459600b27ce283663b63b54bb5d3895c836eee6bf311171080b0f5d5fbaf2a49

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f2454bf985f5446b075e415b50cff4b_JaffaCakes118.html
Size

27KB
MD5

9f2454bf985f5446b075e415b50cff4b
SHA1

4db3a0c0a07c4fdc950f69924cf63cf59cd8436b
SHA256

459600b27ce283663b63b54bb5d3895c836eee6bf311171080b0f5d5fbaf2a49
SHA512

046bf35e6821768e7c100f73b9f8ffddfb775376dcea14f905f7b08f8a762b8bdfb62263011d5f5d86c07ea1743273233ebd3ae9cd37b776c6f3af2f3e17a644
SSDEEP

192:uwjsb5nX6nQjxn5Q/4NnQieNNnJnQOkEntGYnQTbndnQ9etdm60jfZQl7MBtqnYB:eQ/4U8HIfwSrEdTM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E9CE5E1-2820-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424292365"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1208 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1208 iexplore.exe
1208 iexplore.exe
2620 IEXPLORE.EXE
2620 IEXPLORE.EXE
2620 IEXPLORE.EXE
2620 IEXPLORE.EXE

pid	process
1208	iexplore.exe

pid	process
1208	iexplore.exe
1208	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1208 wrote to memory of 2620	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 2620	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 2620	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 2620	1208	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f2454bf985f5446b075e415b50cff4b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
510f9d7e1593b554b38af1a9cf592449

SHA1
3537e8450fdadc322a87afc9bdf4f2f03e615055

SHA256
6c6a3fa908bd99b7d8bfb7315decc220dedebfdb79d58816228e1f51c6bea275

SHA512
61012a1afadac266b2380a5ddeb3955eead6efb333be053849d3affba60382d38413eb21c771fe96342265001a1416350690816f4b00d8f44a876a1da9356ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adfb929f0e08fc0171797d6b64a1a54e

SHA1
c69e4a82ade1a522e60a51ebee2e5e4961efbd28

SHA256
6ffe518815de953a0ba95efeb4e92ab08f6f90ad56ea45b931134d1d1b4d244d

SHA512
9cabe7ad65beb0cfb2ac79a62f109efa92860a3e6bfd3f16c19ba8719f3b05a06f5af92650a0b8cf9984b9095cd965ddef130e9b788318ca8ac2e358834093e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b51a04e18b11b4d17c6350ca0a53367f

SHA1
982f77f346a2a020598b245f7a26715cc1ff3fba

SHA256
e5a5caec7d44cdbda26f0c86364e765f190efbe669206b9f320a31d803fcf3e9

SHA512
12be219a52f20a0581c0a84cff26caf765282a87fe98adcca4393a72a759cb0ce31473092052b8258132f684f5fe53f64f7338cae0799bf878946f34bc8e3a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb8612ed8a3645a4802be483695a0225

SHA1
e55ec3db256d6c0c974ad7b0df5edaadcb4d28ca

SHA256
3ad9c18c7f8176ae7dd9af5b4816ffe1d470f7b1a74fe831822dd28a877470ce

SHA512
c2d95f1591ae59d03bf9f24bd5430744e8ff718b98cc6c3861bc7ccf5e7d131b1bb41a1efbbe110364020797f8031ba44b777c0b008deb3090da5538aac0d537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c94bb0cc0f5668c5fa5fb9a6f339a0

SHA1
4ba3414fe7836b9ccf5d9fa77cd934aaee83b178

SHA256
ebd96093b2686edf63756b682a6e31bf988af0c1105b53a21783cb8de5faab60

SHA512
8efc8ff4437e61316758d1792e8ce099db04d019e50e877f984df5bfa31ccb8ab1f1a927e44da40eef27c491dbdbef5cbf5078e7aa0c439f1c4382a51ab6a8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3be28a935cb3d2af265db9402b6ae0e

SHA1
498e3304d9d178c78ded3d591b097780afd95afd

SHA256
b1be3eabc6c180f29aa5a291bf33e1f4b50e264e543579f4ed000a322671b1a5

SHA512
ccc64deb4658f5db0b698730fb642200f8d448032297d5600960aeb3969e637b6589063aacf2eeb488d54527ab6f8154b7ba12effdd0ec51eaa749f66281725c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d27e62ef189af739d629fe6dd11b9646

SHA1
330d68e2eab62bf19719d2249584d70c8c1928c4

SHA256
5f37fc8d4358f8aa98a67e5cb544e0cec7a5c2970ff45dfe456767acd31b4c19

SHA512
ccc182b9917173b3815e31c2df927264c84f314de1186cacef1211a7fb37b05aff82cdd19f536489d7c58664fef5d2d559a9e0e1e9f7d3b7211851a266fbf286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeb6b38fdf2ed2bdea762f77c50cecc4

SHA1
11dd19a002bab0a1c60df785693069f7732942b4

SHA256
c404b482be1b86213dd25895a5d813940266412bf925b95ea2fd8109873b3502

SHA512
808a82ad2706075bdb65f97fdb6b0c12e6aed353bbe5286ecc1665dd0fe3455fe3eb445fc19a212a6dea46b03a66a78125394c8ace74a1905afa3701c0e393d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d703bd22442c9f419e60420abbe11c2d

SHA1
519d07ddcc6a1d00c0c412b39afe1a470764f2b0

SHA256
855f0a1df214cbee2c6fa5988dab9d9e90ce8b12312977b95ff01296e7620fa2

SHA512
dc9363c4f2511e74681662326e182ce026e3fb735fbad117fd39375610c7e376668936e668d29dbccedb63ddfc87f8f83adf4e32f278082482acd0e2d69b4c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D72.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E73.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit