9b6a846dfbff952b8244faae6b47178d4047bf074832e247f66f237d470220a5

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f01f537398e046a5127da02d7e5d20_JaffaCakes118.html
Size

23KB
MD5

74f01f537398e046a5127da02d7e5d20
SHA1

a1983454ee601c89fe096ded981d387836eab0fd
SHA256

9b6a846dfbff952b8244faae6b47178d4047bf074832e247f66f237d470220a5
SHA512

f1fe93d85cb8f4aabe7a589f2a604ed334aad998b675a781c28e95664a5ab611377b9b721a1220df137b731d5c32904b1412c7d85966b8cc07e99e48e3a5855e
SSDEEP

192:uWP8b5nIynQjxn5Q/bnQieKNn0nQOkEntt1nQTbnlnQECnQtIwMBqqnYnQ7tneYn:lQ/OoEF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E050DF1-1B3D-11EF-970D-EE42DE2196AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422875319"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28
PID 3068 wrote to memory of 2368	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74f01f537398e046a5127da02d7e5d20_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3ef49cde7975def59b3d62f91263ad

SHA1
0f314438fb976f43279857002846ce98e9e4c072

SHA256
f49fa3b4d9a3fe94329ab74ce585d13a97aca4e9e34b82e608a1412838a47aca

SHA512
343252cefdc7f7bc738d478f0538cf54975fab8bdcd05ec5544da51c43af5fdc8d99f5b1a9c5b2e7bb470e8d6b3c9566dee80f6dc6063c3763afdd85065ee4cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9e397efad8fb4c0d6bdb8b93ab6d97

SHA1
33324807d0409a3bd049bc8e7c94fd96791c5f56

SHA256
f3d10ae58bf301165c8f03f7cd2ee456825abe2e9e15356cf392db951f2bec8c

SHA512
a6f3af07ad212ba483cf72888a78b9a1a93b8535f12fd8444a12568ad37e71143dc5cd518fa88158573e1a8d6d31135f5254b55658519e7431c32a5300cfe51c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edce395755ff50f2a43e2b410b5d89b8

SHA1
8ad0385e100d61e2b59b90d965ad4188cba882ad

SHA256
8e17766a654d5df6540799d6539856beefc8b87be459827900431091ae6025de

SHA512
7da6b3939d62eb5bca18cb11d6cea2630c805fead3a856c9a8f1fc7449e114c1783b6a12ef424c24f9719e37ef3b84ded80a4fa66112cffa1bca449642fa1e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a47f0109034f2ca6b78ee73f982815e

SHA1
630d82f53d17c585b45771b9ee8bc858f9e9a5a7

SHA256
1c80482ec6099dcaaa8a76e57555f3377d654249777f052653eb3fc01ed58571

SHA512
79b5436a5a18882adc09bf512e3b9af77fcec6699fba19bc85d53bd8dd8f0587241cb75a91976398ab3757b1c5d942059940921b41346f4c4a17747c52ffe080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af280d2078a0628d5636ee5317c23fe

SHA1
496376b21dfcbd85128daabb3a68883120c2efd5

SHA256
1bd9bd19d83c328003e4696c9e891bb9df7f0b32005c4faed440935cd8300c57

SHA512
ae69ba919dfc4ad7afd00ac85099b990796e2584fb5d56ad84febf6947f027cc33f17e2be257d18060ecf438dab3daad32d0e49a1007f1fee099e58aa7a55486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a359441cd5a954636164318c85ccecc

SHA1
cdb5ca281c30bf83ad44f73967aad9ccd8dc5591

SHA256
af0775bfe6f30076eaf38630c6fa69e01cbeea1a2479126a1492ba7dac87a27c

SHA512
73fc10ec2ab8a3957878e93e3fafaa340336c5b1de6f80b66b109062857cca0af18b9d597fe6ed9409ff78ba5c483c2da6d7fe5dcf98f347782b5db0979d5ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e5433df9139a33bc190341a1393e0e

SHA1
399a44636952707d4818a198b5f1f2d08e9f06c3

SHA256
1c0778fda17d6eeafe018fe1ac050cadb279cf6ab75ee17159ba05ddb3826552

SHA512
03c6b0de10c0b1fd1f33a64798198e00a7ed4a398e1fe67d4555b9d8765156bc4582f023c0b4e5dd1b5f0e998476e2b466929a21ad7f21d766a896cde9adb41d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d664c104d1113f61e7e944009826ddbd

SHA1
4dce69b4b5369c970c71985e92539324d307dd72

SHA256
e38e3668cd38e6ee4b063baed04bb1ea7e3b1e8d224c06f3eedbe2e180b4949e

SHA512
452d99eadf6173f96ecb1e07db4b35874c39ece0967036ac039630de75f06858a090767d8d0186be823a4ab385ccce6e37bc0c802f08c3f97f76778078878ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab965.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA56.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit