e0318df609c9ff82371d1cb70692657ddb09e8d97d54faad50fd6fe3719213fe

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9f58b940e2e41dc009b7a20da2b35e9c_JaffaCakes118.html
Size

23KB
MD5

9f58b940e2e41dc009b7a20da2b35e9c
SHA1

7dd4cd740a3d85ea2360a2eebbf68aabbcb75e59
SHA256

e0318df609c9ff82371d1cb70692657ddb09e8d97d54faad50fd6fe3719213fe
SHA512

6cfd1269cff03053fe2993a3c974eb4b7e3661f4dab9f964b842cd5e98dc63acfb4dffe3ae5f11d321db38081bf121f8fc9fac7b658b6164fbbf0f58e5a59cc1
SSDEEP

192:uWTIb5n/Ol+tnQjxn5Q/xnQieENnZnQOkEntLvnQTbnpnQKCnQt+wMBkqnYnQ7tr:cE+GQ/BOjc3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AFAA8E1-282C-11EF-9C17-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424297485"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2620	2096	iexplore.exe	28
PID 2096 wrote to memory of 2620	2096	iexplore.exe	28
PID 2096 wrote to memory of 2620	2096	iexplore.exe	28
PID 2096 wrote to memory of 2620	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f58b940e2e41dc009b7a20da2b35e9c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d0d56f79cdd9af16ca869738d7394c7

SHA1
17263303e175103cce84daccfb184c8bcd790fdf

SHA256
092eab575c7f2446b32c6db0e35cdf63d8830cca0f0c5f904f61c14bc4779589

SHA512
984a2da00eda1ba93d73b171cd6b03e4ce172ad7fd2210ec8765aaf0a7c20a898dbb8397428bcab68146eb4a7615c1e967322cb951ac4a4c8557359b240a533f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43a3ada5135b1c49b59d1d933127e4af

SHA1
9eaf8cd45627264a284aaf02562d49ebe8b2e914

SHA256
1cdd6924c55677e032a8931352c961b451f01cb44fe8734855d37f40e25280f3

SHA512
58781ec0344280ecb73195a52b7a6ea6d579991e89384e0f94f84ed08f682d60f6a5b7f73d1ab5ed53ebed02079c1a4badb55c9a742ed5fc5494dee69ca0326c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a16421a79f5972fc9a8fa309fc8615a

SHA1
e66af97cbc3e6f48d282377429ba1f3c73f1fbe8

SHA256
94d850dcf11605fbc69b0cfc3c432d142c2bd43b3e0d6d644f3169e2cf46ddcd

SHA512
432e93c549b5492c2c543305ee86810d7a123ceeb472a9acfcbe89924ca18f290f7074d1dee727616f9272b3137f815dd236164783b4bf53fc4104f84bebc175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79b95dfbebc57981a0693bfdb85f1a15

SHA1
15534efc8da10347c74171585df66ea1e4e3a7d3

SHA256
58a9884818bf6a604a55deb10d8c7cd0d0d9637c1889e2f1166c7907ac000ab8

SHA512
b6719df74d4093cabec711d209f5a30cd9425905fe5e329f5f72c341a5dfa0a66f165f71eb42573ff544f082489d0369ec7b6f6db42f1df878227c13756a18da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e07b82ccb0fd0a4a1977b43f513e1eae

SHA1
47980bd90089e73884386fe6d1aa309452cf8133

SHA256
236afd611b7f8075d45b2515a28281b6de029f14df8bc656403fc8f6fc1cccc3

SHA512
d798ea2e45f43b7985e07584def6ce1a242fee4733aef207af728fed081473fa7a09e0aad40c564190647d658c5da1799894de035e2a353625ae306b8dba7667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
853943b9b192a3609c6ae06c0a9ae1ba

SHA1
0fa06099ef66571aa1738259c074a18116dc9490

SHA256
ec3aafef609d74bd28985cb78e6f7018263f0046d93197603dfaacdc71276224

SHA512
14ee3de1bf92df0f4dfd436c4eefbf4a46af84aac98ccfb59d20d581e633135fcecaeffdbbc908cee542f5992cbe27ad892191a56fe4a57ca750d724b824bb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9fe2ba8290c390117e801c0c054e54

SHA1
8529ecb7a516877232ffb3e6b5edac6ba36b1f9a

SHA256
34a27ad401026c4c133b6d71463d2004225b1a1c873397da19988f191b5b8c7c

SHA512
2e4d1b072ede657a4fc15cc0716dea5efc7bf9aebcea9f4cfd7832ceef4596f444bc61c8a14a80f035117e1bec213aaa4150da156ef7dc8d1b814ff8a4b181c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76865730313c1c2d2e2b1ee5b80214af

SHA1
3ad62b73c77e0017a65b11cb94ab46540a1de5b4

SHA256
025af19cad0d96193372722d0159286a46acf08604a6a8021d5ea51558a4f566

SHA512
219270a30a4dd8fe9e2bd0fecdb9f63f94b96b5d7bbf24e5c210daeef47f8e158788a4a4b5ad29ef653c5ca8b6c0464871a92dc9acc31f623f69051929ad92af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f974a4e23aab71163748aa633296a970

SHA1
e2b44d96257e19bcea2766f848c97d2dffe13251

SHA256
9a6725a1a6c2750286960d3a17f6cf338a79162ef017a5a7512b301550bf40f8

SHA512
ce6b557e6b9f4a6fc48d903feb22f151b30ca0849038bfc80a1dd7eb8ffc298c9a9ae72ccd4cae157c0090fd381bad034b0cbce97f1640ef7f277d616f8f7e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1586.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit