0d85e53289fa852540d83beb047e37c0920a3085488de16a4fc37e8c2d73859f

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c9c6edb66ed004898cd5a61bcbbcba3_JaffaCakes118.html
Size

35KB
MD5

9c9c6edb66ed004898cd5a61bcbbcba3
SHA1

d4a4a474b08f94ce4b58091ec52209befa7e1ff2
SHA256

0d85e53289fa852540d83beb047e37c0920a3085488de16a4fc37e8c2d73859f
SHA512

a13fb276598b3437a78a0742878e7e7f8791f260827af28531f6d5fd6be3e37140109c15050a404881d43258d9273969898b858979706fe65a9d59a93bb2430c
SSDEEP

768:zwx/MDTHrj88hARUZPXvE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLR8:Q/TbJxNVNu0Sx/P8bK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fca501ee8b75b346980ca3effebb2c7b0000000002000000000010660000000100002000000062856ab877d75ad114d429e3422fee3b7e9489d988482985fbb4e9b285ffbec7000000000e80000000020000200000000c99b37e9ff978e6ec44d092b612ad03bb13a7000a22502a316385abb530ab3a20000000e3ff28ee8b4b930d19bd507b3770206d0db95c62fa154e1adbdfb27958e1db3640000000e69a4b6dd2ea501a15ffde8636fd197d0c55d426c5f0ac204c98a0fe0bd7a6b07489192118636db13399819975b3ffb28dfee9db293205e5aca5a9006076c7ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424231961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB8A5461-2793-11EF-92F7-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06b298ba0bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fca501ee8b75b346980ca3effebb2c7b0000000002000000000010660000000100002000000052f592e64a1e2cc7d0fd38382ab10685fd950d30b43c6560074360f0f134bf27000000000e8000000002000020000000e780a622ec9b5ad87a831b564bcc29f4c777c05f28c69b53cf75b5d560cd81a690000000e7a344002fe4a3d433c08c18586c753183b105faba98844eb20330d44893ce8af6c495333ba7ad2b942ce3bcf016f69a477e8fa39a75dd5f8644fbf8c276f44a361681f53e1eb2692dbe8cb7a41df8c82da3a940a83f9c4430bd9fa946bf6d7700e438894792d46a8123f6d5a573a744715964ecb8b68bc8a34aed4b04e198487596daed8578e3c7436f4475cf53d3ff40000000d1265433954a80ef66c684f7c26b5285319799032b482d09e9061aebde9afcd8d79a8fe6392b5793446b0fc8206d181446fcd4c64b25227bbbb1f6d7bf1898e8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c9c6edb66ed004898cd5a61bcbbcba3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4ecd4eb79900898dc6cc25bc39f0788

SHA1
3b1217f8de5a0114abd19a26d665f80e3822798d

SHA256
8190d4a55a01a30e334996fa340f8d7ad0de7296f7524322014b17b5cefa1b29

SHA512
889e1db766b8a7049001172c41859cab171074934151bf8a75dd127b7c319a9e32a001587811515d868c87f1546708f00c358ccc792f69d4fea98cd45ce838e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6686e96932432097eda37f2116cca65

SHA1
62e44a7df6178eed0ade6b32186f423f6180b67e

SHA256
4a5dc80fc635ebfde71125ebd3ab758a3ca8965e5ccbf551cebbe579a8ffd6f6

SHA512
dc04f9fc6e3041e44d3c7660b265db105861c7a84d918fb48d7a4003a25eefa5ba6eeee2d144545a23f0830790a5e67862acfbf7a4c2eb914aca914746bb11c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e582bf9ed54cda699c686a76ba4e1c87

SHA1
5f30229300454756dcd65b56b9d65dbdc3cb517b

SHA256
8bdfcfdca1ba133b85b44d0ecace596aa8bf6b618694320782de36e37878f9c0

SHA512
b217fa48276d63fee90153e14f5d89f2b40ef06499e0607b79386cdcd2f013351b8048fd192769239c9886806cd2bee45462bb7aad841c09b943def151e5f3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b605cca1e9300294a141d08596f22c9b

SHA1
6bac2c413b34b26ef7fa9e048cedda3352dfa136

SHA256
4c0645dccb94287544dee769b43172cfac33ff2bfdc41804a63d424457ffbbed

SHA512
8a57d34e88b44f79cb73c8191a8f4b72b85188b8c78f2ae2d0c96c1c73869418049fcbfd69a50f03fb733cdd5c3c3d0111aa8d91459f0197ce93c8c85e814fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4937853beca22396e0522b69106e3fac

SHA1
2477e4a0e5c12ca0f6d991979a40025efac76911

SHA256
bdd2f6323fad08c20dc79fb398bff4ce1dba8f5676adfdc2b1030e4a858d7a41

SHA512
aff1f22b3fc23467e30f8f51195c06abf4e3675462134c5f246761c72e8404ff9d93700667cbf2f5443cdbca60650771fe29162b7376367d874154da8998b694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c825d89bb47ddeb4d3014af5e4fb3738

SHA1
59e8fbda0a312aba749bf3d88b2f4ecb1ee2ee22

SHA256
7d01918409aa32a1bbcda448caa169b43228217c094bfc85a21b21987618d37a

SHA512
5760d54a5219f81c00f898b24c7830b475049dedaa5acf2f7690eb915d51da2d339960b96846ee705d5b0e34d064dca111e8c1beec55dfdbb5a273b81acc083f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1125533b2e1a970b45446f000776faaa

SHA1
9c46fc46f919c103a64619f6523f54916a0101f8

SHA256
fa9cf0c5f7c01485313597dad320f2729c9065ed29d5ac1d427c1afb864d1652

SHA512
fd9b3d520aa507e373d681b6fdfe1d944c691a0e386c662e7626b2276d8d9d936ba53a7b545e99c83c947604cec57558468b92a081b9e75601a75a44e7370d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97eb741fe3463eab2cfda113b2828671

SHA1
ed575ff0e3b0d7530eab992892e6eeb5ee1f6d91

SHA256
5d88f829544e1a8fc7f052564f1073a7b938797afcad7e581d538a45c82e0b39

SHA512
3f7c3f5d76b6ab66073af3f6f034d94aa0dadd4a2d143a20cc26383f38c8165315a2a9e2d0a411a951093def59c2132f53dc972ccf2de98117e1bf3794e388b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36e6a6d55b39b480189fa3d11a4cca61

SHA1
1ae27b2e1a47c57cd786703186e6a907052dee60

SHA256
5967f2c801e17b21f452a6c0c2c5796117041141c720a9e3e30e7e5bdf981389

SHA512
e2ccc884ab2b69f09b4a710213d97050637c9eaf1e7aa9b5e0f3735f0f39de251b15d4b224b81fec7a2661b371db42915b0776ae35c58472c40aaf4134ac1641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3d30c47bb9ae0d8335b4d7b19f732d4

SHA1
6f24ca3a43d056e8267eafb51e5ed2df789da90b

SHA256
67cbb8f9559f8359c5e1e87fc898a12dfbf3be9f002dfd1d00a89d0e26e946da

SHA512
d215f33976fd98a7b72e1c9059e793c7159689847aefeea1afd4a7e7d5f7aa475893b4ceb0b7e8854ddd0de6b82b7a72d9e03583043d082f987992cc353c8ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\e93d7024558d2ee595265c43dc1084df[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab425F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar439E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit