ae74ae828e6874299aca05e967457cd1b9badd65a2b2a9e46df093a38fc268f0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9f20f1ec3aaf75e92ca04978ba80ca8e_JaffaCakes118.html
Size

23KB
MD5

9f20f1ec3aaf75e92ca04978ba80ca8e
SHA1

e8923748edeaec640f3a0f4c9c676d8dff9ace6d
SHA256

ae74ae828e6874299aca05e967457cd1b9badd65a2b2a9e46df093a38fc268f0
SHA512

778b7a7f79e005cf0a52c4e62da89b8227cfeaeed7f8cdc1b4d60d03a48ed5cfb810ba3d422039d5cefbf7610e3b1df5506ccc2e631626e19859d54ccbea6dd3
SSDEEP

192:uwztb5nzgNAnQjxn5Q/vnQieGNncnQOkEnttpnQTbnBnQKdjUvMBmqnYnQ7tnlE3:6Q/7Hg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424292098"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C00CA4B1-281F-11EF-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f20f1ec3aaf75e92ca04978ba80ca8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
961ca5292661c72edfdf7d691531e38e

SHA1
83181377a2c2051d32554e001ae757dac53a53ef

SHA256
89ae58fcd272c7bab4a7d43f29bde2209415905bd01aecaef96e6a9075e06103

SHA512
cb958fc192499c526bcc291ee8dc1a4887a15f0cc28778f34094cd652b2a80987dbc64c198d1272285b5ff0e481df1bf4c670187ee7b25a22e126e3c739a3c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a3f394d540be1a145afc5716924e7ad

SHA1
c1a9a188e026968dc3eb3491f2e11f2173db2758

SHA256
b98ffca3d8a2eb2cd5cc544d841b10ca628ca2e3f37f12bd7bad9aaa4f77d6bf

SHA512
cea07f188bb7f5e0c9cba37da942cde8578040f069f8fc1c45f160433b66b2f0df92222f28c1b04f3e02b4e1e166ad20b383a34b1bf9b038bd4128229804d049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b8344caba434c1166a8a080f49042f8

SHA1
cbb3d0a7fbebaba99e6362eb2f2edea04544279c

SHA256
88c60fa098a662621768cebcbf022bdd1f637bc95850ae18f9688a7b6f11eb06

SHA512
f00bee8ffbc530c6d5560d10ab373159e13ece924bf07358acc6f313d73e4d47273741fdd71f089e370c38099518e06d860f4ea123d2ec7ecf6224083f0cb377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be2c725d16ea7ad70766d502a647c9dc

SHA1
e6229b570f6260571fa5b53bc247af31fd98ac67

SHA256
29dedfe2be31caf1a80630734514035b5141043704a33581b721508c9e838d18

SHA512
8c9cadcb87e8284bd3def24f3a19336cb7006b468bbf9cdfae3806f932900cb70608e0e57468fbe45032750a5acff5b2a04dfd829824bf87015153c664aa51f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7702fe179e1cbcfb491f2de2af051682

SHA1
436ded8f3eb00b5edd02324b42bc98381a333b13

SHA256
9d1fb8b3183fff681de760bf809bfd15e7f4b7752c4fac0290fb0e9295c67d1d

SHA512
c04e9c8f71c6df62b5c05ef5521a59c3dc8c91c26f9361f97f2df4fbed359ae65e49add2a77c34c192d25a441ddbdef8b42ef48bdc4298a64faa489d8db9d7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7a9158f293b115076858b2e681c93bb

SHA1
1c8d946985bc690019a2770c9f6d406a674d50d3

SHA256
c6ebef862223c4bfb9343f705cf323c1ea2b7090f868d978acdaadbf2665b0d7

SHA512
0a48f74df0be8c77be97373af1bb9e6c97f11bf3ac378b09a12cdbdbe9d3f41d2cc0b300b4107e373a177b9da2cc9e6f1da0b05721478088a94f05e872e761b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed59ba00c97b0b854a252764ca3f0a40

SHA1
2954e20e78dadfa38418a6caa3ee49ea7756ba3b

SHA256
0575362029837e5f5d0333c44181aa15e14d75b4a54dc381506c6c660bc4e61b

SHA512
ac9bbbb5471c42c9d2d2afa9c62f43e100f2f4980b3bf297e5656df19f7fb2f1ecb15ec9deb61f1103099ef337d3513bf2822bc03fe65faf09a2a0ff301224e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc65834e29df6321f6ebebb5c29dc64a

SHA1
11f8f8f2825c7aed2fa7a9c63bc1fc510af5a323

SHA256
170c843708df5035e1116a22ce6dfa2da5f7f037ac06fce18a5de176d3dbfb3f

SHA512
585b783087fd3ec07a594fb7d7c8fd4d298c3c3a463d6f122c62a9a9994af6381c0a08978a22c2bccd4600ccc810ad06640fbdc8ed59e3622dda908b6590faa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7138d687f2439b17e1613b520b6182b

SHA1
4cb65139efa2566317c6f3a7db47534323812504

SHA256
10600e4128dbec76096fe8ae6be66a2aa7934381f4ee1bd36e946750f2166994

SHA512
d1a21ad165451594e82f55ccd7ce696ab298244fd3989907b6dbab7ba3b795c4bba935559b615dc4612f9fb50a4b106a52be04afe23ed7a735c947c8c51b7e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3056.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3132.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3147.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit