6fe9edde24973967a12fed91dcabe7aecba5e18fe981eefb3b3b4d9510c29843

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9056e8ee935330714172cde3b683c79b_JaffaCakes118.html
Size

23KB
MD5

9056e8ee935330714172cde3b683c79b
SHA1

cd4cf63d1c6428bac669538766354ff777b2798a
SHA256

6fe9edde24973967a12fed91dcabe7aecba5e18fe981eefb3b3b4d9510c29843
SHA512

1b5222cadb3586acef319822a85dcb5c4709b03e620a65298a7bb5522ac727b8c7a84cea13c20a418e6b41b09a521c0d67ec798e82cad56a2a1d1a9238f24ad2
SSDEEP

192:uwTUb5nlGnQjxn5Q/KNnQieDNnmnQOkEnt0+nQTbnxnQKdjzvMBjqnYnQ7tnAYmL:4Q/KiUVlv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423545736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDA70931-2155-11EF-97A3-C6E8F1D2B27D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2024	2420	iexplore.exe	28
PID 2420 wrote to memory of 2024	2420	iexplore.exe	28
PID 2420 wrote to memory of 2024	2420	iexplore.exe	28
PID 2420 wrote to memory of 2024	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9056e8ee935330714172cde3b683c79b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d9632eb37aea9b4e7f767eff461b40

SHA1
4f6ee98da5028e658ff13b00b2d4a00963ebb82a

SHA256
ab2f81c2aacf6cb9ecf25196d99977a27b80a31ca0b1d89bef395c356cee627c

SHA512
09a49537c2d69e2a35c1fba65552ba3844265f465ddac9001732fa9ce3a5d1a150bdf25c357fc45e65a931208f9d5a14ae941d53874889f6a2dd28a5f162c35c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79cd2e7fd5c1b3eac19804bcf81744bc

SHA1
621d070051459abed4e0cd3e2061a27136193a9c

SHA256
1774f99628cb607df543dd34c2d8ea991f8cb9014b6394e248faa9523486ceb1

SHA512
e94bbf52bd4e728d8ec522037a401e2bd9c0d72e5b90ba97ef15fee43e00e880886bc71d53aff5d2da1f5652ca831058473c69f8d3347627161c790f126b1bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00b3bede4c31d23d840a4695e87ce95

SHA1
7b5902efd3051664aa3ff2b5b9b40505cd87b73a

SHA256
dc74570ad930cbb71baba90d60624e4dc1447318863fcc751ed5738cfabb37f0

SHA512
8e3ab9db4e9c52ef0a242a686aeff0da7d06690fcb28fb7907e6473aeff9104b67c3566e46b2ca7b6046d788a90afda8dba1a9c537c4c9d9d54a19db34ff32dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e1001a1d258aa376683511cfaed49e

SHA1
144bbc49d4bad3c1d5e82da4828e886e7befa0f9

SHA256
bb8405e350718538a8401b4605e3f248783dbdd40e1081c5885ae544c2034340

SHA512
77bd402e2d31517e2d881eb89c671d5726d69393dea204d788d17d0d08f50a2c6a5fe4cc6b80bfcf61f95f7109d6a3a073dfc69e19c801418cbb973dc90e0b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57530d212a7e93c070bc9be9fd40bb71

SHA1
bc55f4d740c2a0a133a9425230a0eaf9d9a0bd75

SHA256
5272c63fae51b1878606be072b6a0ff43565070bd5f1b1062ffbf02a5d944efb

SHA512
f48e1af5fe1a8182ff9ff908f0d15df75bb165fa3beda901109e575e4f71767032815f474d45116398cd83cf067b6b444b077368e1807baedd312e6a615cf5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f8d42a121759f543e9c43f76ab8a47

SHA1
5751c0c348831afda8048cd0fc9b6b55d8eabbf3

SHA256
544e2fac43204d28f2ec1a0119d684e13dd912b662de6a48a5555993f301161b

SHA512
14ff3a2bdf9102c3eb8a5ec5f6d48eddefc28af0dd7a7a637299d78359a7870a96f1c55c9b4407a74d661f2aa7f14fd27f28bc94271a67776deaa63443649de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3df6ed8b60456fdbd5fc68022a89e0c

SHA1
8a938bd33ed5a03f936a45f82ccb9dbfed4d0fd1

SHA256
7ca26fc58dc2d12bef3f243e1535df54b899407d75c3ef9069a52fd57d04b13b

SHA512
712202baaff4c12ca549c031926cb69b7bfaa793566df8685675c19c96a7339436eef81a69efd03d23512de69cf5ab076796e31128ec846bbe25e61ed0ebb6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b81476bc0c7b0fc70b6178c01d1ba01

SHA1
f53981533515c8386c65ac2e4001a45c466f0ba5

SHA256
6a63531114e60d1a4ff79b1fd42e48962cbc87192a8bc4ab1069d5930151819a

SHA512
16e35097a8e9e2c2385425f3a27fd0a4c55d6832ffdde3c750ba6b6692e27c3bc6a1f45497124fd34762c78bb7b95ef9faf98a00b9c67801623d00facbc0506f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f7e93210ac1dfb22ce3aedaa817ce47

SHA1
41ee51e811ccbb86e49fb9c71f4dfe14e668a215

SHA256
c0624c8d0fe04dbc2f311581bfde12f2b17196e448d5aef7d1632584dcce0653

SHA512
bd2ad491cf9362908d37eab78666e2fc717cc9dd89834f885c0d6e3c7f7f95de13b087ab35c2a2e3baaccc8efae82b20fc7940cd7a829676bdab6a63d94f9e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1528.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit