9dc796e73a5f28712002c4125eefe5b7dd209da5c06f4a02d1a77f98cf8456c7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7486989a5eeed790fd719d7fa3421f16_JaffaCakes118.html
Size

34KB
MD5

7486989a5eeed790fd719d7fa3421f16
SHA1

0ecfa087a5b94f8ef585e8cb9c95705a9af3765b
SHA256

9dc796e73a5f28712002c4125eefe5b7dd209da5c06f4a02d1a77f98cf8456c7
SHA512

044f8bf2e90d6a62f7b24c9b7bd60952cc403cedb4396e8948f7d17c21073b5e1bfa7af0ed98148d5e78272ed18417668a5c57a1748aef7f5232aba09df9d710
SSDEEP

192:uwjAb5nAqnQjxn5Q//nQieWNnVnQOkEntB9nQTbntnQOg6cwqYncwqYTcwqYQ4dw:9Q/ES/R54d+8jxQ26Lse

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBF63301-1B24-11EF-89B4-66A5A0AB388F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422864953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2424	2964	iexplore.exe	28
PID 2964 wrote to memory of 2424	2964	iexplore.exe	28
PID 2964 wrote to memory of 2424	2964	iexplore.exe	28
PID 2964 wrote to memory of 2424	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7486989a5eeed790fd719d7fa3421f16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353f611eb3f257a767eeeeb349e33957

SHA1
cdb4502fc4bac9fda2987644c15c7413998298a0

SHA256
58a4727bf27de7fadd662d2ad17a2a7c7b431d09fde029eae1d66469ae35ed04

SHA512
d4bba1782c6438df2a0a05c8f16da4ec819b2636af253cc084c5d720baf989b3e5dd733f41bb19ec78d5ebbedcf91578959aa5a019b8b56790cf336ca50c382f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbeb713e565db2cd3f3d06d730c7faa0

SHA1
d91289144bc0c0099a3e0bc4e695b5e36a6403ff

SHA256
8edce6e759c058c6d75abaaef07cdea6514f962cbbdb67dad8050cf5943bec4c

SHA512
0af67639e2ae16c7228bbfee3acfa7de86b2320d3637a02e596bce4ac588fcfafb2e68138004a8c9e9b0ffc434f3d451e7388b411e689ea2e6aa45a40f476b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e5bc2ea42f0422b4b1f0c576a9a66b

SHA1
8122a2286839b15dc42755345618dd66f963e5e9

SHA256
fda070306b73a51caa9248bc073f2f01768b3d2611586050f4f93e2b8d933684

SHA512
a997bbfaa5db4f7eabb18f669a1b6986877677323e0309cc78ec745bbc25494e4ef526172561e26cf43498cbf30e097cdb93ee42bfbb3233ea1ea1126e3df576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b97ded81d94f1fa301c5fd82fc83716

SHA1
b05f419dad476cf10056679360185594d880dd8f

SHA256
7e8b5a01b95cc4a882f12fb80198e72d16d049881251a6486c2afa3b8b059858

SHA512
b8a9e5467c99e2c0ef469657d6382dfd53a2261c624f0efa53f25a111ec657424ebead446d65c1ecb05ba95667f7bdb801a5c7ee2086d9b3cea3beba62a232e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1849bdf3a56f00171c92858ec5f95f8

SHA1
8bea536fa4fa8a6bf012d43081ce8d85195e6c70

SHA256
0b5ed7a061c66ffd4b4bf39e2a5c29e13a4e1593a8420738d3c4559a840b0478

SHA512
fd5145d97b13c191b9c7a1e1d56d264198884ec42f88eadabb9c580ade3cb3542a10da53503d8dba04204b348abe0369303ea833b7dfe06f852a9d4dd730bafb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e925c1504b852b99002de1ec6cecdb99

SHA1
f2693f8576fab12c681a9e0b425d6acc7ef6af03

SHA256
1ae1725bf686d5b333b7d55c2cd26ea78126b243c49e527ed78c7f54d45ad8b7

SHA512
39c8f4603068b8b02e65a74fa8475867516bc4a16bce6d2237c495eed8f66b2036e726ee9282b32713253e72df9f22836cf4e28e622e27c8fa0830704d789719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b019f06a0f73e96dc5f083a622f83181

SHA1
6863e257d98f53d93d18e80740d92776e8e7ad11

SHA256
4cdbbf18b6f8ef59d8171f4b80cb39b3298df1ae3d4913487e7caf5189b8e583

SHA512
c4805ed44ecb033cff13f297579732ce6e13aab3e8e8fa0f21af7537f2a18ca2dffd7ccf23fe2a99e0f35ec62619d09e0ac4e32a93de0c83df52bf64432d04d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
163230c76e7645661f8e4ae9242ce063

SHA1
2ed4629c9cdd6d5ff8c95048ba6f94c31dccbbe7

SHA256
9736602149f242299628ed0d2502283e9dec54441597c1e12d5927a41076b79d

SHA512
27850962659f580c6e63101e7361b717dfad8e1004d7cf29710d25da1883ad2fc7a1bfc1d58dd65f079b20b8e1ccf3b786ae9ace3e84af066fadc7a13d771e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21A6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2216.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit