547a7a0c0ca03b09be9a2cb2e28d74c72a67785f1a4a944034f7c724ac5530bb

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dde44e156509af291f8685443a610ac_JaffaCakes118.html
Size

27KB
MD5

9dde44e156509af291f8685443a610ac
SHA1

688db32472699493c40165a0046f3c35d1e3d90a
SHA256

547a7a0c0ca03b09be9a2cb2e28d74c72a67785f1a4a944034f7c724ac5530bb
SHA512

0f6729616bee7b95e216fb9327792ed64fcde85c9d481ee7ccd1f0aeaea02fcba7dcf37a6f7799701cfb58a3e57634bfd577c6a54ec28ff10e8c21dabd5cbe2d
SSDEEP

192:uwHQb5nX+nQjxn5Q/mnQie1NnfnQOkEnt2EnQTbnRnQ9ehZm6lbb9Ql7MBVqnYng:OQ/DMT5bsSvc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424263588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5EC383F1-27DD-11EF-B5E8-DE62917EBCA6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
332	iexplore.exe
332	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2912	332	iexplore.exe	28
PID 332 wrote to memory of 2912	332	iexplore.exe	28
PID 332 wrote to memory of 2912	332	iexplore.exe	28
PID 332 wrote to memory of 2912	332	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9dde44e156509af291f8685443a610ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54860efa2ea8f6dc62bf78b0d25d207f

SHA1
a7c2a4954648b9700291a79c29fba11cf96faf6c

SHA256
814f9f3652d06a3c20d4c8f28309afabb08c405cd8d6d3f095d9c2ec4be4d836

SHA512
7e3d5f7432db3ace9d9a7b3645044445fbd87ea29f92a377aa4c7d8e0ce88fb314ca09e750e02ab31c0caeef7ab521db18074be8499f0562b560923554d97832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0159883cfa3493a3f0ec0c2fe9bd8a04

SHA1
7498fdde543882711feeefcf362c2af5fe7cd915

SHA256
69b6e9d5e5cc29afab3cff983ff5b726e25e4a338e97aa50dbdfec521081416f

SHA512
8e9c2bcf3797144865d36ece893f111796c05f1433cb7bad83695ebbaed3b2caa4bb21635368f213d35e0a2d75cba9b599fc2eb62d26c337182d7120b7836cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5cbb96414ed23f437ca7732f19be610

SHA1
21995e0551997536198d5d1a44ab68d923cfa697

SHA256
6782873e4cea31f010c5250bf64de87ad8c9aa8b5514aa0b8649d6be79d7331e

SHA512
904db074fc8dfbfd9f9aed36d76a658ff1ea40f711b23c4044f8431d1d1a5cb8f141282b05c8ef6256bc9edf9cd10c9dd98095aeeb82094da35a252e4e92b793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bcc45a878366d8a8e81d4e89a29c1a4

SHA1
37c0f34c6d7fbdefdc38be9e98e02b1a8b26bc80

SHA256
12ee2bf9b393d9b085a8d6d2b48d5ed4b2e1cab94c261fb59b5f8a2a85b1bae8

SHA512
ddfbb62253e3ab9ccbae57aaaac93758756fceac081b9d364899dba04208f5d00c9a7fc9314576a580c76af9e85482ad2068b7c463e9b305623b6d42ffd02bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73c3cf18b5ee811f0a1099d55170f6ae

SHA1
887ae72deed7c34e94d90a83a7cf46bc56226e6b

SHA256
f56ef98d455f9e07a7b377ef316780438fbd5efac11bce5a04d97d5aca3e7797

SHA512
3ecc5ccd0b3026fa4790e6c64a035895d259bc44c84f47584390b479ac75af9de6c1321b7f461e06929b0fdf7c9a20392be9be21e9de677dc8cde50783130052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73605bf0a079939e92325554554acc41

SHA1
549afccaab89db1ba8cee87014b3d054aa7d095d

SHA256
bf2f3f0bcd92e1ed604472f0d3ac6540d282634a5fee523fe0160a1b6dc5a8d4

SHA512
2c605429c8f485508cd859e7b01fea1e199ec55ef84a4e939910044217a690713616bf460549b70cb12d121c10511ec104446e8bd1f4684c2da54efe1a4e2931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8775cd4b04a5aaa4ffc7ea4bb146c919

SHA1
231c07164514ea9070033be05a62d8bcea21298c

SHA256
531f4d60c7d196dfda8b0c15be48fe5fec285558bd768b908cd2670b04e32d19

SHA512
6353ddc9512e1b65e24018bafd60d8842ff40346e222aa6da291459ff6ddb9b07a80e0ce0a677a163177823902d646eb8bf50e647d7d8e08d787272921b78388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15d6d922bd9ffc1ceca5b31867da2378

SHA1
6e3c7040f341afa1a247040dadaf65bfeec28ef9

SHA256
5c09692bf54ee2a193a1d0b34777f78eae38696a6ea8ba7115d0bf4b4ee70e8e

SHA512
0e8ec51cd25f4ff42a79b855fd86003738744f78785c3595c5e0b43873f61266455f5e79ed2ba16f63868d89d2dce6ce9cfd41b4de29f62168785cd34c1efc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3285833cf27fa6089cced68726d6ffb

SHA1
453dc832d1bb3fdff3ea30945289135c60e060dc

SHA256
82b30fec6f3b75a083596b19a3f82dc3d474b5b9cc53b93d75dfbe14ad6a7448

SHA512
763d29e78163ed1bed0aa52f5e7c81d10a618f302bc6353fa637685bb15369fe9eff6347cce1fd45b8a8d137704aa549076bf474f62394ccbac058db2a555fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar178F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit