c4b905d101b43b90d25b0bc6bfd83d778efad25cb2223a7c02cee7882424d3dc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f27363247ead0e9674c8c93fec6a746_JaffaCakes118.html
Size

23KB
MD5

9f27363247ead0e9674c8c93fec6a746
SHA1

ee8bace0b859d347a4d7a6ffd9c187e2bf479ce9
SHA256

c4b905d101b43b90d25b0bc6bfd83d778efad25cb2223a7c02cee7882424d3dc
SHA512

7e0c660b1e3cef9af506a33c2660361ad93a0e932fa1ae0fc7c56abaab122fa36089f81a221fd86608d5c2916e0211be66ed7f92231790697c94bcf8c3d120ff
SSDEEP

192:uWX4b5n5+nQjxn5Q/onQieTNnwnQOkEntwunQTbnRnQxCnQtzwMBzqnYnQ7tn0Yj:MQ/IlCyC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBDE65A1-2820-11EF-805C-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424292601"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1908 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1908 iexplore.exe
1908 iexplore.exe
2236 IEXPLORE.EXE
2236 IEXPLORE.EXE
2236 IEXPLORE.EXE
2236 IEXPLORE.EXE

pid	process
1908	iexplore.exe

pid	process
1908	iexplore.exe
1908	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1908 wrote to memory of 2236	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2236	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2236	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2236	1908	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f27363247ead0e9674c8c93fec6a746_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
491f1a8f16267761744a54641d4d5b4e

SHA1
7e0330450dba6b22d9bc8251b6144d63515c17c2

SHA256
6f9a9a79a17a31c5b53f942affbc68ff8570c99cc4bc74535026cc0d99728624

SHA512
6a90593af88697fb3ff8c11afea462df8ed1dbf244c85f3047a66fe28322b070dea6f5571dfed17363ebba0e817984857ada47318b72412d54748af60def37b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8b719e65c9a5975831041456d9244bea

SHA1
8d1a93809317a89d4d15f30d0f366892a033e724

SHA256
5a105d657c9a0e77d020413838a41797bc1c9a5e12edc185ee0ec1a3c3e15432

SHA512
2d06b3ad6df1e15b4ddf21c9418861eefbf832930e0f870076b4a59b03e0d628a5f7629b3261f4c25021b570c722288109ad17ed18bc6bbc8d993c9de32ee96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7061b1b97444892162b696ab8ce1246d

SHA1
4e1500e0ab0df4f2a7de1a144733912e2582d166

SHA256
03850d14d0d5dcaf8cec298b4a9b5a820d7a65a41f53a2270c9543e3c5cf9a26

SHA512
831e9d41921753629441a5edc0d0cca1e5f09328fd1fe03b73ebe1e74ba072cad903ff80e04d15e8c3625da65bc841fb34bb7468f4f19b1ea3bac5cef75936bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
dba0895c9e7d7ac3a6970ad102436223

SHA1
8bb1486d523f5c6cdef4465a02d99d72fc61e057

SHA256
5d48b899d182f3510f1722dd806060799c8f4230d703629c02e8b6b365162e32

SHA512
74bf1a36252f9de5027d156d0a5bc9a66669606dc8d3a4d4ae48143893526cef6402c9058a48ce2a9408ae21c491c4b23411b41fb5217bfdf5220dc389bed160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8add1011115d3fe757589cc7e5c11d1a

SHA1
c18de34734c06b44d7ce5b9d1d4ce24675ebadd7

SHA256
72d7d6dbeb299e429e709a3b636ed8f2d59d8eca395b03c46b2a44bf23264e4a

SHA512
394b50e6023ba3fc2fb4b35bf4f8b9a18a3f3eb9a7e1b8d9e4c116bafdabe4bdb042535b83d01fd6edbc3902efc7e727e78aebe07bac30fb96ea687f10f56c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f75322b77d8f1f1411630b13549d90f9

SHA1
59dbca89be7a7742eec1b67563479951a9c36350

SHA256
e7d3222e2cfdeff24d041ff6568a681253571d9890b36a53018194b370851c50

SHA512
0cf3eb8cdc3461a6a8799e69586fbdb5f63044a317ad3f5f8ac23b7527af0dd47a15f16edd7f179dcf4d573c704097d0683268b40069b0901d5a2f3bb8457818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c16b3710cf418b28efbd842dd250847b

SHA1
d33836280f2b239e76020d06990fa94be8832269

SHA256
28466bd3cf6d6a4467434c680aa32d8482ef49b3b68beeb4b7f658cde70b7e6a

SHA512
74fda93f15eccae1c7bba0ebd2127095ee2737d3d84f105385ca5d1008ea6b2e39a7463dc7bf1ed25dc4678fcb2ded24fa8c852cb2da18cfe35c07f5e9afb387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e2097f3fdeae8cea1e7f389223266681

SHA1
e0d272e89a9889b0abdf791e21704f3f447ecb3f

SHA256
3d3b1868756b33122ca7b8a91170681a2d0656dce40f0704cc98b0a9a04c60b1

SHA512
5ce9109a05b4e34780fb0938fef8fe895a1eeb122d055bafaa06a2f0e711fac9f51a4175bec5189e12af54001e017201e882d46a8f28562acb6de32c3c98b9a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d9b1eb9df024f2dc3fef256033c0ca67

SHA1
50b63699e7a4523a3d11b7fa72fe124c8a894585

SHA256
41e3b9b9e7af3b8a2d30eb4394c3eff94bb0e4453f04c6014df78c1e8b800a3b

SHA512
e6d1544a6e18ddb37e3077f85f33443ca0fa60b0d6504766051a762b1d30f98d936434178e0396a241f1af27403433f37d83c70140bb88a69ede2eadfef60a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48C.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit