08f726764e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f686bdc89fe0207db84c4a058b96a4

SHA1
221038039603d21b268f13af6b81e2e10bff4d4d

SHA256
7d9b721f9b9643ab9ff4f3518bcd76622a309ad4ad1543271d93cce7743b547e

SHA512
2e18f92572b862474c67aa934bb10abbe1edd7d964b17b65e62c48da193499c7cdb59eacde8e0f483966f618b07b9760c24e81c33a24345deeac30fb05a2d5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bfb6e22d4ee6c96a69cb4d8bc84be50

SHA1
cf7f9277d1620b433e4a3630fc6d1707a82b167d

SHA256
dc08cc8c07219b25ff62549e2406e525cfd3a3620b3739d0902d8eff543b8d8e

SHA512
2ced8d2a96a5267c584d2af36dcb5f0ff9a364861a9ddad5d664709102c0192eb73721737f0c7f0decaa7f767c51045c30aba09e90a1152c4c18824fd64c840b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25b390efa705099dae5edac38c6a7697

SHA1
41ef301f4ec33367cfe0830885519370a7530326

SHA256
92e4fcd96587c7adde5b4cbe757873dd39868be1e4d0fb441bee4aef26c29fa9

SHA512
4eb898ab155e54b46d3e2e0433cacfbf4375aea9f52ecdc7e80cbc2ed4b18084ca0ff84b060e7129a8645b7e3214a05bf0b8e7383acabdfceae7e9d7352236ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c58c5be7c6c83f0f3d7993c277a00ecb

SHA1
3e65d880476f5bb22c3a3ea5d22a924ba4c9f6bb

SHA256
74b13e2ce3be2b3fdec9e2cee5f8dce4ceab873a3e55be484cacdf6c074b7720

SHA512
1034f9548ce4d78d2f5a592001b473639c3beca6f366e10bd19b7227f760cbf6a3578f7f8acaba658bd94a258b75a953c0bd757d43d010972e27a2a1ab1d85b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fd7750dbd680bc8866e46fd35fb25ad

SHA1
4f2006e40c9e8dcd970864aabe31932da0c17186

SHA256
4454045574349e3d43c5ee94b8697215c980ae1caad91ed16efce296956ce724

SHA512
e49b293d9b2e3dbf9343b2023b12f2a97030898eb17076eed15f52fed76c63b93be782ddeae01d1453c260f27f4bec8835d78a94505f9d155277c2a2663dda2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
900dc8bcefde280455ec38f1e818a764

SHA1
9c5b5ba484aa3ca43a7398379787054c2efc3a1b

SHA256
9f9a34135d7511f9507cfd64bf290979d2164f2eaf8dbd1cf434f18622784b73

SHA512
b0020d1a75343c1dcf562a6ea1b30ce9473794317fa69859c78e5611953ce0349da9cb08bd08db66e9463a739a70e850063278b77499252dfca8907253fce4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit