e9fe7fcad5f2f86e9cf016bdb19f30b5f545dc6bbc1760790564847b4915dd6f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

accd8887e73fe7fce592922f9eec425c_JaffaCakes118.html
Size

28KB
MD5

accd8887e73fe7fce592922f9eec425c
SHA1

93058120d9607978951d0ffead970fd64e6158e7
SHA256

e9fe7fcad5f2f86e9cf016bdb19f30b5f545dc6bbc1760790564847b4915dd6f
SHA512

d02da588103f4a096cbc0c096a4ca949997b0d650e204952d573004812a7bf6ae0c4ba57b00125a84dd163cfb1d373f79e75525e8ca5b2fb5bc99c34a41aeddd
SSDEEP

192:uw+KNKXKOKhoKRK6K0Klb5nrKnDK0kKZKnK66KfKFKiKKK/KPKrKtnQjxn5Q/c5o:aQ/DSVGnK1SL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC16B651-2ACA-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424585545"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2560	2036	iexplore.exe	28
PID 2036 wrote to memory of 2560	2036	iexplore.exe	28
PID 2036 wrote to memory of 2560	2036	iexplore.exe	28
PID 2036 wrote to memory of 2560	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\accd8887e73fe7fce592922f9eec425c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13e15c0b7eb3a85a79d6a6272351f4c0

SHA1
9d384f82fedfc5452b886e0a7c6c23233531249b

SHA256
5a168eaba4c69481e145924f75c3b6f0992244c1d78998c5120bc76b7933e90c

SHA512
a5cf03b85cc2b6e185341af7dafc4b15bbfab3b361a3e9311e57311716830ae4cf74cff4c41fea8f43748f8d22f67d9ac9b2f4f718a942ff010d21d798dfbe5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db13f0255209c77d1d89639f6952ed24

SHA1
d5847f5682ce722d67ca2bf5dcf692bfe4640f66

SHA256
fd462469e6dfd987e1874120bc0716c48c7426f0f63384eaf747b0aeaad3d9a6

SHA512
737697ae5926da26d5998db7790f4c313d8908e158020c0b79c257cc1a969fc55a41ea5675343bfbaea3281d7ca4662fc8f8e09e4671646e5a16f9faa7c3563e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0a544333079740efc4725ff57eeb67a

SHA1
a25be08c34155e34065173955eca6aeaf32819ed

SHA256
8b2261582080a8ffd4f9d06a3f76c6c775663a911a8176c54afdb2475d4a4e3c

SHA512
ef4d153795270e12516d4e02e57e9038d718787c2a5de60442dc016f6ae998878018e180f5c2bbb0c365c170ce98665f5d3d97ac776e4efb58fb4cfe928a80df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f9991f781c86f07a57ed6f65bb320c

SHA1
1db62a6f2727f5abe334a13535c853b78c9d977f

SHA256
e05cb46123bfc904b38bdfb44da810b2bfbdba426ad0da8673d48141203a7646

SHA512
903f1ebe6e75484d25abc2427b85b9651150b8d248b283a2d6c8c655b34fc917e4ffe29ccdfaf65ffc81db1209113fcd1f9cc7eabdffc9756817aae31821988b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f554284d15fd0d282499c5ff77a4714a

SHA1
68fc90cd215a0bab36de4fcafe642cf495d9d066

SHA256
cfa2c840c7d75ba3ae1e085bbd514d8738789b68b81f5ccbb5100f97b5acd665

SHA512
38931573d708e5eb33f333b1d2ae7813d9c9820b62b592f196b836d9f6730a0e28cd92d06665a9b4b440be872fe37e5a6e459e233bb638c3f85876469a2e872d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39654afbfea85ea4c3644854b8197622

SHA1
2140732b813c14f367756800cd7a6a63caacc6a4

SHA256
673f571966b93155a95284330674d48e6ef61857e2b58cacb470126070faa84e

SHA512
4ef8d7f194705021097b849e281415974278045a0f7746a3854d9be846a8f94dc06fdfb56eb08fe4376fcd82410a605d9ba4fd50b2cf9b6ea7498729b24c066e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3628d38c3810a5012cef6cc34434460

SHA1
b459000ed85e5258d28dc439834bbd0705f4f0f8

SHA256
5d1b4b81a311a2d149056139015f3871aaa867949c122b080e4a57304849cc99

SHA512
105f28a031ba936d253fc42d8b4b35e8ede66f61bec5fd87c6bba981c6c552a35c4219f29bd95fd2d81bfb426a6a6f7cf7d5a561fa56e836a930cc9eac524a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25d5933a2b1ee8dab418d9f9f5c7a77b

SHA1
ec3dd2ff857a6ad8564d4e90de34ec9e756acefe

SHA256
c69b276a8ce632043180c7128b8ecfeddbdcc15dee1686f94de808251775d27c

SHA512
2bd408779f4f1e097f80d45b23313115ce71da8677561832d3075a7b885a254440740bc3d6a07ed9d2a721352cfb79bf76654fefb326c724864d1cf6946af664

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE25.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF17.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit