5fb4d80d8535ed7a8e5645c53bde2ae71799ea4b21b0ed52eb7fd3589d88358e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f064eba4f3bd9a61d67e98ee66f92bb_JaffaCakes118.html
Size

26KB
MD5

9f064eba4f3bd9a61d67e98ee66f92bb
SHA1

ee62de540714007d42193bcbc60f1a89eb0ed90d
SHA256

5fb4d80d8535ed7a8e5645c53bde2ae71799ea4b21b0ed52eb7fd3589d88358e
SHA512

c8c79cb20eb722368b84cd7f249bacff157702b8396483ede9ec2041793556e04313513927bd05a87841a956a11e880e48134dad335d0a29646156ba2492f0e2
SSDEEP

192:uqqfrgb5ne2nQjxn5Q/dnQiewNnwnQOkEntDznQTbnxnQCCJVevo7Nt7Fo+NzQ4y:nYQ//ygcAaa7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28EE3031-281A-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424289702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2524	2972	iexplore.exe	28
PID 2972 wrote to memory of 2524	2972	iexplore.exe	28
PID 2972 wrote to memory of 2524	2972	iexplore.exe	28
PID 2972 wrote to memory of 2524	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f064eba4f3bd9a61d67e98ee66f92bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd3db95b70cf2bfc85c990804f9b5304

SHA1
d29dcf37c74fcdd182ca4039f797809b8eec110f

SHA256
5cc6a83c4f53549636d8d131efecf3618767472cc003ea91b294d10f61d88e98

SHA512
10a5fc96f5199e2edd81be85b4b3127234adc9fe48e3d8f34458f64031a245b1760415415d639d7c0f787fdd57203b251dc5c8caac320dba9f0a015644bb328c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05bee4069e74be1fa5ba9c3a22fc55eb

SHA1
59bdb12e313cb29c0001bfb66282b447ea0e55fd

SHA256
7821ec3a0a5ba3a63d94ceab115429af52f27a364ef410bc6a4da6709eace4b3

SHA512
3d258bc19c77bcf163fcfc48861eda28db3d34fd010f2179d160c3bce142335181b31808806be8238d5de8fc98e4ac287f617ac2d1aa572af03fe9244d9a15a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac17b5c0642095175c774377a63ecb5b

SHA1
1d21ca353c5bc7c8797aae510b0465d07cb6cbb0

SHA256
2a39a8a5e14240f97cf55a89fea1c49208113cc7390051e559a0ef7a8df1ffd0

SHA512
dc0abefa80e8078dffbb7e256f3f749be9fa217bbc329410511eeda0452d5fb4ce3738aba61ecd6085099a283a965d5cd76f9906cf252ab093c28444034c9a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02850f57ca50ae7a696a05b26a708ea6

SHA1
15d073cf781e557d0b19173888343e5cad54cfb9

SHA256
f11e1f6874ca534ae1db22658c7989f71a0b358164a6a1c190bf6b22087899ba

SHA512
620201dfcd78aa5b5064edbe765b5d0234dc501834991a9ac2ac6e2121995c09e9fa5154ad8d6217a7d30fc440adbeb257c054170f8f385c8ca27bc124f650d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ee43bf372ade097fded10e2fbf1c87

SHA1
804e60d0f93d82c4c1a6acad3629959cb918637d

SHA256
dd58c0a9a5230879da61a662dc5038b8b711f6459f414491b6b441e0958b859c

SHA512
601727b117d27c888eac942fa72f789584ee6516169030fdfcebec0d5dba69993a96f3c65f40deeaea6d9a2125c84fe4d310b3c27bddd8ce0b4f5b432b3d6ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90bedcfb65960e9580ddfccd57ef8fa9

SHA1
b8a1eed33a6e16bc82b74b7fcda4a36b66ab93a2

SHA256
854415b32f1f140e97b16f7149f3b84e2170ef4dca73f382b945599aaab3b449

SHA512
a92dee48d8594bba4fe2a89c37d29d67058a0e5d62571f345d2868910e3e488c51507a0595461472e23185f754f0b6f48b46aaefb0e850f3f910247a614de10d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6446af124620903025af0093a057c279

SHA1
70023bb940e66a1838a5db1bdb78de223c608536

SHA256
cb25822253c218b3c5d0591d886eac102e483da384a43a6411b7fd600fa768e2

SHA512
b8be32c76cb58bdfd74ce3ce8376311716cbe0da7008a57917c04b7b355df0cf223c418a7a1f68b594ab48de85d6c01801868313d2a849426c1e64ba4c10e100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b40e2e604b0553457374fda0c356759

SHA1
d0e62422806084325ff047156924dc1b6a35e73f

SHA256
4c321395fa616fae169d117896cdf414b6f2818e76bfbf545f847af9e906fa57

SHA512
d55312f6ff892acf1419d7236df138af6afe5ad57fe002c97c2bf557beb3f405c2b76045b8605213137fd2a0ddb8393fb2dd4ec0e40476e9a0223e01e264a0e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA30.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit