54ddccec773b49a31de1855d6c0f058e615f12a60f4bc6e846d871bd6085e16a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d94b569cd8850f6102a6643f297e883_JaffaCakes118.html
Size

26KB
MD5

9d94b569cd8850f6102a6643f297e883
SHA1

bb6eed1944304ad5890f8967d535046bc45c7d22
SHA256

54ddccec773b49a31de1855d6c0f058e615f12a60f4bc6e846d871bd6085e16a
SHA512

0185b0e5b9883d1ef1bd6a4c13cdf648408bb9d1c6be477a9c989692a9c5604a5562fedb2caa975c583e564e6f203c4081f2382e7578b98ebad7f49b8122594c
SSDEEP

192:uqFXzhb5nXmnQjxn5Q/2nQie1NnfnQOkEntqgnQTbnhnQ1CJVevo7NtYFo+NzQ43:n5Q/7ygc3XH6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424256995"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050FB361-27CE-11EF-8840-6600925E2846} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1268	iexplore.exe
1268	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2600	1268	iexplore.exe	28
PID 1268 wrote to memory of 2600	1268	iexplore.exe	28
PID 1268 wrote to memory of 2600	1268	iexplore.exe	28
PID 1268 wrote to memory of 2600	1268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9d94b569cd8850f6102a6643f297e883_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa5f7499e79afe9437ced5a5fcf209ce

SHA1
6073040817928d4e50e5178442c7b915861c597c

SHA256
17808b88f7f903a118e4c5e89ecdd26b1776faa857244b05454de8c94d0118a5

SHA512
321c98263256d89b32062e10757b154398d610a73f0a835dacb67786fdbe80affb9c3d6cd30f5c4f215a866246aaf7a7b8282e96bdf188b69c1f868e37194541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdbe0485c5d1d0341802c7928f47d24

SHA1
7169d8d3e8496d33e2f4b9ce1147c7d673fda035

SHA256
e8f9a345f438d983cc6a18f3a0bfcd9b6c6f5406da22fe34132ef77bc19cb413

SHA512
850227ce3e911e61aa433e773ce7af5cd3c7b091e394d6f00c620c9503a9711edaee51393cf26514b3885a94ceb92f847a31c7629032729d6d39dabac5798274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eed7ca3710c61218934c0470f7771651

SHA1
f7caf9441e43f9ae05574b8eeefed2454710ab69

SHA256
c7259928b4e50f81e66dfa4fca48b83dbfa50ed9aaca70c5d795e0dfdef92139

SHA512
e9ea91300e82fe153a9675e8ad568b4adda8dcec3945eccade75ac5c77f18c680fbcc6166698c89a5e398fe973438d262bfc9eb27f5b8362270fc56548523fac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe3fabfb18499aae1451910e7f30abdd

SHA1
814df74d22c0710b4df68a2fa6097fbbfddb56ef

SHA256
340a754e1884ec0b65e2ffd262b978b1016830f7e95c3e49cda87883b1feef0d

SHA512
c278240c8714239f8ad6a58597dbe9a46142857ac2c2eff0c46c894ac6eef55c28fcde401f0c4132f959a758e622beafd28a65c3ce6f0d9c71efa9c1331882e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7081185e4f459bbf6cd4f2c7f56cc486

SHA1
bed3fd1b88b6e50e6ce34f4dad468adc097bda21

SHA256
94a21a3100238ca859f2c9abaebbc0f4d6c47d0b8d6376d27c784ff94c7bac6a

SHA512
3cd4fe449c3b5e302d4d576b2ce857e55626f765faaa995ccf35f5ce233fae070a40abaab3aa67b0697239f9dee77e1f89ab03b7abf8e96e88f595a65a48057b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60d66e627421d91807e292838f48af18

SHA1
1edc8355df95c0c3b86688530bce686c998655af

SHA256
162a614b20c706d25bc38a7d968f668ab3ef48b71bdd18e588e4f9595b3fc9b1

SHA512
46687d45a54258cf9197b6abcb31f8b4e58ce29819cfcb6b2ae65a9bd391f6361a426f5fd67477c812d6473b18163da65749a3424f2d96a00cf994f2ef740a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815c9fe30eec74447ddf80cd282733f0

SHA1
443db42f88dd2e9ede8affda7da3d580302e9215

SHA256
fcbaf25cd11b7f8a05530d360493035b55071dfb5a5a6bf64babfe0d2a363197

SHA512
2acbe921877940079d5449dd2246d112b315847404107b881e4f2d85d6b09f452040ad8465656ccbee7f2abb30c20940cdcbfe679b79a2926eb5d2abb86dede7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db655604582a3bca34776b2a9e19141a

SHA1
7c60020b6be2f5fe558ace5eead97ea47d98d1c0

SHA256
d4a84ffc8f71015af2062dbc9a34948cb231a296e4635cb63e26e93ff1805be8

SHA512
d12066512ae245ebabccdfee6200d6f636922b09162b093bddcf63119e3ce3b87e48891f2f6f4b396581de9bbb51608bff50fc754022a7d06821cf0f52003ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF65.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit