a873a7403ccdebefe3ee99d8977317ffe6d15865d07dc0ab9691215a2cee83de

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

995cf847dbb02d362b453a4be42ec4a0_JaffaCakes118.html
Size

32KB
MD5

995cf847dbb02d362b453a4be42ec4a0
SHA1

217b387c15f2eb9fcd9a17dc64babc756f623aac
SHA256

a873a7403ccdebefe3ee99d8977317ffe6d15865d07dc0ab9691215a2cee83de
SHA512

f855360375e30a1fda08b5aacb63325fc2ff449b8734f2e586197e7206bf0326887fc52a77045e5bc2eecb8098918a9b8c84ee2e8495b0a2c5ad81bb2935342c
SSDEEP

192:uWPKTb5nKZnQjxn5Q/xnQieMNnjnQOkEntn/nQTbnhnQkMC3ALSgphIWdgTrX8b7:yQ/Q9fg3I2qrcrsRAHEpoh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53107F91-2387-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423786826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2164	2372	iexplore.exe	28
PID 2372 wrote to memory of 2164	2372	iexplore.exe	28
PID 2372 wrote to memory of 2164	2372	iexplore.exe	28
PID 2372 wrote to memory of 2164	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\995cf847dbb02d362b453a4be42ec4a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e023cb27f6a191ac47ef7aa594fe9cb

SHA1
4f49596aba3e06353532237081b8c94220194931

SHA256
9c89f6fdf8f3a851ea92f64bc229106326bfc0bfee1fde730442b43a2260d364

SHA512
b9f7f67c1c41717d378799f90acd405d7f8163df41eb93291d74fbf12b3b0be6beb89f2259b487196c7155859fc24ce273d527483262c7c7f719b0d0331fd907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da88e57e927e08e757c8feb82d3919b6

SHA1
a19187f4c41b5be816e4061dcf82cc83dae1dcbe

SHA256
95a88ab5c84f6b0626990f2b4a354656c3a99973ef1248af1d09da17354125b5

SHA512
c62a131191d80109e5149713278378c9d7f8ee68d630cd1e8146d4a6a6e70ef674c91ae7a6ee0283e6f8e88a24b2c1e0f7e79a9eb4a31bec31521705df1d6e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71752e32f44bd491ac18956502d2bdab

SHA1
9fdc5de1c0070983b5bd30f6c7e9e37e4ac74e59

SHA256
0d66edd04938e0c493b446b05f4a54d320dc27166a6fd575e87ed96f8f4494e3

SHA512
40b19489779e2f91ed2c69c7eccba0fb6cb43f7f01671465314961dd7bdd47c9df4ae912950d2a57651cea150cf7271a2a06579283ea0abadebd8cb6c2306ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13bb133e33ebc64d438cbbdd8978cb8b

SHA1
7bfecf259987540ce4fe52002a48c12e6e9f572f

SHA256
f376665e0a55d7acfe9c1526c6a692a1a59e331aa674ce51e523b24ed1e10137

SHA512
bc0a1a1b8a2807f606f2db1d38c699d4d68ccf219ae72261f47e399b40c73c71257dad20a6f9cd82ab96cfd1b7ef312b4d9ca7acd09ab47ddc36fe5e808fe3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0c64729b7230369f240d1f649e6ef47

SHA1
792c94fee0e1684064f531fa1b42ea3d401ee8a6

SHA256
6bf1a20dcf91e29690650b3a97904d533e5db07a6bd8b99f4a09e61fc18ca766

SHA512
9b81171acb11f85ade38300b2b68c3300817aea2f273a7952f2ce97b8cfcf95e434872d3fd8aac015a880e44be32262b880fec353a3966822fd4befdd6150836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e529698ef6d7b8d55bf3a3c080b221

SHA1
063a655783b3d2fc1da3938e3aa670aaf8d10481

SHA256
b88a062ebdb232e18a374f2632fce8f2caa58d0220296305dedf031605d9d76f

SHA512
9d72b7cfe4b40088ed246d017b65e7b1df79f772e428c4d3698c17a6cf8e7456233a1aab59b5e5e2c2a051f4a83abb4b6d0e45fa320745a0d983cfc70b14501b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2977c030c0f4844827874acbdaca3b3f

SHA1
ea8c48a8eb025c3fd717bba496689ffc84f3b8b5

SHA256
932afcd15c067bd56387f9a0ed2c54e6bce3b018e99b57fd012ad0b82089453b

SHA512
1815c64584e469cb2b6c322c8774693aeda4ff3223a02128c497a31ef6cab084cc10b6b4d45f06ce654239ccc1c440d29d8a0e9dada582809d7bed981eb79dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e9876c72f02513ed74cfb6a188f6783

SHA1
9d224e5739c8394bddb456386df13d6cc624fd2b

SHA256
9b34751d3460fe92fba794ae7296af4e093dd45db08ff07e9dfbfeda9dbed3cc

SHA512
7a1750a391c07f1b4758d620f819ac9295160af80ad1d36ff9b5ec1e6e1b1ec856a381b2bbdc22d9bfc520bf0f27b87ee3753cfcb26b34c305908f0ee06e6ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab189F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1944.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit