9d2a6ccf0e9bc59309c824e7aa37192ae2527f156ace538b688af3202b023b23

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9318677d4be0b76efcca610cb0fc115d_JaffaCakes118.html
Size

28KB
MD5

9318677d4be0b76efcca610cb0fc115d
SHA1

1f2a1d6049669abf4490f4d608d14a93f1f08289
SHA256

9d2a6ccf0e9bc59309c824e7aa37192ae2527f156ace538b688af3202b023b23
SHA512

977c419d32906a5bde9656496cb07db6e3551fa8ed5d93f2b303382f7ecf5dcfb0140766ab2c5a8b6fc859cc58034af3448b7285d0e70f36c121a89f18bcfc91
SSDEEP

192:uwL8b5nehIunQjxn5Q/4nQiezNn2fInQOkEntoCnQTbntnQ9ezPm66vfaoZQl7Mh:WQ/AfQOxIfaNSn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423622003"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90E970A1-2207-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2448	1704	iexplore.exe	28
PID 1704 wrote to memory of 2448	1704	iexplore.exe	28
PID 1704 wrote to memory of 2448	1704	iexplore.exe	28
PID 1704 wrote to memory of 2448	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9318677d4be0b76efcca610cb0fc115d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393945ee206e646d2f17efa5e524b90a

SHA1
16fc70f89a4c765a5125713d09e1e4046109a801

SHA256
16fca8143ba867a38c2fc75ec091bd286ad33383ec40b3774c9a7f492ddd551b

SHA512
d59d5cfe72bd223b98b3425f55a7e5b1d2a62448da89462601b4ba3dcd38dd14766aa05538f1277f2e05c56ac77359bc25a260043bb2e6830e572c89acf4a55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8c145698cd6fb9f6feda76727dd0e5

SHA1
50ff9a270b806db3289e489cc65eece3c060665b

SHA256
26c8f39c119d2eb5ca675a0bfad7de6c4cd7c733f826527dd30f267e36d45a0a

SHA512
1698c09a1ceb5e83239d39fdd552f94ce9f2126630789049349e2a109d3fa44dd3ae111ceb0f97066ebdf03500e16ac6c30810b867a71c0ea1d747c12a75ae55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8601d6a5c4dd2cf5a464e7ed4887ecfe

SHA1
f85ffe400892a0e737780fa55946dbcb48381244

SHA256
e973d8ee9a2c95625a74b1e2b11539b6ce2b6f04db4a1cc16d47d7a6e52bb874

SHA512
6f39ba3f053de9067c603fa34c92304c0b558b226075cc08b91161cb76a5208deb28908e9056715a7dfec6776caaa0ae056d02a91e068f11b77ec5b2a24db44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ab7a9b0a09a3ac86b913b394851032d

SHA1
8bb041a0d0bed2bb5a9c934bae4871cdf6557c0a

SHA256
1941b7a9f7e50273b2ba6571a3c468590ce2ed995247948b8301d347d3f5adcf

SHA512
25a6457d68e74254163c5fa34b5ce6636f404c9865cd6c81ea34aeff22065e81c27fcea5a32e0dca79232779a85b8fcfee5e3824ba0e8f6ef89b34acfe9cb2d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bad5228ac1f8cecf4e8181345b4277aa

SHA1
391ff61aafb2ec7ceccdc7736647109de1624bfb

SHA256
0c1fa63913e8f41f370b4fc9de5f39cb3a032db3c5fd2bc48c917b51fea8ec1e

SHA512
990eb59d29889419455dc1626b16cebdd5ff17ac99cbcd9489acd76b4c094311288fd6f8ee943ab8ed7152fad38b337f752a29235e7a8ba23339e3cfc4ce78c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc8170ee824a2b8bed76a9163f37fa3e

SHA1
fbc162eede2cd5141ddcccce101143f783840b02

SHA256
57b6dd4bf7748cfb8b446ba156c5ff206a319e5ce7db864bf80ca51d556bfb59

SHA512
4690e1ac7824ea0410bfb02c6075fb83502dbf643c0c729c58c4ac2f53f483ff7a779dcf719c0621e44b0456c9edd341a2a4d333bc564cbe3aae157eb77944c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e94c9738c959578940de17e7f01d485

SHA1
a824893607560f14054ef8eccbf74f6711f1e6aa

SHA256
acc0c04acb29cf9096d7278659fde7154ad027ed187fb3bdbd250b4e84c03965

SHA512
ba430f6e83a85b97d624f724e157d7338b0584a169a5e24eb5d720381ff732976d314ae0b680013a8d955d2c5cddd4cf09de51604be8a15bdacd3c9d68f3eb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f903cfae5d9333268a839b3d5444ab6c

SHA1
dc07b5ed1f04e35213cf741d44b3487cad4bdd57

SHA256
27158bf8812b4726606cae0ff48cbdd697082a4f1ed623b0dd5b8b3b7028f598

SHA512
cf067525a394923dd4ed3652bc490b66eb942ef3aa843ff1e67c391b8d2219dcd2ecc478037a1abad87c843db3aad77037763502f26296d612347c5ce9f02008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
459420f8b57e51300f9917fa59b2a39d

SHA1
fe900c9d3dc0484f729387697cfc5db9bfa9a6e0

SHA256
4f919fa605b151ae3e4eaafeacd032517e13314b62c73864702a60ff14313791

SHA512
b433763666b84c3bee7a2b7c1ececf1624a29b4ed4d2e11f7580047c46481793b5a2ff72a316f9d8a79b85d9ca204ad508d55d5279aee18647ce4ab344caec1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b07cc78498aaffe9d0ced1fec6b40689

SHA1
f121c8b0e66391cf941f65c78c229d061c45346e

SHA256
d14df86ac5588b853edbb7863f7ee77cd37deb2cdb7cedf8d441b9f373e5508d

SHA512
720b373f166954333b7681ba45964787ff925fd1fe86c8913f5d30c6f5f78be3d7445a5396c8c7b7437e787947df485abcb79d30555ed536a898d71d1b11c72e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab193D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19F0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit