9f9aa26e9c85ecff045560652359ba2d6999264fe700bba9a264db048853afc0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a8d0c5ab9d674b17d57ab72f86947aac_JaffaCakes118.html
Size

26KB
MD5

a8d0c5ab9d674b17d57ab72f86947aac
SHA1

973f2e65dc788af6904bee91afd38b5101eb9809
SHA256

9f9aa26e9c85ecff045560652359ba2d6999264fe700bba9a264db048853afc0
SHA512

7d6724f5983eb249265b6730664697badb0560f22c6e40c38a2baaac51849ee568b80eb623d3938913c4dbca861d6bae7bb5fe9395af75b266449d1316dc95c7
SSDEEP

192:uqlrDQmDRRC4pfNVb5naP4Wk0lSTZZwL/vnQjxn5Q/EpnQiegQNnkEZnQOkEnt+X:nJQ/Xygcr3vb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{380162F1-2A2B-11EF-A293-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424516926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28
PID 2172 wrote to memory of 3008	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8d0c5ab9d674b17d57ab72f86947aac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
324e9d51973cf95db42ffda7ad07ebfd

SHA1
b193005e89b0ff4052c2dde28f631d7441d806c9

SHA256
a3ce9164660f6694748910299e003a3e343248e28e7375ceff30496fbf58373e

SHA512
d0d60d27de4f53fa8511d01190b44de36407d9b6179171345ba7bcf60586c51068e187159f020d088cc45fb38ad3fa3a4e4c8a089c473ce134bb4254c30af9c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0ba007258abdfb0fe2f984356fd892

SHA1
bd6ff6e0037cacd1de617a890bcbc9889b872eee

SHA256
0395eb5e2e96faa51b99e754a4a9da60008a1118c97c3a8058647f500910586b

SHA512
4e891ef668a02630806e542e82e634f035ad87aad159a45dace9aa27900fbcbe9243a5d98759835d621b4298f948ae5e7f1c2d781684284dc2a683dd7563cf36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35eb38053b2ccecc567a8d915965548

SHA1
12eade314bcaff0d363d13bbaeed4d6852fb4fe8

SHA256
50ee3b14fc42095d8b465d54c8402973319315b6d1cbd471348ebf2fd70d9da5

SHA512
19a4d600b1d164cb719ce7f456d3fda2b8645cf325b4b89c1c8922d7fc2e3889aa4aaca618c5781bd05a487e05dcf16afbec7891c4eed40eccf7a217da1039ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f954e77557ebe7b39c92206e10f66dca

SHA1
24e93597e1e23f6a02f17ead465a38e48d961450

SHA256
70e983f79ca03540339b66ed336663056423850598c42fc1ba750a524edfd232

SHA512
7d8919a82aaee77ec4f5dadfc3bc11c50933b2f00f6bc2a896bdca6ebd0c3d112b19e21f6aff969482418a88b2df9d48fa144eeb38e3d06d0fd9ee2907c8f486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c7b0fba7b9774c90ba863a955373aea

SHA1
0f90c4e44d79938c6ee56e0d9256c35d76ca84e2

SHA256
44ddac2fe250f14d0e454cf6f46ee146559f2821fbefe1b73ffe3d0a358ff64a

SHA512
eddae0e8e04f6a02f9048c242ba83f609373e7574ebad6df0b76093e02266133a79843d0dbf864b43fed89754a7dfd7fad4dd8fa72530880eadfae097eddffa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
098d985606194d30bd2601d29db8a4bb

SHA1
276c0f66ba81a9cfbbc3df54848dc6ff936bd2d2

SHA256
8bca4026ca354fdaf195e95d4d6fbc898bf8e4417daf0aab95126389692eb691

SHA512
3a15409eecf2461f7ac01422fcc3da569c3e178e5469056189659ad77251adef607b4c6e5030e06cef0ca9a1784a0266774a0cb2cafcb98fc97f99a565923701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9dd89db0c4a8a8f2e454731bfd46cfe

SHA1
54611e7c94a6d24aa184a8cd622587f73c31310a

SHA256
672c0b7646a0568df211260caf38dd218f1ca99b7bd0ca51795b4b453d5fdcb0

SHA512
a78237ec2b5321fc92375c2739a729134cc3aa7d2662946dc50b89013b8385c5295f577aec7ab72c4b15567eba7cf0216ba4f2e0a956a9fce1328d114e588683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068c63c7dce027310c1abbe5d7df69f2

SHA1
cf922058ff5977b092d12194133efef9d2b8fac7

SHA256
e028a05ddd38460f97357dbb23a9b19a347586fccdfe573fe2799a198d3532eb

SHA512
b6fd0e3967ab78869bbe5e90f5533a83ec47f34547c473c0c34f256aade293b46cc73769602fc3568bfc204b2c8564a692661c3fc8cb4f6f12e9affa13812853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf7c862c009e54a8ed26ceee0847506a

SHA1
f47cdde075e33a9944e2e4f5c8e22f03c0bcff48

SHA256
86d918c4337c2b99abaeb6ed6c074ef4ad0c0f47f1dd055ba73a7497ba14d734

SHA512
91221c2c7a7e59b6d09dc6c50e4ad39cbec3cfce783b19097e307fd4eeaeb39a5169e1099b0b63f17b44c13efbfea2d8d9d442315692cfb46f994efd6314ff9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14C2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit