e8719813a72e37f3fe70913249dd171016d5332dea01f769fc4fac11a29d017f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac94a295b13a25c3138c5005ec270aa5_JaffaCakes118.html
Size

37KB
MD5

ac94a295b13a25c3138c5005ec270aa5
SHA1

dec3a3bb5dbe58e3d65d47e42714f45709dec938
SHA256

e8719813a72e37f3fe70913249dd171016d5332dea01f769fc4fac11a29d017f
SHA512

e0142817999d29c606beb28a3848af8cb951c608142da301d32ca1bc82f287d429b9df33ad21d41cae24ffed92fe351f232e82250f2d284e4378448599a14cd7
SSDEEP

384:7iuX6qsQ/oq/c1RwkrGtEGxd5mPR7Lbe0UmL7upflzbf:oqOWNiR7Pe0UmsfVr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23247781-2ABE-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424580027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2904	2932	iexplore.exe	28
PID 2932 wrote to memory of 2904	2932	iexplore.exe	28
PID 2932 wrote to memory of 2904	2932	iexplore.exe	28
PID 2932 wrote to memory of 2904	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac94a295b13a25c3138c5005ec270aa5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
306d1287442a2052d036fed3ac48d4a9

SHA1
ebc463ca29e6ba9057b12a195ad74a2a16525069

SHA256
7a49ff41e0e1a472e5a61daca5300530a0918180f2af56bd270dbc7f3d1c90d4

SHA512
ce67875db1fd77b04e9bfd48490a0239987130e50dec4583986cb3440d575f6c4f0dcd74ee298421641cd652762a25c17ec95ed2911312755e76c1e3de96f691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f71d83c95c1ff65c39665594e13270

SHA1
be54f5e3833a5b47fccc52d822ee78bdf3c8c4ca

SHA256
20181f76e8ce4501bf37d867f807acd806fb7ab0a941d689e5ef42a22b059998

SHA512
05708a5bd02bd1a2b06493483d8b235141009fa6aa84a068277a7585e37cb236a5692a1f7d4582883e449c5e549a0e229b53601817bd8a2edc2fe4a045502955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e664284378229fc6d10812b340648366

SHA1
de35b4f4037dcdff218454eacaa90f77837c1b20

SHA256
456a4d0a663fcfdba7d68c409600e1982d194530225d9621086831fecdd93016

SHA512
3d487f37b65d6b677e67809259912ffcd20c4b04b6bfafff4b25586ff91b3cebed2382dd52ade5d56064c1ef9bf259b5c48fbc937a9689909ec4c232ce691361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990e7dd27a79c9e784244745f153a7ff

SHA1
3113d313757d037068a3bac46b8ac174853737ed

SHA256
0209b242ed719160de1fcbea6ea329707b00404e5e3c9f609b851bbe32e00c5b

SHA512
58d98fa50eba33199682e9b12e4f0287918289afca4c9496aa267c1cbacb88b21295ea916bcd627bfad9aea8a279fab1c3fae4e69102ffe70498ede81fee4c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ff4b13dc7dca2c2cbf650aeaef9f39

SHA1
e6560b53f1afb6df2320cc6b7b44baee09299d6e

SHA256
543dcdca914b929d361d3df067ffb35d902db8b067a4f64fe9c1499bb6834c17

SHA512
e3f5d9c7f1f79653adfbc7b3967a81cf7e6011bcced29a83bb6375a49076a5160fc751e53605ed6490eb2c20781d87b6899e18ffa53cf2aa5493432a1dc7f9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cc58c122579f88637b8edd9453e1439

SHA1
ae164a901c48533050f38207d5bb8540f24245a9

SHA256
5bd340fcb0a72119b62b7925142c40b19a6c452d0800f07bc4e03b75ed4a6f82

SHA512
d92b44bdf2e5bc2fc5925a03106e02705f0c59a4e2aeceaa154c051ea7a7b2acc191de6e0116cc21d54663734f23c8896fb5c2283bf2064ff1d2d02e176df8e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
859da82184922c4564a6ee5003b3853f

SHA1
da91a75b5c0c7c6e84cdb644011f51131c3bf725

SHA256
22ab357848363dd93ecad0bf7fdc6febae4efcb4668091db1b9ff046f93b177d

SHA512
fe22c018870788bbaa6070bb4bf4eef4aac190ed8d5233f082d15b73d0a1a35dad238c011d8cfc6fb5f57de5e88257f29cf376d9ec8c02d7eefd3edc89e0423b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78daadb2084bbd18cefa893cdaeda0f6

SHA1
bf7966daefa2f06a5e2b1e450ceac9af704a018a

SHA256
fceb33b6cb4a5235ba5c0a5b3fab4c244d7deac4c397cd024c79613887b1876d

SHA512
111520c8ed35eccfb0a6fb0f5a9af13bac0da0fa0c0ac3cdb9653a3cf4503faf71db045f8b62f0757433666556842806a34d33d6528feadf7ea346585d268142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1660f0da6eb1ccf03cc2337ff13d944

SHA1
cd6c3803f02c4fc74cb474a439fd29e46741965b

SHA256
5a6e22a25deadca20c3378fa19ae3698e291486ced410eb6cdb0c311d24d0fac

SHA512
8b92673b3fb705ad02d2bc238904dae26dfeea34f0ec06d5e78bf9a30c9ee6e3bab0a2cf3b9f163a58701e9e93dc9f7c4cb2dca9f1d8ca9050bf081a685aa160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd6fb8fc34343aa531ec45ce5a52c8a9

SHA1
0f01bc9b250d000144fc3aa10f3d6485cfead165

SHA256
1f4656221c435a3a83590f54baf379bb5dfe98561339a3f6a2a4e98877a4b999

SHA512
414f64ee5cdf475afbe7d2d3422ba1e653ea1000f55879cbf795f4544aa4a71b5b7977bc3d0285f468ce400a5cfdf22ddb1eb0ecd86c27a5340de204b29dd032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2187.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2268.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit