4f538b4ee90ab72a5ddc33830c10877254559049852aaac0eb9b32f65c7d94ad

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f863f74a1a9dcc3d99bbc41fed88a3c_JaffaCakes118.html
Size

26KB
MD5

9f863f74a1a9dcc3d99bbc41fed88a3c
SHA1

9db4824123842e94c6191632ecea6dda7e17d19c
SHA256

4f538b4ee90ab72a5ddc33830c10877254559049852aaac0eb9b32f65c7d94ad
SHA512

a1580ae5e9a09110ed09d2f2d4409a1fe4b6fa146a5806ca09879c82d7d97586a2d1000a10b576ead9995ef56914e472e444ffea485809c3e9b7ac1d50746f63
SSDEEP

192:uqPffnb5nNenQjxn5Q/snQiePNn6nQOkEntECnQTbnRnQbCJVevo7NteFo+NzQ4+:nrQ/iygcZJ5T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424302051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBEA2B41-2836-11EF-BDEB-D6E40795ECBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2912	2168	iexplore.exe	28
PID 2168 wrote to memory of 2912	2168	iexplore.exe	28
PID 2168 wrote to memory of 2912	2168	iexplore.exe	28
PID 2168 wrote to memory of 2912	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f863f74a1a9dcc3d99bbc41fed88a3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
efb4a1a05ed127c75fb05345b2ebabe3

SHA1
c5eb0165be9c185af10fa525c398dd92625833f5

SHA256
c04947d65805c8f2de92834fbc77d6cfb47c5a248d341f5a73ed750bda0f2e2e

SHA512
cb742426d7d6ee80f289daee01a0c1dda81134dd47601b3466896193de0a91f59a2999d8ce794982448ae3382041cded61f3002a97e8839d6f3369f979412694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7dcf479cef545de86a30867b287ef8c

SHA1
e8f0b634ec5827aac7807c8bdbe79b70ca73d846

SHA256
e5d5c027cc3750dfcd7a7b969458afb6ec7194f917a3cf37395705114311a34c

SHA512
32ce2372fd4fc778815905236adf58143e92ef3010c44f7cd212485d4487d7eb6d2b36e848dc3fb5108876e95dbf4cfe476322d128d8e09683dacb07fa974ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ae63b035ee5bb06d00cfa77e790edac

SHA1
78022bc07deffa7fd4674f657b8502445a9d8bef

SHA256
36b267e2643447e73ea451c691d8a03b0b365b3821e1940507f37f46625db185

SHA512
56371372d47532b34247d6d568814c40d12c8ca274a26e1e98c80e766d2f77c56a661caa9984f8442cba6187e71a778bacf69fa05663e282c45f62342fb0056f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ee0ae6d0ccb6688330fa4b0cc920b6

SHA1
c6e7d59bd690a1c1ab7ff679780dfd07fc952d1e

SHA256
aa327cd3247ecbe6318ccc173b53087b95bebcf5870b90eaaca17755a19eb36f

SHA512
9846df779ecef0b8c356fbdd44e891cb3586482e02411482c8b1cb4d3fe7b6ebcd3d4a71077899cab21f02830b1ada12494ed1b12cc39bff91fa39e2eef042e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff360abb0e90e3cb68b9174c0d24100

SHA1
adefb8fc0ab2193f1b28e7aeb9599aa3df4da376

SHA256
890a8ae7f6a5ecbee73b8a36356e8d712045cf3aedf36b3adeae63cdd7684cac

SHA512
2b21ef4434c4f63a6e87753699ecd2014bca76a0b7e062a19edeb56d3f48dd55771f1b4061972ceae00fd8d2352d589082b074052d11f3cd2360efedb63f2976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eb975989cc29ca3b11139c95c599623

SHA1
07b748a16702bf6ac09d1ff0b2210ec37ef128b5

SHA256
82c715edbb75accf2819f20de7e494d0f8dde67a15a0fc99be7ca4350c004ee1

SHA512
333c4e91bb365653dd4a1cf8ab89d528c6c0627576794a0879f3afee3ef859153efa9a847a3575833a53cf7c4c1e03798d2d0bec0df6e6748825695e76238130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e6676348423704cd127a99ce34db406

SHA1
69504c782b8877d1730de1e8955ba2505640162b

SHA256
b26e42c9ce187bf4ce67bf8680807a4694680fd60928962774dedccf2a1631f8

SHA512
935de62340eeb50c5d12969b66625e0c8beb9f1af84b8f600b2551e4f76d1117638afa69760bc81c492276e723f88b3c741cb64c87cf962b36fd08ca7b9a010d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d6a795d17b9480bebe32d76826609883

SHA1
18824725efacddce555256c2806bdbb687ec5f7d

SHA256
4b10906ac79e77d1649da6557466436a5986f19ed9256ea60efc99251114323b

SHA512
b3f382db693a6d834c9f6edfe0e370e565196a0abcfeecf786e2036e86cef01f446c339143188a75a3ac4025b1c27964607a036ca15a4288274c70ee94f61bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
04037c7dda1d23b811348ed71307df61

SHA1
5e3a57313f6a530c11b6d9a67ae1da4b2e1a92f2

SHA256
796c6906de238b11465413a2fe944f6dcf5358481bd7c00e0a4a0e4e120e02f9

SHA512
ffeb06a1c85690bdcad9b728573dcdb915b298298db2e5b37e0444ad76a51becb2c3eb1a0d859cd1b9137cf7d5822908f330f8c35f1295ea8eaa9a645a136dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC07.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit