32e0a6a175147d9ee3e73ac61790f2cd7e6e47b210a5908d5eee97dde9ae6a06

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ab2c0747dcdafa4043ec1df0487c3c0_JaffaCakes118.html
Size

27KB
MD5

9ab2c0747dcdafa4043ec1df0487c3c0
SHA1

292c83e17be02fa5ccdc01e1f5ed1f5a3633482a
SHA256

32e0a6a175147d9ee3e73ac61790f2cd7e6e47b210a5908d5eee97dde9ae6a06
SHA512

71b3c451e26b188b5290535a714ddccfacb79edd181f0b5d35bfe9d57ecc834f6d984f588231ba4e3bc66da16a3dc37bb9a7abe855df5a60f5c264c78945ee51
SSDEEP

192:uwPAb5nnmnQjxn5Q/GnQie1NnanQOkEnt+EnQTbn5nQ9eZJm6ljTVQl7MBVqnYny:2Q/0UDhTUS3IY8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A11A3AD1-2726-11EF-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424185102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2392	1956	iexplore.exe	28
PID 1956 wrote to memory of 2392	1956	iexplore.exe	28
PID 1956 wrote to memory of 2392	1956	iexplore.exe	28
PID 1956 wrote to memory of 2392	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9ab2c0747dcdafa4043ec1df0487c3c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a017cd02aec9808c225c2732812df625

SHA1
a28d319eca4aea362864a22d5ac147682c7fdc9f

SHA256
18870860f85a7df0cd262e398fd06cc59bf3f8574f807ec01f502d2363571705

SHA512
9ae1655341ae46179c5d92ccd87b665f54d0e7c4941fdeda0f912b8ff3a4e8203998ed5e9987aab7b5e1cd0a9374a1a10742623035282c7891829c1e5729dec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757f994d92c08ff79504b82e24a789a3

SHA1
d37f88efd7d6fe9886b19d7a1e57bd83144344c0

SHA256
28393e6b88f3bcd9b6d7f6bc80ea5747ba37cf967247a8d1747ae0c0a8034314

SHA512
a15760ed81e7e96720c727d636a741a94f891764d75fe9268dfcbfd6d4ac7fd8ab780a4c26058c0ca50ce6341ad82e2d893eee5c776042e8af27ee43423ff773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b1d9bd9428dea1b63acb975cc706978

SHA1
99432767633e3750b3aeb4b29c38b715620839f6

SHA256
46bd2475f447878edbb7def00ba598e109b5e108ace2926298cd0b435fd92ffc

SHA512
5c872660021820ac7f70176a5217121d3289ef2f6bde1221b284880498fd22172b8542f3b449d3c3443272520e19e7b2c6bf87c09360ba02764552eca79f9b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394c2563d0a4bf4efe547e272e6b21b4

SHA1
36e2d1c5601a2d48397f5b5296aebe71e61cd561

SHA256
978609c5dba555f6790e1ecbed9514d44ce254d3d525ef87195e69e7d24a18fe

SHA512
98d0a72cb28cb7553295debaec294abd4c6921fb6e2ac472088a95b02d79e32871fca8b130cae59b0bf88d47112d872744ef85df6b3c148687920b3cca9d4c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c328bdc7d42913d9d371accfc073fc57

SHA1
fa227282f0ed8cfa0cfdbb42f5e77f45e7175ceb

SHA256
f8048a29f0fb1db5981725dbd5c88e4b341790650ecafe83ee7954393f6fa6df

SHA512
6773dd3f2899cadfe4e9feb1ea3ddac70c51759eca4cb64d710d7cba49f8701f5c60211241490ac86dd24b53c6d5ab02787630474eab42fd78e26d4aad358229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc770c033c0ce6a823075a579d4a14e

SHA1
83fe1bc300cf5d7350e68e77cba34cb2db7ca34a

SHA256
0dfe020003b31266b67c148c9890df4dbe037f00a112dc88cdc8b5cf28237eec

SHA512
6cbfaabad1784b2bce5f20a7e28fe37697152d82ba1f5df4baadee3b3eb3078d4fb2e593f79089360c7c3e3dc3b99856d6bb9d2e0f79cf1e7ab7465a5995341a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4690880ad8bf7765723c36792fffcfd1

SHA1
87fbe039ba9a64c891f8e2887db85c0e5ab123a3

SHA256
6653f19d86b9dc4b27500d0a3ec07d19f1c20858da5c8946e2f0815e13b608cb

SHA512
f4e60facf6968a84da26eedd869a44dd0afddfd1287b1e983b1b331daa3b0fa4c1f724e8d753dd78e38d0e3b404beffcad0f68704bf8076efe4468df0af7ea59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11a5083794fd6330923bafc817bdc518

SHA1
8d4354bba60d2804bbfd0041e8b043999d24de21

SHA256
85119a0fc9d6cb7b6127b0f0aa17016e1588bb619b97371c831057c43ca4ce4b

SHA512
cf4e589b21446862e29cb87bd35dab3f0b2b9a7b3015b07ef71acfdec1ae4e51a3c33394266af60ad7223ad6dc381cadfb4b1b968f540ba56405dc2a66cb972e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acffc2c8bb75dd7202b340ff93ad7263

SHA1
02092768c90ad581c530bb8dece6938b7fa22567

SHA256
85256e7ab98034e462e7ed39de6bc9fe557ec46ac5b5ad4d9cdb83e1b24b2684

SHA512
fb320bdb956a7a82eb25928153ac72de65bfb09b9d6f13c5d13c1fe9dcacb4d2ed82fdb652bfdc69051c232d605ccbe7cab82a5a22e9ff34ed57d8d978ac358d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit