eaeda3fc5b3bdedc2721a1a353709f028e57e6f6ca8a38d2ed996610012af277

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fe9267cb55a7725be1e663a4f9f49aa_JaffaCakes118.html
Size

27KB
MD5

9fe9267cb55a7725be1e663a4f9f49aa
SHA1

0d00b5c2be6888e9c1c8b08505457c58015f54f8
SHA256

eaeda3fc5b3bdedc2721a1a353709f028e57e6f6ca8a38d2ed996610012af277
SHA512

68002289da1830323a74799ffad3df406cb8d7e23a7a43dce39814ed3469665d9c3bad71c94e34bb1eaa5b59c9fa67ce1b04c07c45c8f2ee99243a7e0fa7117c
SSDEEP

192:uwrsb5nTt6nQjxn5Q/4nQiezNnrnQOkEntYSnQTbnNnQ9eTPm6u/NPQl7MBTqnYD:YQ/ruxGNOSZSoln

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424339529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E718F61-288E-11EF-8B35-D2952450F783} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2788	2260	iexplore.exe	28
PID 2260 wrote to memory of 2788	2260	iexplore.exe	28
PID 2260 wrote to memory of 2788	2260	iexplore.exe	28
PID 2260 wrote to memory of 2788	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9fe9267cb55a7725be1e663a4f9f49aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6b5d0bf6358f07385297361cfad7a71

SHA1
fb389a92f4968bb75104cb658728993a86df9213

SHA256
1caa6afde829dd6c551256508501d5c9cfa47610396308e4f888164d01d79543

SHA512
e9f855d694e84e479ffb4f3e93dc3bde982f38b42ce5f479d5661badf7922bd661213c921da4be5f95a4335986a8bd8f5430d8f961e9eb6951bf87b1f4923c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab8ed2630e187e8f34c164d224fffd9

SHA1
696fccd91fc9b582e9a9c3f00a065d7373d85080

SHA256
feeb60610dcb3c62fae492e2bdb8e35b58d64c654f4915250612f7b468732610

SHA512
b8aaf03e6249bd75b105d435e64abd7030a287a8c8d7aec9a1e25c80ec218245ec6f355ac87b1ffda18b1bce284ff2004d4e901322b7601b1fadfc60fc52fdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c80e45858431fd500ed1b2aead80d019

SHA1
4e0a9851f6659877bb7d0a5628c1de6c5f047e11

SHA256
e289552f3a4b3bc5303f7c998f447d8488c770aee048a28c3919860a89c0a901

SHA512
6fe57e7a7d7357afcd87a39ea3e21521452cee479d5702a00f4e74977dc638fd336d5c4df7be3cc19781a271eafdf441e3d9b649c30546d2788956059aa7d3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249bb7300eb414892354224ece3262c9

SHA1
d3fa001b9657437565e944efe49e67af36a5ac3f

SHA256
6db736d74923b2ee955008f6ee31d3b4de51c71c292da315c68e19bce11f6d30

SHA512
bafe5a6e23499737e703cb31b7cbd5f99171afa4707d79638813cb506048316d933d7c69c4b8e549891456204dcb9013124f7de19a3b9ddb7e2425e4b77a274d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bc836b73a6b8d98917131b4bfaf8f84

SHA1
0501661b7f26162fe61e4ac83edd2624c8f7036d

SHA256
2ba08940ce6d3f0de3f0700426d27cfb90f24d8faa4c377d86be9eafbae91706

SHA512
a8fa5d279ec1e01a53927f0cdd91fc8e0e2ad06cbd1fbeadeca4688957517c04771b7a654c3467b99c8a60c55e2f4312ce7e9cf8fe5aa54addb03763b39f5bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4573e9f2df747e5d6383e1aa23e6c9

SHA1
f705f574f323cfa9b1e828cd8ebe1f952078fa39

SHA256
4f7233445ae36b17ea04b610e59725189ad1d4401b02d278e94efdccb6743f38

SHA512
56503347bd5889f5cceb5dc9bd9540fecf8b316139a4f94ee8b7684fcee0b1eaec301cd66289dd3183afe8dc383612ab5e9763cb8e1848c740a293ebc72a705b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
994b58150dbd94d9c6f8ab0471eaaa14

SHA1
aba829f1ea2c38f427b7c94c32237b7f2d1d30de

SHA256
ae173e7d5d4dc93574e81ea4409d4eb6f6864504b3f1316466c8bbf9df3b0a0c

SHA512
bc016203709ec6bcc1f67e944cf511626a241f6b1e94f41ca3d6909be60eb895c65fe5bc56ccdb865cb5e802a7f37a3ac6ddfe1f7558ca97e615d80fb8181537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ec91bdd6fa04e6a631d861686974190

SHA1
9c0c8b8a917000fb40c61cc5d4c183c1d954d9d4

SHA256
7fcec524d071d57b141ba29d4d210acee5a77698708e027f103f57816febcdea

SHA512
52b3a160b36d25979890e5d7f68c8a94b2d3d4fec42884b2f34433b6516e66ad5f3ab9bcd98f06598385d9dedeb059f67d5d2fcff3509a08e3388d9bd26e08c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf934249a88b1b51799e006d7a709922

SHA1
d5197f019208501855bd11605c546065e19555fd

SHA256
5f42954f93bde07bf4c6b8713bbaa494bd0045906dc94d36b394bfef3fa6c95e

SHA512
82d0feac61bbb1c9a251504e941103bb5e7ea1fac8330b5bfe69d7c8c122d508de478600ed1c6e04858cc7e0e9341c56dd0426cfa0c14bc781cd1619afef02dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B56.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit