471d2ee73c496e83e0cc6a0ed67494758f67471fd4a924d0e80c61bf8b1dcae7

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c5055a837da695bdd721320b19e90a0_JaffaCakes118.html
Size

39KB
MD5

9c5055a837da695bdd721320b19e90a0
SHA1

6e2aa0c342b13481f6e4dd657314d8ae0f5f4657
SHA256

471d2ee73c496e83e0cc6a0ed67494758f67471fd4a924d0e80c61bf8b1dcae7
SHA512

7bd7d940e3361b2125626840112f40309d78350b817f96a806b4fdd63df4cf1133c5b1e6f2dab4cb81dab642cbc104a930e06ce6992a507bb748418ca872174c
SSDEEP

192:uwjib5nr4ZnQjxn5Q/HnQieeNn0nQOkEnthFnQTbndnQmSIxKzWhlLCIR94M6SI6:LKQ/hXx46luaJ2y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A5A1E01-2782-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424224390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2164	1368	iexplore.exe	28
PID 1368 wrote to memory of 2164	1368	iexplore.exe	28
PID 1368 wrote to memory of 2164	1368	iexplore.exe	28
PID 1368 wrote to memory of 2164	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c5055a837da695bdd721320b19e90a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03e7d5666315087265486339e3c0115f

SHA1
54980c298945f98508094adc049cca238928d0a2

SHA256
cb41a6187638e4fae34b7d47848ff9b56a014eff485a0348ca94505f24a2c2be

SHA512
3274c8522029519b6156e6eb7c56aff361b3d4ba78803764b2cfc4e7028bf814383a1bcb5bd4ec642b7bc9cf0d2eb428262fd29a22555b9c65a461d0d620aa69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251b92d635dcc9ff7ec640225baf9220

SHA1
b5a021ff4c4764719978f9db63861d8bc894a5bc

SHA256
9db06f03ad42a4def4d88ae2dc9c3dffb42710906bccf622e5b820a53ad8ea3e

SHA512
62e180401bcca8ebdf7a09f3359989c62e6ec08f0341194253bc5090059f7a38285c35b1a09f9b09f27e57d95c5b063b367cb5917ff82ecd9622bf74c2c593b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c88f7f35fa92d63bc96f0e1e7ed1ec

SHA1
9ccea79a2cae610ed932c53f780489dec6217a92

SHA256
8d57fdf8425412d5dbbade34a0f3d0e72ee27a282bbbfa25e5669f4c5374a4c2

SHA512
6b6eb629f8b36c8b01e23316e2da4822a953f012eed4220f135d819a1f771163a371bc9b8f4ce2f0bf6fe01c259cd76496960ce4129bd68ac21fb8c5cb54b37b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c25f1001ec0876c9e703a815f745a1cf

SHA1
3b01dcdeb57c59a4a436c69cd6f31cc0ce7199c3

SHA256
d7186a4738939bfad34149cc2cc1d1ef8b4e1812bab25c358cdb9721d3f4223e

SHA512
3ebab4a5ec48fd3bb174c29b361eece088be4b3fd62781111c097834d06da9c9161bb9b4ebf7cfd849a939ca01ba540f43b789fb6986a619eeef54ca607a45a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44ccb233726fe789334bd9f34969b115

SHA1
24057a72ad021786ba8588a90887ca790511c458

SHA256
e38fb737ae96793e43840ef86ca2a7733342399101b26a1ad324e2cf3212a63b

SHA512
200f0db6d65434fece4fb02af91643bb87e3419ad2c6b47e04ee4aec5af317a634004cd181937fdf3f6cdee31e2edb8381eacbfe82815d62a8a6f271f965e98d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4635eda01b57acb27b79c4e0e8d88ad

SHA1
b09660e7d7a0b50666a34e0a672b8abe02e6ab65

SHA256
a2e8156b0bb3c3efcd0d4959b88ea2bc13e7f7ddf25081c588b78219b8b3bd17

SHA512
1c7a11355a667d15aa5b3972e956a45229e1ce7e9113508b2171d6e1c2fa1bc13a7e8fd5ced7d32f80839c6f9d65fdd9b8ed6edca2e9ae30a1008256fc5489d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3c14ed784239b1fa59533560e4a5b3f

SHA1
7c46ac4205fda6b82a6a617c508b94b18f799533

SHA256
9f0d0e550a7462d0e35de0403e2b1f3fc28a038ae773fb09f17627a98d2be444

SHA512
6cebc099e746d28238a8555163158b2ccad5ac7a38c16d427991c2c9d5b8a97bb917393580a4e15cbd5912de8314e3e88d4712c5126651755e3d9e8768df5800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06880aa2d3c92ad6ccb521b05c75ca6b

SHA1
c5cc721f5f5c4b08f5663292813692e8564d4c4a

SHA256
47e07556feb1322fc76458dbffeb9699d432d3b21284ed9d3ee3d7360d95ef8e

SHA512
98ad6905f742cd77a147f629c4c9778e3b1cae13fb4ea248377aeadb7907fb2daa84bb4bd7c6536f736a14be0fb2ebb219d520a112efaac4891afccdc8a51289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7970b2cf7323c24246a6cf48c4b413b7

SHA1
460ce80bb4d65a86cf417e080c7bc825fb563168

SHA256
598760bb661149e057acf8c50d1bac216095e769dd5bd8698bc3eb422e1d8f38

SHA512
21950bc3fc25aea8ae1f389ff8b47586432294cba36ba5d9ae1d235ee3676aef29cdf2d6fad0c91ac1b26b6f83436c4411ffd4dafbdc6a81e634865ca9ed85d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8873.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89B2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit