268acddb76b4acf247a6d936f545ec9468e6e0f6ce1e5e12690b85c623ad1920

Analysis

max time kernel
66s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a6ab7c0472092ea261ff8ed914ae934_JaffaCakes118.html
Size

59KB
MD5

9a6ab7c0472092ea261ff8ed914ae934
SHA1

e7e4bcdde78057d4f504618c4e3ccc21a0df3f09
SHA256

268acddb76b4acf247a6d936f545ec9468e6e0f6ce1e5e12690b85c623ad1920
SHA512

8aecb0179cdb582e162e9d968b5f3c682cb5d1dc11b1b1a98c887afab96da3018c25679135750f06efd80d6ab12a1e84b7c097cbb524b8b64215ecddf0e2a1a4
SSDEEP

384:2Q/WguRB3bWvOjVfZXsHtcPanHQLLHesTs21Ncr/eleDW1asjKG8VTkqWFO2c:65z3bW2JqmgHILHeL2lS7seGSkqMvc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F375E6C1-26F5-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28
PID 1936 wrote to memory of 2264	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a6ab7c0472092ea261ff8ed914ae934_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a775c0a7a888d1d3f458fcdaf84d878

SHA1
bb4ec0a3906db7ce5040a0a28cba31b0a0f42c39

SHA256
b3a4dd7a44f5305b83fc9ba4993d828097621d22a4c1d670844a5cc283eb8218

SHA512
6cf94a8291eff445d640e58a49d8dd0003d32e708217c15c65af49c985c44d44adcaf50c69d0873c2371ed5f2efc430ce0959e9d3c16398fd4d8afe3ffe48e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d011a5a0898ca502c1e0c564c954a42

SHA1
943e710987c5a666b432a6dbfb6dddea26451829

SHA256
7a4a191f37fa8980a5d98db107bb8d1df0bd35654c857920fcaad3f799b0e57b

SHA512
1a55f0c270be9ed37226bf4283c04fbf2c1c7934a2a294c33e684cb552c5139f96e88caaf9773c98c91510c9a8a2b469868a1fbc4f657aa33f26c1def4542c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4263b9ebb0106e96edd62f89b0ff18b

SHA1
ff193966dd9bd781d981a027673cee855f0e3198

SHA256
8181d93e68fc1c32c84efeb9d603e49da06df4a1e4a04efc9612b14f056a9014

SHA512
fdd7ef86fdd026d4c2093e3728ddd0a68a53b9f4a786ac87829377cfe51f2faa38d2b067a91a6133b78a167814f995b5bb87cb43980bbe258c995da4bb77fca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44867799ab0ebc11a3d491f29f518ebf

SHA1
7ce87a94683c239eac19e12793a75ebee3409af0

SHA256
b42ef7a48901982ed01ddb32f95db1dab8c4114a2872c69b30cab98d8ec8ac30

SHA512
3b2e684f6bda5bf7e3d7cd7b448ed67ca48fd82258d271b7923fadbf1aeb67b6180cb71d0402e6cf566028627fe23cfd8b88a6b44e526d856285be36aa125161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
380ec1db0906083b46b2b825c281d42d

SHA1
dbbe396f0c67d29c7d1d8e1f9248cd606eac5a81

SHA256
0f373fff946d09e808e2c5f9ee4bb270c84cd0334db7ead02741d14c36c55a5f

SHA512
8fe855b0423cc1e93c00337f01241373c7f8af0418e7b55ed780d160062d0201fc53e823e7a6d6177451270a48b56598b207c2d6762372166564f20e8fc9e6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
388cfdf2b33dccfa42523b784beafd8c

SHA1
480f3a3c3f632127b7c38af137458121f1b67d92

SHA256
9805b296418f1e9a95850f8190a898aeae9f660ad9cbbbd9fdb5c8c1ec248a42

SHA512
ff22fb730d491fe9a3c43d504b5051586dcdcd1bc5dc7cf7b6bf1b73d04abbd2c360a7fe8b56b2081565cd3ab233833b5354964888de46ad6ea2c0ddbc5684b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f91a0c90373065e908435fd9faafd48

SHA1
ddcf85a080b9ab5c0cb908164674b535abae4d31

SHA256
abdd981ea170ada7f2d4fb5e526632d862b765710d3d0501ff79199032668cad

SHA512
6b83dd0b13887ddc16a8075adde5aa17b050bbecf0b7371c83ea44b7eff4fc3dc52680a1c89e8b575867ab5bd846286e22a81878a9f9008ffeeb539b6b4cbb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b339f6057a23accd185460ac0158725d

SHA1
004aca3a9e41e2ab1bffe1e2f0df69920d62fc41

SHA256
8163618f2f70883277360721ecf9a16790e7c901cfa414a16a7155e680ab3455

SHA512
916cc6b5792faadadc7be551192e7c1eecf119667e8693c1cfe9b55ae4d4141692e74e195a933348dec34ab008c1f38612dac303efc404e2691bdadf41b52b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
316c21dd4ed3544f8f232400cb4ce9d0

SHA1
eb60c4816b0f70d3ea692ba9e0401f26c286ad64

SHA256
a8f06880158bda89f47140ef1f2f34c6758fcb6c2a3d18e0b2bbed287348677a

SHA512
74000cab79ce7dfe2193078d68dc96582666935cad54b1a7680e7f6cfcb382878a630f5e90b88471e6fa241efe251b50034cdcc96e1d9d89cf40e351cf8593a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit