9a3d6c250a9addc7ab2c9833bd5c41784dd62e8be4e221b9d3a6a54cdb846567

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html
Size

19KB
MD5

9a293d6163028d5a9f8cd2d12c96d14e
SHA1

e75349a1c956ccfb95855f4ee8f8256dc32d355f
SHA256

9a3d6c250a9addc7ab2c9833bd5c41784dd62e8be4e221b9d3a6a54cdb846567
SHA512

5a76204dae4f1315d8835e7fabce4fe1ed74214f9e6d4f86f6248647688da1a222527b964d65beafe40c61c4585050048b1e0933ffa8f57c6fb132201d588645
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIM4GzUnjBhyE82qDB8:SIMd0I5nO9HXsvyHxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423817898"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB690E31-23CF-11EF-82B1-CE167E742B8D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3056	2092	iexplore.exe	28
PID 2092 wrote to memory of 3056	2092	iexplore.exe	28
PID 2092 wrote to memory of 3056	2092	iexplore.exe	28
PID 2092 wrote to memory of 3056	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a293d6163028d5a9f8cd2d12c96d14e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
144991ba48646777e21daf2efa30d567

SHA1
afe68aac9fff982bb455282db3ec537f7e8e4c79

SHA256
1ff2b5db015805afd58604c2afebb5c901930d463be579515e8ad07573883cca

SHA512
ffd110c74d520db58dd509458449f8ede652b96b46bfba304ee15c98227fa23ad88129cdb00669d839f1873de9a1b878cd87e758c8ef944b547212a554967fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0328a8f14d64bee2f969bb3bc6559041

SHA1
813016825b36ce07b972124f2495a9faa275f940

SHA256
faca0b469bf0dd81ea13378e6127aee3ae24a1398fdbaf1c48a70625b1edfadb

SHA512
a4e370bdbac93ffa9254a7f5d5c42e07fd5b770f402585ecc6e47c0bf3c9250ebe1676e56bccd9fb0a483020794a644107b484381fead0edda891aa2faea264f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb85cf313da45f278780cf27c6384852

SHA1
2cf5c2400b851b2f59b6ca867a79fbf29dbd4ee4

SHA256
d346faae47c54e3aa99acfbe6b88a902c2d9c2412f6a6c2b06f9a64d6174d679

SHA512
776c25151c93a9baeb443efd604e6a3dc77f5a0f11c044b0abf8a92fac44b62a9b4b7d18e55fadfb345775e1c8c64d01439501671d9b5da1d633251dc3337f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bf1b078877a543bb1a8f20cb2655cf3

SHA1
2a7f3a9c72166ecbd902bf283a2f8c3cf3bfe1c4

SHA256
e017198d5c15d284f3a8f41e97db7a5d005591c909d473c853e6045d7c62b82d

SHA512
20eb95764fd2c4749a19debafac23168a71faf58b4a0e5c085587402ae04d62768d38bb9b824c89f5fd0af0f2b1e79f149d5a46b29076dbb17bdd7eae2e2d99d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fafe684bc7bddda4d83fe8add7aa620b

SHA1
eca69e6f9d2dd24d3efe69c709f70672162ee888

SHA256
53b0160bf0c587f63ffeee04ea1ff3e79c9ed3abde926a32b7a7e1d472fb7386

SHA512
efc37e60f3960ed9e49aa34e3342c9bb5c0176816ae7919d185f8f30fdd8652a4f3f2d4bb9fb05478d999f2fc99a55fb5c0db3f733be6b3a395ee3e01f50e68f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9961aec36271627a1458e2a5d60dba04

SHA1
08e1fb43a18180683e121d6e435f22ff800df50f

SHA256
02fea690a1a1f01e4a05f946000489c7c5c1ae833d19cbe87d6f438c54bb3fa2

SHA512
4887809b29174b4e772867e92cd3adc3be452eb71c404426f2ae7bc69a85e2f8eebc8ce55a27e09b6d12719d57376e6dc5cc79d44d1684cc5fbd6ddd1d9eeb16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7d83e456d5419f4c8df53be9b11be8

SHA1
05db3e3a16659ce331692765145878ffabf176ca

SHA256
37b0887c6436184e4ea0016ff8d5f5ba7f7c766bd7fecb3fe061cbcde727e9a7

SHA512
3b86c14d995570d37fa4e56a2415ee78832656283a00a9613b6b3f90c740154bc514f56ae2a8c9a0dde93819b94c04188fe9122e3102a72b53e2caa071f5b912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3065b0f1a63a057914fad9e7694629c

SHA1
3ca140b748c7b9349e3bb123c75e8459b2a59662

SHA256
48efeb71d51d664be69c9e857fc421e3be3d546244f5e933056490cf9c6c4882

SHA512
757f5e0c581729b41a252a6f6a1b2a3e54da4dbd93b64c91eb919f738c544460e05f3917d52782b59f2eb08baaa8b526f684c4b9d2e8fac4cdab7906f8f57765

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar109D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit