fcd8117b7a18d28fc13b192423ff5fd149fd2a2758b7447b7d81abb7c8ad9dbb

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e6a58895a9402176418a9232a9f5d2d_JaffaCakes118.html
Size

23KB
MD5

9e6a58895a9402176418a9232a9f5d2d
SHA1

88472e5c9540cf275047868b37f0df2d5a0b75f2
SHA256

fcd8117b7a18d28fc13b192423ff5fd149fd2a2758b7447b7d81abb7c8ad9dbb
SHA512

54dbb614f304e18a43ea482df847cc8682525874d5136c08c5d9228d727b84663754766ff932dc27ec0a383cbfb8a298760da4e3d2ad8be55eb14e6710d0593a
SSDEEP

192:uW/ob5n2OznQjxn5Q/lnQieANn4nQOkEntjbnQTbnxnQSCnQtKwMBgqnYnQ7tnOi:i4Q/mKmP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29679441-27FA-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424275955"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1972	1252	iexplore.exe	28
PID 1252 wrote to memory of 1972	1252	iexplore.exe	28
PID 1252 wrote to memory of 1972	1252	iexplore.exe	28
PID 1252 wrote to memory of 1972	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9e6a58895a9402176418a9232a9f5d2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c3ba1ad8eb26e6ab7499b80cada8eb

SHA1
029f12be8606fbd380e9249e5b1b49d562b8a896

SHA256
47b7fb24b60c50a817dc05252029746c4b0b0ad8d872e444d1f9600c8d3e6e53

SHA512
8a17ec652369c1f0c1acee9ca4379b4d0680790a88f41ee3a813f4b9bb312f0546af7e3b5a720c3017afaed9b18ce5ca9d9f3a01811e7798052523a3766ffa2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18fe14f8e4e842ebe9030129baf0f387

SHA1
307c52c33e183cfb940bbb38c7bf8a59ce8a2dee

SHA256
c68524faf26916110918c556245c97e9a1fa49a494667621c01c0f36d3ee18a5

SHA512
647e6a29b51e84769ef5d2748740b03b8eb4a25a7259348fbe71dcf1981dd62ced36de3510cc89f41bd3fede21445f0b12e03d6217d6192213de827e8c2e51bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d83738d452444a0a1d2255288bce768a

SHA1
cd0668b4d34fcfb69372a6293c7b00b6186da60c

SHA256
56e541b1fb4b95fbd93b15eda05d90ee5b059b83f0c020513a3f1399312793cf

SHA512
28ed84b176daa58fbdf94648b89c7c305655581a9e3654721ce54ad5c2a4b90c38de2adf7910127ea816979f3e347e53ff65ed07c4be5b8917f243db0bf8c7c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46aa0e7157983e86d3a583b75a56de6f

SHA1
9079c09195bfd410574c6e46cb1757ca49947b4e

SHA256
9f84664ddf97def34cdf79eec46ebdc4310b323c7071e696599f9dac564a69cc

SHA512
885a767133ca0801baf8873f54f83b5d04417193abec33bac6c779210f3a1c78ea5f476df063d1df7ca9a1e094f5d7953833649ae2d411ed13fe6f59bafde14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19a23c524d5a55f0ab16e0d2a4e5ccaf

SHA1
467cd454f683b925899c7236c1a6a2a8c00b0f2f

SHA256
ade92aa7668533a47f152a04addbd89b0130a142173f08114a9e1212f12e783e

SHA512
0683ba0c3f82bd82c4b7164f03d2b79fcb75d4614bef0ae13d373760e84a2b4f643d6a5e06fa35ce99902a449e8cfa48f4f5d01e97d8ad1078e3be60cea2e249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
820c781c53bd1ad2d128c2a06278d3aa

SHA1
52ed96bff91a3b0fb7ec02013735575e93e1a314

SHA256
355cbba30d7ce170478c41bfe518177b53f0a635f68649eb045c14f6192854a6

SHA512
91df4448a263bde4fd53bae35c19b9d5220a6e22b20327862429a5afe95cc318f9fc70700fa0ae37933a6f24158042910033fc4ec762c328cbc5e0d03e95c583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a17e7e624052ba97f951376ebb107e

SHA1
a33e691e5a793e9e1e2825bcc5be12cdf7ddbc36

SHA256
dbbadd867a436c529a47e3d99cd7f98003f288bc033f3b356d85c2214c48b9ce

SHA512
56b0217b7dc9c4a0ff9e453608943214a5cdfbdcef8d9dbc6c1adb43a6c4e609730b108f22a546694b831ec7a2cea27df1ad71fa305352f11b5f3b2dcea8ab4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9094219ec0b5e77a5b6dd4aa97c0915

SHA1
ecdaffe1dd7b876a376ee0b88a3652f107e5b683

SHA256
2cab5c7345eca6bff9ab0dbf87de137c6a5d05eb1b0364f3bdef119dd8213253

SHA512
259d50f64756ce9d2a914b62aa353161090e6017e0a48ed2c588c476108fb7176e5413443812186ea27d9eefb260c5d8f0dc7b5cda3a0759479f2353195ec91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7418.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit