6fddeaa0b2a2e7f71e4318e9162a30c554c24ff6e3838a32478c87d522aa58bb

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9921252bd3207e979f46f5b0580f2dd5_JaffaCakes118.html
Size

27KB
MD5

9921252bd3207e979f46f5b0580f2dd5
SHA1

fce31686cd99095e0f73607d3d15efc7511062e6
SHA256

6fddeaa0b2a2e7f71e4318e9162a30c554c24ff6e3838a32478c87d522aa58bb
SHA512

e53bd5b0b14c76ebad979cf2427e00fe706265cc490194780785554b088ddf6ed98db0594933219212ee4043bed25000d95b500ee267a9cb2ed0f7282f4d401f
SSDEEP

192:uwtUm3TrgHZHb5nwjIOIKR5EdpVEz3VnQjxn5Q/67nQieeuNnziZnQOkEntcH3Uj:iQ/go74P4Sb0o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423780320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C964CF1-2378-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9921252bd3207e979f46f5b0580f2dd5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58d068b75aff1cbae306d1ce512ba661

SHA1
8301904904d7469e24ce18f1d2e9ed8ae0b7691d

SHA256
ddda53633fe22d1aa32b417f3053cd120d7fa0b5c56d7fe3340fc2e3b38be777

SHA512
9ad126e24f9a17cd3313b69b3964c76b679a69afcffcbb7daadbcefdaa29b1d978f519d7255eee5367208b1afd8ef2a433b4d6479dadde6f8ce15e3b8acc1e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db8a8d34bd021276a6fd61d3f0dae472

SHA1
cc7c1a937cade334689dd8645590456f83691bc5

SHA256
3321882066d3572511d3731aad7bacceba457223cd231edaf83ace260710cb1f

SHA512
f76a4a31c625c673cf63176484bb6dd7c843fbe1e8ed694d10cc830da3012073d801da1bce1a02aa1bc065bfc99ca9eb3b1f92a2187d83d327b5451418a8ab2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae2662547ca9c8116ceb031e66043b9

SHA1
e1d3a06d01735b74cce4382490eb175954f65caa

SHA256
fc697f4bab71aacce292e8c6e583b3053632cfe2a0d04a47620aa8ab89f43f57

SHA512
3f1a3fcb4b6728f6001a48fe5d5cacf9f15c5b2687d08f43f4adf15cb43a7920d683c02ddc76b4387816c941b6155608c8b06be51c57c95792357c50b40541cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1d819362a485cfc3e8bc9627f5e93c

SHA1
c3d4fa318d6d871f3e8948c1913195caba16ad94

SHA256
3a805ef9e0ac43a0064afd7c9db2ade48e0d7965790e05d1f79f822b6cf34cfc

SHA512
3f0c231f9660bd0a11b4a812e8ae4f5c7a5d298a3c8a51135019ebbba36db24cc48c4c36405594b52f0813b63c04acfa048a66dc6fc98e44cabe4cc04552ff9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afdf4ce76280d947e3b94d3c54b9abe0

SHA1
2ef4cd14bc4cf386181d08b86411bbee193f7677

SHA256
611ae9dd3fb6082d7783cc861513ede4424663204e166db07f7db311dd970faa

SHA512
2c668537ae1c5cdb9553fc618ac96076a31046f2f486f8308e0ecc2ee3f9c64ffcd8db20585e829bfd80ff67dca2d166f67622a8576dfc491fdb07398b3c0532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46a4ebf5114940f4ba61cfc15ab9fc54

SHA1
d5ec15af64fe28e9f7401d287d4c6737004ac295

SHA256
3f92361ca2a41770115b104b8ac0f729ef3acf9f76c1c0999720abe23a895a1f

SHA512
c36805d73de0f59512aa11f56a5509863b4a69ed2e2660b598a5d67e9c96578e5dc2c5d3722198388d83db919a9ca357c9ba64afdac239406cfbbd4f1182c6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bc32ac199a8bb206f3cf7558fffd397

SHA1
269d1f94eb05ce4b050f06c0e62f7e64aa7e957e

SHA256
82d761b8afccb70aad9d4d09c37449f9365894f7678b1ba24714113a93521d1a

SHA512
c44058089f38535d6c3c8c0ac874bcc7d3363431a67d64dba456e0f85c270096a141dab2eff4bf700832172bcb40f0a7a309247437f98f981a51475cf8b4f6ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d484db0100b8238b83c034b07d5abbaf

SHA1
d9c870a19b2ae86685e151a65c173e83ea0ee02d

SHA256
1d3305c0f02a5495fdd12c149a6d593c875b1c746ce04f4cc6a4a9723e108b6f

SHA512
e37c2f155a79e2eafd794a89ad65c0c0744553a13c4df1b743ad5aa7c4eaac9c1e0d62e26fec8279fa708bd55e1da13fa57256f3e2e41be4fecad3791934adf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab192C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A1A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A2E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit