8616baf0124b8832589f49e637471a92ef52fe1b6a65b9d44b1301fe6d6b3561

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9df2e85f2668e2026485d0425f72dd6_JaffaCakes118.html
Size

34KB
MD5

a9df2e85f2668e2026485d0425f72dd6
SHA1

0fc2b9d9df4302bf79113682be07857718be54a6
SHA256

8616baf0124b8832589f49e637471a92ef52fe1b6a65b9d44b1301fe6d6b3561
SHA512

f159643e60e14f0f96c725e6596ec022ab728caf9c65e2f970c24b413f0f4d8188eb98d9382224e036586b2123d613296e5660251ceece6f9e1470c455cb6c62
SSDEEP

192:uwZ/3++PZj6myb5nqCPz7HmnJywnSm2XnQjxn5Q/sWnQieQpNnMLCnQOkEnt2gLa:pQ/IvS05EyqRWwNfT78n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424532967"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{912C0C21-2A50-11EF-917A-EA263619F6CB} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9df2e85f2668e2026485d0425f72dd6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d39d353f42a9ce176c6dd0b496daa51

SHA1
4dbf936774cf6729ce845a57f7bd2b5ba5aeb659

SHA256
5d9edd3c1764d3c77e0e8e79f78d86472b858a2a2ff9704dc33fc35700ebd91d

SHA512
007244a7176db05122d400fa304bf3bcdbae90ed993950f29c27e15fa4021e003e6c3776e11df01b9d240c1e4a5a8ea53f6387056266f9a921a0c0e97e18cde1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a1eb78697ea9f2e79d232fce5c2785

SHA1
65067fae3f8aefe46869eb02e70cdc9dfd6e905f

SHA256
801012cc83b6689c0600ee808a0a765b1df1f8f8cee152ce57d2b6933d49de9f

SHA512
58638a027832ec517e9ef5f5f454b4981f08b02b6c91d5afe0fd2ef1776831c810a08ee396214a9616704ba88064adfdee616e5b385a0756861a1312a244cfcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96a2ee2a0ac5dabcc29a58baba5ba845

SHA1
2dc3a94bdefd5b04a4ec946a57791903f8387b5d

SHA256
0fdd9974362d802cac974e397e466609e91b61d55c794bcd9edb00a6287613d0

SHA512
7180446a01dd26d551f1801352d2ecc066152918d347c620f4a10a4ade14c5dfba0872ac977ac63d5aecb6385c5d3037f4ac49072bd484df6c78a926b299c95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9fce5d367a3be4e57d8f73bd989b95d

SHA1
b0ebbcd5ac8ca80c37a68d401c386ba61dedfa9f

SHA256
1b23d43a094157161b9a64c01b75fd408fc17a0d4174d0a659a001160e6fd7b1

SHA512
7e179aea39c1da49440fdfcab8041f713c4f130845358046e9803609174ce37c7b22670ad5fc5528f9ed953a99098c140571d314608a0f179653e7d70addb209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d0a357d44f086444a51ece0109d4c08

SHA1
086615291c46341777cadafa036a007d10580133

SHA256
f1eeb89a62953a46d6ff508541c211be90fa350ef5541cbcad2a363ed09c0d5d

SHA512
8384b6efa51f104fcdf9635d19195b662fe13786c068ed47227307a36d458a13a4a1398b4ebf79b8d4ce34e1956ba2de7d2f3460ae858981b4befa2952b9d41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
847f45130d445e6da3d40a727f702623

SHA1
92a047589b008a886d2dfddfd95982e55a0ba679

SHA256
054b6ea83090e4e33603ca13099a954f10f621c6732da032a397f7acd4bfba2c

SHA512
a4435a2a1572557ca96f5bd2e1a037e893300ab55f944e1eb454256b92f0a954b05e749c1cb97346a5e1f30f89fc4ada513dff37879501f5d17434b974e6be54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef2a9ffcd2650c271fe58fe14fbe7844

SHA1
989e18b20d32f71c941a99150695c512088ea231

SHA256
a1176ffb0e218574b44d6222014e136bd2a9e1c2549c97da8e62ce55e265d046

SHA512
7737fa3ba669cac9878cf1abf814cfee9dbd6d67329faae8be3dbe90799adc696c4403836d628e8cdd03f80e10424175733910bc09da5a1c8420699a4041ab0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa10844051f70c769366990ae2e1e912

SHA1
2345cdfbc686928cd73c02a7fee31448a5b25733

SHA256
63987c1db8293331602c38564a863d9e0ab4117b95a46a77feb64a07bfd60005

SHA512
b7c78799e001884bfd8c436e4d8303a40e3b328a77b731ea9332578408e96566f3cfddf598b52d434d6337418b8ad7caf1202af7b10d28157627bbf1e3903d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dc5f5045fc87ba201d018b7fbe3db14

SHA1
ef30c60531ff2b3d827bdc1a5cd071b5e52cefd4

SHA256
d3808a0d2cc18effe436f75a51c8f2818a6450161cfe80fea95855399533ffd0

SHA512
37a6485ca189f6961c44c66cfb25c4d7b97e65f56bd76acb73c5941cf4b521802eb952a4e4c90e41f6e00906a44744847f88db2e1d3321f745cea653aaa871a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF00.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1001.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit