f9bde165567e441da4877ea3274bce2488b5d99c258425e1196486684a87f12c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e327f5141f19583cd5311294cd38381_JaffaCakes118.html
Size

22KB
MD5

9e327f5141f19583cd5311294cd38381
SHA1

56ae79cd38632a2d1f032d30313c0d600f5a8d54
SHA256

f9bde165567e441da4877ea3274bce2488b5d99c258425e1196486684a87f12c
SHA512

2c1c255d701b9ed5912e0a655166b947d01897b3fe549541eaf8e67833217f296dd8d591888a036d0790390e8944981e3d5ac56b90aaa5138b3e529fd9bd2539
SSDEEP

192:uwDnb5nEXWpnQjxn5Q/OnQie9NnNCnQOkEntC0nQTbnlnQmSOxD5xHMBdqnYnQ7h:KQ/THJxy60E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1876DA21-27EF-11EF-BDEB-D6E40795ECBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424271201"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28
PID 2168 wrote to memory of 2868	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9e327f5141f19583cd5311294cd38381_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1fbbd0bafa3c40252e9850b0a113e782

SHA1
e58a3c668d6443f20bbcaf24ba0a37beb80a2649

SHA256
58fe5ffa220a15a499d1bad7a7c88fa4fa982de3218924582976af27c6ae53d6

SHA512
bb0a7045e930d525f3cc5b718de5b70d61d0dc2c7f60640a16b3bcaedad99b1f4544ea5ebd569c65a50da37a4d574a5707c0145105b9dd0232721a36426b5509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f1b0b8be43916595abb2408f5a42c77

SHA1
916915cab930ee1479f83f2f938bab5e4f51004d

SHA256
815e03172d9830265fa24f0f2e28bbdbcf47897e3a7be754b62220a565fcdb1d

SHA512
253787a14f7bb75f3d33b774ecec0410830349aa578cfa8452838fbb541e9bd469711e612c42c207890a92638cd4d9d65732663de0c0de3515a5c020536a1828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ece47fda6aae3c9dd874010173896642

SHA1
9b6af80ee889441ca7962f61f42b0b1ea5854024

SHA256
6be31f6e58fa02befdd96c4405e741f43d76817df384d02ea05b509a070926cb

SHA512
b0f387ce142f37ddaec0340e011a822337aeb1488ac7e562284c6640063b5891b895c51396e5c86d32f9c675f87f6d7d15e61adb25c5c4328e30c21c18a04145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9082f6df181f4558a29736a90aea6e14

SHA1
7d42dfbb7db385ea94d3bab57a7d85a25b5d5bb5

SHA256
8cdf01ac6bcde73c28e69b06a2534b792cc25ca7eef87ede77844497cf66b3e4

SHA512
665b905c71f7883e56c198f3cd645a7c44ed6b4a360c33410cb7759dc5e5ec61be69128053e57338ac2bc47402b1b411abea31c74b30ca4dc49feb6c92bc0fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e909ea8c03f51daa999f7f5c69aa7232

SHA1
4dc94561cb2e7d81b0c795197b10b6aca771da5f

SHA256
40989c8b96e0ec7225fcf3451835e1cfc6cab157a2266c41b79a538b69d3c70b

SHA512
71149616f6e85cce0487dd67f57b5b0b88590dc93a518e9074a24f3007802d94b3da434a521af772865910971d2ad0aee7e1cdb2387356ac84f2dc0c92095186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
897aae9ce9c044eca1ff4fc29934f139

SHA1
6ec68f29b0f66eac21b8f514abb66a64e150a1e1

SHA256
f165bb94c21adcb5bd25652e8516abe84ea51f9f042bf6aa04e30715c4604391

SHA512
fd5bb42169116fa9a3bffc703b3e43082503c3dcb1014763044dfbb1884302aaf513dca9d68fbac99ad89bbbd51a483f85e75e4fc3f99ac0ace5711ba31f707b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a289c8ee09c6b85bc1a4ff2c12a16a20

SHA1
ebd00fbd7f61c69a4174221acdca40c2b390dfab

SHA256
5da3dd19e1873de0c98403b67d608a9c58481d9cf56afe89074bbb8656c271c8

SHA512
93dc5ad07efa06698d75337df355c91df4f720477b4ca9ae5034502043ad5494a13dc7790361061c7a685cf40f61cebb6dea31bd8b9aca81ede7485de25a58e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c428a558d1d8b9ff4863d638fdc2fe75

SHA1
73fe2869ff5afc7e823358a26a4741bff1107536

SHA256
b0053eca9ba638adcaf4e2bfdf0404ad83a4f89bbcc0b21aab580cb19e63b433

SHA512
749f5d2ba3475ccb2ab7aa9b364247b40364b2f12a0e430e7512f3c9004209a556464e185c1bc86f12d6945ffba15a5a63abd61f2eb85daf4653958685ba4c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a902af95fb13f554be46bacaaf32444a

SHA1
df70708b913ee5189059d580a85fe63acb5f788d

SHA256
574c9dfbe75d6e8786b47f9d84551a730f27ff8c6a782cf17901b81683acf48b

SHA512
998c29993c78a915b0afa6f8ab813545e1bc8a0d077b29afaff6421f83625a2408359a21da05f01c27f287bdbcd6fe9d6d9e616ede5fd966dd017f62dad6347d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe5a62b5b7261f3b5faa16891caf5d83

SHA1
c3d2518a0d837b53b172cbf4a13bf3599b196dd3

SHA256
f1c9d98ff203722216da9e57db663e96465b9ccb15cdb3aecfb3029da9e29e3c

SHA512
223306da0efb29c77f45e086ab4a2f91d626c1ff9604e0e57d8beeecc24059998b9e543521b9c3aae6b2c1dd71ceea3e97d41f6026a39b6baa1ca39a482a80e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b87f4e58f141f8975d96cf1211c7d0ce

SHA1
04e441d63ba153fca96b7e97e0d9b09897d9f8b4

SHA256
038a42ea016ce91bf38e836924151d38d3ebe19d17d55b99b62c5174c878895a

SHA512
e8b711f28a64558e152d350b76c444807ef363d495dc395b58c92a172a4eefd7ee541c8a08dbcba5a223877c56124506b3877bc15bd2315fc6fe1f0e8150238f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit