fbadacfe12a8c3e7a011b5d0aca16236f36e128d4fb49508bbd75badbdf3002f

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c2a4b2ac21623b5251b9edc22247b45_JaffaCakes118.html
Size

42KB
MD5

9c2a4b2ac21623b5251b9edc22247b45
SHA1

93ecf9820cb5f7ca2c66b0edbaaaf288fe9c17b4
SHA256

fbadacfe12a8c3e7a011b5d0aca16236f36e128d4fb49508bbd75badbdf3002f
SHA512

5d8a5c1475c1870fab8714a615ce7902d965867f7e6b52108a067029ef741513da328fda61153a32b3b53452ab6549b8b8da297743789587ebc50c52e2649d70
SSDEEP

192:uwHgb5nh+nQjxn5Q/5nQiecNnGnQOkEntb7nQTbnxnQmSJxJS02zL4k26deS1zom:6Q/vexA/j5CRgec

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98599AF1-2779-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424220736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c2a4b2ac21623b5251b9edc22247b45_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d041cb6ab86e450dc13463f1d5c30e7

SHA1
74cf234908660ce2ba9d3cc94d8934eb28b9322d

SHA256
a00732b8d2a8878521623e8b75d201f0d4507b8e8cf6130d147ffd24a882fcf1

SHA512
5b16c3c9a134e262bf93b10b9cb32584c740ab2b1f47f56c86cdfc047f032dff3396a5bf732b18243241c8e1406c16b66c99e1a0d4746a3c3ffac0a99816606f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a40670ad19c469be0019cc843b64e2fa

SHA1
072c5bf155c0fa778b6284cdeb6bf4f7d32b9639

SHA256
b01e7d793948d30b7f001033ca221563a3dcc700492f01a0fe283306240e65e0

SHA512
e0cedc89b16a56aa75d6918aec3a2a1160a7c366bf3e39885032324dfacf32e5dae55bae4e96d1eba07f9c49cd64e77d3c2be6d31d62d8edc00dea995d6fe9ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b49e85956cacb3784a5a075fe4172f0

SHA1
55614083b212a413d0122c31f3751e224c85774c

SHA256
6e8a594d7bc835c9c8378fe6753cb6964de95caf539e5198aa219fd82d89834c

SHA512
0c8d1bf6d9f6f04fa2e2fa583f4c89bea8039c12c8e620aafdb2357d4985e24536cd6a4050fa4292923e51f8bfc6b46186898186f075978c47e01feff011744b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81e7b7b05e383a871e47ca6b1890b4c8

SHA1
9dc272a524f14bf4be963cb6d7cda3f501a557e9

SHA256
b94faa18a2ad9e55c50dd97c76274443d4163ac838b1a5610f2e673ab6d9049b

SHA512
75822680c0950feaced823c5f2de6551e6a88c9569195924cce9261a0219e1614118a83b72da98055549dbac44efec4d46e563cee6fb8fd620efa50b0cd6dd9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ce6c083d9a6d8e8dc02a6e101ac940

SHA1
9b63a439dc3179b662c8ef1b4b812f7d0c3b1fba

SHA256
3c386a83392273480381165f06da77b2c275101e5b87276d2e01446d5e24bf6a

SHA512
dfc0eaaab32c581720add9bcb3ec083f510e991aefa57a4351ebdf7bc39b90f91d1749945080d9a6053a31b02aca9cbac34f975b3a574ed9646f43e0811ee056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0978056be207690a30d4973a3e6dd105

SHA1
1bf0b86353c82b8caebcdbb1b334c237e9a4cb10

SHA256
935fb4dc9469bac6d8e213fb706894e51c18e20efd4e29bbc2ad9809f0da995f

SHA512
cfd8fd8c9bc59fb263312dfd4430e457bbfe5c00c7865549251ab3aca8375074be235fbca33b9a0fd8fcf43fadb196740c07fe5bc746417f138eb0c41afb9b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34cc55e0a691654517fea86c11f796f8

SHA1
b68aa0923f6b6fd3d812501f304ca767b3f535d6

SHA256
b27ba99caa59ff55cd2288c09548c64ff8434f7206f4d10d6e08b927f59af6dd

SHA512
fe1ab835dfbbf28b5aa50c6c8bfa7fc680eb4b0f924c5714bd334a2ca618463a65243bdedb6df6af2e6930869f1bdfec39a17114f80a35d314dd358bee355add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3e1d97146b59e3169ba56faf51b3d9

SHA1
8552fa4b9fd0ec2abd5659eeb28d6022609d2947

SHA256
dd837cc104af3155ea90c3ee511e72463a4f97a2db954fcf08a7c6309c10b66c

SHA512
a3c6e7d04e775bfcbf51b94e756e4a975c8f3ea4680f4dba24f45b4d4c83d24ad5b6ddd941e25f96f5360b0b3181e212c580d7f1502ec83b0ae1ceae3a232cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23637449da608cb93979e22ab587557a

SHA1
ea31c27b0c51702eb0b648253e2fcb8618a534b8

SHA256
5c943839c2d29d1b8ade5f9d001188532db42e5ac863736f0c2277cebd5fb35e

SHA512
dc3bf0abba96d21aaf9e3fd98b1509f237e793914ee94827851a1e760279da8de7b59556e5a65d8930f00d126ef8828fb4907b2ad3a42367434150daa856efff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9427.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9537.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit