7776106ab6d41d42b9cf730bc52876d747d24fffccf2b3c1a20dc28de4473d01

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f11e1f1888d9ddbaf4f8fde0dc8cb9_JaffaCakes118.html
Size

31KB
MD5

96f11e1f1888d9ddbaf4f8fde0dc8cb9
SHA1

9c0de20e7c6cf18788c9e56c21514fabf407024f
SHA256

7776106ab6d41d42b9cf730bc52876d747d24fffccf2b3c1a20dc28de4473d01
SHA512

88420c692876326a575d387f199b6ce897f7008d3e6c781bba92755b8283d1ca40de806edcb6cc5c73381e0994ac4c8fb96db47f537ab7866baf95aeb2e2fd88
SSDEEP

192:uw7rb5nA+nQjxn5Q/EnQie/NnjnQOkEntoqnQTbnRnQmItxHvrSY51V/U8EvJvDo:6Q/MAxX1/UByaFpG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCB5FE51-22DE-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423714446"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2460	2124	iexplore.exe	28
PID 2124 wrote to memory of 2460	2124	iexplore.exe	28
PID 2124 wrote to memory of 2460	2124	iexplore.exe	28
PID 2124 wrote to memory of 2460	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96f11e1f1888d9ddbaf4f8fde0dc8cb9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82c2c91745b54a406214ce516649bd71

SHA1
3f630a8431a2624c92159c59a576871e393b56d1

SHA256
634511357552e98a4a78ad9edf9b35707ac9989b1bce4403ea6d4801229c0c18

SHA512
7446c187824cad20f45e26d0732e423a7b17a5f9a48f45060cea23f97c1106f296abb63821c36f4604bda7f3f5edc630a2aa8b00bb9d52dc9b9e6dcfbdbf448e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e54b9e2685f039354400d996a6949e7a

SHA1
f5daa3d2068a3e58465e6b02e27852b2a3de796e

SHA256
f4dbd2b38dec3ad4cb65f4b3d40657d0cc93a851fab07e0c902c43cdb753739c

SHA512
e9104bc2da33e884e84e96a109dbd371331b8a177dfe8552d666bd4450d4fe6c3ee01e00140d77e4b7571fd45b6d8c0d97c2649a5c59ef952f7f9ab4989ed5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a820c29acff011a35c199d4ccfebed47

SHA1
b3b9f2beab4d978afc3819f2aee0cfca42a79038

SHA256
fef576470f797ef24b4214f19cbdba712cb6d7ce27f980a6fa8f9184d830b7b1

SHA512
dfa48bf7b732b99fd8c6f84286335f1c3c6fd4903d79104d0c5db4bc6a1795b433cd58bc8e8c24b4e49207a1dc8095906ddde5e6367565cd380e298beedc209e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b2758d76bfc10182e6a214188235e6

SHA1
fb5f211a3f6f336c04225ca4e2cc280ca0ea5e0d

SHA256
f46055bae270f4c73518aab87ba60d41d210e3a53db4e4c5d2384b500c36daa2

SHA512
de503b6a530668cb4660b7b3263a1196bad1d08ba0f3dc0022709a28371aef8f31cef4815ac6126ce77a7fdb84b26a23876e55c1e14fe74252f9c77d1f0b2715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0d46b1441bca6e061a5d52d292dd175

SHA1
a0e4a1d2e631b5c4db44731a92bd72a7324f788d

SHA256
f2d8cf1302865f8d24bcd0baae934ad1bf4b63192f1179f2ac0d1263bf84760e

SHA512
7fc3678d514cba9465427befa3d209e02390d8ebce7670798359e7c1647baf7e3d202850ffa3aefc947953c090c363005d296418a7858c7fa9f1849e586a7b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d84d9286f16697daaef2fdc612407d6

SHA1
321d095ecb91d74e7e8e4d3644ac36159e9b48cb

SHA256
fe01ada53d4ce4d47da2d90bcc2be9fc3311f557c0e61f3e104eaad8bb2bf42c

SHA512
ff98b8a83f70f2036207e76f295b892df8fba3a05c69b5cf902b66a3c08628af3efd656bea78ab03953b0e414e647cc084db5c0738980e33daed6f3064b54e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8ba01da8c39d03be8033cc98c9900a1

SHA1
e528b143e99735706c7e672023430ace6e654744

SHA256
13455248a49e336728b02caca970bdded9b90ba17a16efb53bc7552109d9e384

SHA512
2fe16cedb3ff7efc70d07a4134e0450edc175a14e9352a8c9a0165d09771f1e958f9d7e67433645bcb7ab30f04d7abddc2705243ba4a9524b5165063421d71e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13a75f188fe67566a29dd68a7cddac98

SHA1
1763ad0f92f3db1555cffe9c8c6c2d18fd3bc652

SHA256
20012ab9e2486f934671c2f6a92e25c29d30ab3af34665384d2d25f746266cee

SHA512
1c7059ecf93cea33f0718357625425960ee582dcdc6e2ee4deb3d8875af7769b29bb6920c6e33832efba4ec363bb6cae2fca918d9c70f4c686a256df3db34b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b236cfa9269cf5390c81bf9b229b565

SHA1
2c43889682401a655b2e1d9885403364c9e0e91e

SHA256
0d7467b80af81a2e4c3ab1305c0e7cfe19682087d1972b3191ab4bd699b4a7a3

SHA512
6b5170786bb8b5d1ff0789fe6ade67ec378e6935b173d70c17d4fef695d3c295f747f5bdd054d48712bedf475bda0d3e83ffba09e2634fd2d239b046938eb357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c692365dbc424d3d33d1bac4490d332a

SHA1
e7d2aa7bc0feb87fd2ca52018ac7b32828741d29

SHA256
053f4cfca9bfefe0a3d04b46272af48a11a86ef6c3d6eb07cdd43a77dfe6c280

SHA512
6f171e44a8ed683e6f6bef9bc759b23ab0c92349ca8cea396251d89aa42003a1594bb9528556373165bab8d55735472ae11a813cec858d313224a91631ce741d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26C4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2743.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2758.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit