9c46b2716ce0e0d3510f0c618a49fa29ae8308edca03b2f391569c9b30788fde

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99b1ee3b480d6e63f4c110ce0d7ad545_JaffaCakes118.html
Size

138KB
MD5

99b1ee3b480d6e63f4c110ce0d7ad545
SHA1

8fa20a59d8c1abbea808596bfdae0edc09fe1199
SHA256

9c46b2716ce0e0d3510f0c618a49fa29ae8308edca03b2f391569c9b30788fde
SHA512

dfae8baffd3488f266cd6b33b3253b78ea32f83d9af8f9cc045084016a2a56bd01dfeb4846b8c150822f0b34a6050120f29a52291b35e9b2696141d4bfdd9e64
SSDEEP

1536:S6rJwlbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:S6kyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{867E3451-23A3-11EF-A6AA-4E798A8644E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1804	iexplore.exe
1804	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2856	1804	iexplore.exe	28
PID 1804 wrote to memory of 2856	1804	iexplore.exe	28
PID 1804 wrote to memory of 2856	1804	iexplore.exe	28
PID 1804 wrote to memory of 2856	1804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99b1ee3b480d6e63f4c110ce0d7ad545_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6217a418f95f2fa86edb1e04ae5368e

SHA1
a5c3917e56eb7baf1dcdc6bb1336924672e95e2c

SHA256
ed8646ba8387683deb902b25fb7e55c5fba60ddcd078121819f222ffc19f0758

SHA512
4fde594fb9c58e070337853412bd0e03311701614199648879d24d86ff2b26a0737158ac384480407136e9a619830264021c47b7ebbd744aea57fcc9f1450ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ebd923e279c6c6ac7d7a7dbb7a862bd

SHA1
6c35f2d367a337afc664802466af4f46210ca478

SHA256
fde7d28a16904eb0abea1c169756ae21851c50e81f2dbda6b5e33e1b1202942a

SHA512
02de632bfb0cc1a65dcdceb65867bfecfbd0a570b2b6fca698b57d3c69857b4504445629be217da28e9fb3c4842d9526b856a95e98f6388ab4e85195e47f22f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29407a203b5d1c8823fcf86f44eb8904

SHA1
da283191ecc6c285be1995521bfb098610dc509e

SHA256
a09df241873dde40917cbb4913d7a0173541aa6374dd93c0d85d79ad3ea7bbaa

SHA512
00c3de5a4ac06bd1df32309a93d3e97d127576fce551e10fec46edeaa02a53b65db815531a53bd2ad8939dfcc205f171c46f77d4f54120f4ae326f3649f3d79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d53abe32732106117dd6008f71be27a1

SHA1
a30e6d80dddceb33e64af09f512ff95d20df059b

SHA256
60c13f2c35d74b2bcae0a8cf4064450e11ab1c3da30e0c978380046adc00ab04

SHA512
8ac5d23a86feb1cf07af6d08081ec48054e60ccdace165042b816f44e87396b0d9b90595ad364416a5bb66a30a898a84eb014642c224a045ecb6aef8af3cb0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47bc394c4cd0c58776bd3e0b8ad2a976

SHA1
98286b3de51ec8a6be2878b0f09dba0909715eb0

SHA256
a330fef4c1aaf51d45ce37f0e897795fdb1fadf63a2d3b137c14b89a223e7451

SHA512
ce418c270cb67dfa380d7a3d7b978d7ec45f92d571223a2fcf315452a28f2ede90fa2695a431cfed645a728c89dc464aa507fcf80150b099e909f89b3da8406d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a5e4b7ad868993abf03fdf7ef463d20

SHA1
08c46fda4db6afd519276493555d3a1ac67baab9

SHA256
6b39c527b65095a2fcf2b065a4aa8f168d977d076a4873354102cc3d5b9c531b

SHA512
958a6c300767c7d547a40bfb27fd45e4cd807c28d8ccd0ca179a9456c7f460b8945f9d1afd1c74e3375bb6fff0d5951aa965ef844e0bf4947f83567aeeee0cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
177f3f7fe943cff4313a8329f53403fa

SHA1
a2ea3a97ff63efe332185db4d3e1e8ef5fff96a5

SHA256
54981f415e2c0470c474b82f9eafb06561042fac02647f5bc8c685038e395070

SHA512
0bc0fb6de64005f92248c880c6adbeb38d68a950fd1998e3d54083d110d2b8f8b2b807876e91209ffee7ad7cf5b867c99d81c4a2f907175bff5bfdc0f018e493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c3ecd9bf585c41bb76089d3a89dc651

SHA1
6d1d31274b2090f9895eb3bd35a0812adfb36aef

SHA256
e5b5700306d350fe0f53c47e451c2fc3e36d4f3a2ab5e68987348329393cf52a

SHA512
1893554017a935c0404da286aec456658b4835564406d31719f198af97a2ecf2c6bd3bc5ccf35332586f8e6012a2418033eae1b68b8a585271042635e51e752b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa011b6cc8543fad4520af20f3e202f

SHA1
c06bb7b3a60d63e16e3dfd9afc9b22aa692ff732

SHA256
93befd427389960cab24ecf47b89f47a3bd05bf02d36be01e07fc451ba6bb90d

SHA512
59c0bee2665c3c592b31bb50083b73eb24f75e31ecc467d378cbece469240097923702ccbd3356a0feae9ca606e70938b9c643ab9622ce80e7a1d0b2ecba9fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b1c65a4727c26f652cbc53bee1e3d34

SHA1
7e6da2a2966bf7e7fdcad118958b253c4f3c866d

SHA256
30f06667cb58e7b0b239cbbf536079e64f1640ec87d4b4616e3a53d7693e4043

SHA512
747f9150f9d264cf5ac4043f87a49d41e502a66d97dd534b7e980320f4f7220d70c7c1a2c88c5edc55e58fbaf0c74102a56b83628edaa0ac21294c2846d922d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeefc920a6dccb9ae3a333f5495f8c7a

SHA1
42104bfbc1630f299b1de9b6b6e9975a07edb5b7

SHA256
e8c061144b30e864455bce86a8443c4bcf99e0fb71e8e2fab58c5e219ef53c2f

SHA512
9956980b8b38944800407db315161f30275cb915f010c39734218882a1f4f66846f94c5ca9123f43a9ff6e5138542aa520052e1977b156b513abc50897f5e6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38f3b3eed72791cd0629697b7e28ac36

SHA1
eceba97b1edb9bf6fa1d9a789401e623cbc60c98

SHA256
e1dba203c99eadee5125efe207d00c87ce0aacff78d44ee6255112d80f730975

SHA512
ff98a9bef8ffe10d026334c74f2f8d7e2d199b3fe4701d2cbb4f07d9de48b9d4d26daba4be52bdaa32a1f21e19345dcd2b751ef0365ced5485f2e1dc02dcc7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be1a23395a4369b1b54536fb3b790cd

SHA1
75f78331204533bfcf01a0e2953afed91a369b7c

SHA256
4d3d66c4a9a1f2304f0b34443b4eb6fa1f6de1c122f5e0b76d32e47588892949

SHA512
d45ef656cd838142f6c62a764040e462a6149b7f139733e30bf03a161aa03da50402ff37f24173c58f362e5efac1750e6b6fd31c6752dcf1cbf190308822dcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit