f7ac021c4b9b565a2ad1b94da628e5f2ac07daea948d1bc294c8c06c5a020752

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac308ae7c937d2efacc9bab761dd48c9_JaffaCakes118.html
Size

31KB
MD5

ac308ae7c937d2efacc9bab761dd48c9
SHA1

32d2929a8abbc3b52470067c75a0c816d1eba315
SHA256

f7ac021c4b9b565a2ad1b94da628e5f2ac07daea948d1bc294c8c06c5a020752
SHA512

d56c96e9836b0df37bc719c167967cf81ca778cd373f985e49f9ab8bd07ca4ca3fcf4f1b55b816f165a20d5b71824e08a4e4c80ae6c8cc62eab6719cf466e875
SSDEEP

192:uWL9b5nq5nQjxn5Q/9nQiewNngnQOkEntDHnQTbnBnQTMCQAZbLU/IfyINcsitOX:RQ/MCmLuxVP2ZIAlkDOB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424572522"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA612F21-2AAC-11EF-9680-DA96D1126947} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac308ae7c937d2efacc9bab761dd48c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eee1c9581dd2836d4d62ee513f7a540

SHA1
279936bd467fec8e9bc2df2a7b5414aaf245f6e4

SHA256
b1779c1d5bac728b1e5ef5d2919ea85911fde295f2494a241537d23ed9fd0a36

SHA512
e95a94538239189ef0b9d4e02c4a9e0065590c60e9af05e5b639bbe41a14a8b37b58203c0051257ca247ba0558568d74288c0d2b1a0e05fdc0d243d09e259d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
956b49047909925e46656326fb4b2910

SHA1
00e52ef5fffc6319bc5dd6ab1341d53a1ffd881d

SHA256
08bfed8520a3397216d75b42333dddadbdbcf79821a2c47759e4946c13bc2c49

SHA512
578e19b291182f094bf2d705f638c8d6c6b01d94a137d76a32bcb688f4489b8ea4b6791d902721d5fd13c68731e42304f048a78400f3880ecbb144d405b977f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
075bac8c3b4e4f5840ff6a7a3d1ae793

SHA1
6c90a1567e232f9fa345c76bea2c8b420d372d76

SHA256
ecb57fa0604099d02e4de984edc971d145c8f1c92f566cf859cff146f2d235dc

SHA512
83fff400589ab763d3f7286d739b7f5a27b67f8c38698cd58626207669ceffe1660679406e0151300f853bb01fecc8f1c2e8c6e729ff10884e28e93732a78b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22cb7f3a6b04ad6e5a77eda350447814

SHA1
b9af64c75de76dac6356f7e4b6bb66577355d1f8

SHA256
c1e1eb9e358f9c598328f807278e0e328446bb5f3d2fffa6fce466cb54b7e7d1

SHA512
74319aafc6c71ea8a65db67d4026e76378580b7be0bd047dcf45811301fd220c51107515b72f1f2ce0654b886335a55e1d5014cd54997cec37681982cccfde35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93820dc99cd2635595a8774074fa72ef

SHA1
ed550fda66e14c08f6b6d8d566f87666e69bb7b2

SHA256
6b8a1646559dca9a212857428e6c031922d4172bccb13e34ddf2daeec28061d0

SHA512
f4892163cb3007825e38a8ac50cd54608d833a331cfb7e4aac72215b39236ee1e56d05ee0517090004c2fb212fa79cc993e0f089271aaf8123816403dbd1eb5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c13cf9b4df6260bcf7e17442764518ed

SHA1
bd87705ce8c14cfc0136557160e5c99acfb08505

SHA256
1d41420a1e617e61ad98e9bd693e8a1e82bb4596a2250ad321243f7c2510ad49

SHA512
4f5f2e20e19a475f1039cc8d2f6ad8c617e5c5e1bf9f07dc691447daaee3bbb8eb1aa6d0188f9a7a4b4bc1260d74202dcc53fd9edef97e8e97e803d3cffa2e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e7b2dfea7d44ec4f0a2f146ed1d0ae9

SHA1
4f2d7113f74d455305ab3e7a5a4fb9afee326791

SHA256
280fc275509fb825191b39feaf6c23db5d7ccdcff5cec053bc54294921cb3142

SHA512
d71b7cc612f8bda06c3cb1344407eff0e84b477938eabccdecc73d05d4b948f006f46719b991ac6abcd3bdce54b03c7cc7c0aaea7145f4163dccd49b7a908773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
136d375e323e091fe3055ac33a8cd739

SHA1
4bc1a2269fea39cbcac9e57a0f42dededc04fac3

SHA256
0f000ffa9ccc7facb843e313e3686c17f472b51d77a2ce620ba2f5f55556b736

SHA512
c334546d4ef9bc8ae17596853b531936759fec0a44fe65ef760258e2cf088a6e64a7cb7395299cf27c9fa536d51d15f897aaeb6b1f1a735af8a4f5f28092950c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae4e42c4426330ab8dec59049298e7e5

SHA1
dbde9ba69751d9f1521c35502c67be3a2c8ecbfc

SHA256
fb3a992c6b02c0c389c2af0486402778cf7ba016ec22dd227671648cbcdd4036

SHA512
c15fa042828720fbf3ab84da90b08e4fb9c4cecd467523c714c3aee608ead5f24268bb8d8e0d224ab8a3e30ff5761f836ca0a48db64d376916f9a6c07b10fe11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2722.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2803.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit