d710dfddeb3c3865d71e798ccf62517fb71323417f1aaff3617e7fcd6354de8c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aab70f04d352558f93e9abce554ded1_JaffaCakes118.html
Size

23KB
MD5

9aab70f04d352558f93e9abce554ded1
SHA1

c9b9de4e52a9305689a1e7decf54fb82f98a87ea
SHA256

d710dfddeb3c3865d71e798ccf62517fb71323417f1aaff3617e7fcd6354de8c
SHA512

eef9e332a3e2e75c6b09b77ac25ce64b50e86693ebce80143f1d706e4c2186863192bf93e41893242e77676dadbfcf4bbdb7bd55504add2a397d618fd278446c
SSDEEP

192:uWfIb5nQGnQjxn5Q/fnQie+NnnnQOkEntNFnQTbnpnQkCnQtkwMBeqnYnQ7tnCYp:VQ/zwi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0C06021-2724-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424184379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2112	2008	iexplore.exe	28
PID 2008 wrote to memory of 2112	2008	iexplore.exe	28
PID 2008 wrote to memory of 2112	2008	iexplore.exe	28
PID 2008 wrote to memory of 2112	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9aab70f04d352558f93e9abce554ded1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63a651b1e5087c8250e2a57142239465

SHA1
0430315c6718803837e0c35fdeb483400e91bf0a

SHA256
cd18416a9f4c266c998e3e415662e525d7b03708b8622016bb138b723d2e5ad7

SHA512
140fab236030440fc9d2c32d2421cc10bbdbb1bfa767a7455b64bbd633e57bdd3d7cb782f6a24be222166c6b82f113ac8d9e76bd1b3dea498f088a18ed38f248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b96750cf7dea3b0de49963fa5f56cc39

SHA1
574fbddd78e2d9d5e96776b9ac67168b66118a8f

SHA256
1dc61f129aafb9fab678b6b07a5e71c16b73d57bcf3cd7726deeeda63d75c039

SHA512
95d28308a5ed88c991d66702bcd3ab4b55327425284294b5da9b9f3aa554cf50c9ea4e82816823cc192c4698bd6d49cf3656d5884bfc7fa19f3515a7a7f8e418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c4741fbb598f9e3ab34943942e44dc8

SHA1
373a7abac1fa1fd53335906b8a03ede7bfc128c5

SHA256
730331f44bc9d6e7df0a055ec084e8d994004a0b6f2b0d1eb280b4442ae873a3

SHA512
35344fb9d87e5c851f004201ebccff4feb9c460ed7358464be6fd12f66bd4be68525f8c88ea1eb5cae7f1f13a094e708766aa576760236c9cd7cac49cdeae845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14f368b70c9ea6386700b34c0c370cfc

SHA1
c49081ee23f528e491948c49ce1e0c8a730a213a

SHA256
4b20b0d1ae3fbe4333af813869374edf0128af643ed139bfffda7f84c29c84bf

SHA512
446c2eba42f556d6159afbc98bd8f0a30d70b7ec80f5571b7a3f834cecad2057ef3760a7e5e7c4d7c080ba430f036babb35571e780d4556de770ccb2dfcf9dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d24acb4d2d82b35d59283a9efad8330

SHA1
df137947fb65cfc8bd3748c0c1307da85f369274

SHA256
e053b3f8f05a8dbdb9cd1eb60d55464051b679b9162fd100c086fc3bd5596449

SHA512
3c7e2287381eeda0c92b9d52e7aeddb23d77d5ec2eec6a3ad990fbcd328950466125cd46616612384e8ae99c895895008ae4424e62dfa65e8c84d8e5b912555f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3247cd9b41b9599013319f7f56ad73e7

SHA1
bad1f92abdad6fa238e9faf7113904e051b9f35e

SHA256
e1b998e68a1031aa35bf04389b2e887a0f4f56765285ee02f49f53ebf5c9959a

SHA512
f42b3ecd9d5fee7e33bc6f029c2093796e0afeedc6b43efac8c927d4a9be11f32a1b384f2b86f7054fc37303c2a662d4c89299952f1d58837a8b7debf0e5f826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50c2741284b3d6177014e4dafbb299d5

SHA1
399fefd73c29f55fe86e723f6fef8647f7c22cce

SHA256
a94b0af78e1e60b6ffc5b2d9d5ce614e0683165a1c05ddf698124cc8fc28f899

SHA512
52f88dda73ab8ee97e65d3946a73d985d17b7c3f62f2d3e3115bcf2b71fe9284e4fe09e4df654ebe922712c96794bd3d46a4474e9d5a375cdcd4d53b1547a043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4eb1d33b67a9b930d6274a72c59c318

SHA1
74193252ea7662500c5c8f38d75ab21311523ac0

SHA256
f1103f98bc4382778a3c4907e45a462c0db2300ee0ab58c64f4093a4dc5258ec

SHA512
7cd336ff7377cf9b12e178c1851c8ea0bbd305d5e49ff4c57a2ba960882512af45a1d7b14f20cb78389c50a120b49b72ca3bb6e96345e77b9a5042b2a7d1a270

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit