7f6bd68b9e9dbdfcadcbf9cfda172428ded24486f6f344150702c598d49940e2

Analysis

max time kernel
130s
max time network
145s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9fe0245d9c962bc0504670bf43bb65f_JaffaCakes118.html
Size

23KB
MD5

a9fe0245d9c962bc0504670bf43bb65f
SHA1

cb7a8cfe4913b1f0c1fb1f1aed625daf7874a569
SHA256

7f6bd68b9e9dbdfcadcbf9cfda172428ded24486f6f344150702c598d49940e2
SHA512

d6e3e22a0045ca9676a3f21d91a2fe2193c4e70144f9c31c530376e5379b58e9581f7048ac438075eebd74e4d5c6e3b1502ac25642a2ca289b037109c1c30949
SSDEEP

192:uwN3HsyzsrIMmb5nEgPrj/MLdo+nQE6nQjxn5Q/2anQiey1NnWD2nQOkEntY8H9V:oQ/ALMF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424534610"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63CE1B71-2A54-11EF-B918-627D7EE66EFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2360	2440	iexplore.exe	28
PID 2440 wrote to memory of 2360	2440	iexplore.exe	28
PID 2440 wrote to memory of 2360	2440	iexplore.exe	28
PID 2440 wrote to memory of 2360	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9fe0245d9c962bc0504670bf43bb65f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c1bfcae8488f9082cfc6d3d9b40cbe3

SHA1
aa5107547ce94677d2ee2a544e14740c33633e97

SHA256
e29b189c19487c9b51f9d5e136d2b6c0e2118caa4308f8a255c9760a3c4b371f

SHA512
e0b1815148d30500ddd816b46aad9cc7efd33200d6396767121669f0c59d77343d01becba7b7f45529a8e7e24ff3886f0ce26bdfe35ffedcc7dd79a7f1d3d8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3504453cc933c48475ebdb53c8b90b2

SHA1
a8f6ef9da7c3eb9da88f9c33e7df8856a16e1585

SHA256
93e88f1a4bf1865e3adbf48d589783afdcc7b0ee4fab77d12ff51dcb03226374

SHA512
a9327b8d26f923de1f4086d3c12c443307aea6965c9728c8b39dba9cb3e79cd589a51a7214836163e3009c5cf6f1140a45f0548e3153f1977dd36c8b0d591f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cee47baaee2f683526424c36051ee10

SHA1
049c3a4fee92446d87b674f38e345713b837a417

SHA256
6e7017373c86f34d10b8fbf787834cbb614704f3ea8b2e87b605317feafa6e69

SHA512
5ce1e2e603cb8720167ab8323db4efbf1606cb75b040da6da5582323a12e009780a4e5e6b5b4bbe8466da871429c0022acee5866aac45bac3b6e4c8ce4af0173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69728ef74ee1947c0895d244a896e270

SHA1
e13a92eade30065b47b5b06afe3aa1b2718bc35d

SHA256
be1e38a14762a26442df8ba989e4eec389c46a427837b93e0ea5e05bab6768dc

SHA512
d4de831704956d838b6e4578e128fae25df81fbc2567a5c97df8f01635ebb4825169a0ba9f8827c3d28f1cdb5394d624d37b46597d6d84d917441e1ce4ee621a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be407da9fca99438a0b15b382d6e10dc

SHA1
2af22a389c67786c2398a66954cdb7615b1403d4

SHA256
bdafec211751a1170950060e7f7efd7da405bfe88558cab9a0d0870fd25837ac

SHA512
b462a6c974268e51d8b97596de244c61e8418385d5552c87a04276871921af343e131dc7532da7c21d98d6af9a41a5cbb66731e5715021e9264523f1de4d62f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59dd2bb0c78247c0768b5aa164e8aa03

SHA1
49138bd76a43e53e4fd2f0f934bc71198bf97e57

SHA256
d09039e4ae219c999f47e1fc96c46ae4ed62e092533ea942f9970c66d2134703

SHA512
faa500e35f0eb5a528e58ea84f7acad9c54200c8666e38f07ffa5b2d85bccb9bc4b150ff2d55d93ba2a9c23ecf2b218b85ac07977b7cd5bb9c56852ee46d51fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4702af11056b6df378fd68bdcdae2fb

SHA1
60272563280b47d5fc34c81da42fccb209930077

SHA256
bf4cba4e071530cffb2581d0f5b11766e3719fe08937562a0e0227fdeeb11129

SHA512
caf4c4e674b85dd4e94039696d93f93dcc59079b10f57ae6f0b751ff3ee560c44858773f1a54ad07940e3712c880c4dd85617ba23a3cbc425f898e8ed960c30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4bf84da0aa0ae45bb27324eb31cf949

SHA1
88c57739e00e4a9425b9b5eddeb5907bf4ed5b0c

SHA256
fd1d4270c11146c64b0b65c63723242707478dcd8c797d58c409b06444e5feb6

SHA512
0ed29a6afe987ee90c38d36909e6a5619f0d378eba581cc2429c17a747dc06abbd91cee558583c229f28d4315964a003bd6b0c500745449c5eb70f8c4ac83939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
116dba8ef1b078929302e59f98cb162f

SHA1
c3b362c808625fbcb5c426aef9391694c3a1f27e

SHA256
436412c18e4af4bb2a88314fd91d12a4d72c4f84de71cb9481cd6ac4bdacae15

SHA512
74d3423b6355f5ae4aac6eea5b68af3bce4bc19b572aadd45f5ed42b843cfff12c0b542e67a106b7e14c4338a476642620063e913b9fb71b7665cc64c46fa417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c559cad8f38cd5bd808a8064c81d540

SHA1
a7383ea4aabe6a51a65c9c2d1f3f04eb719bf487

SHA256
516e0c0514e64e143f32e7727664c8a8946002c7281ef267f86a18d11893de46

SHA512
5f7cf204c7619655c7d348158bee4d4886c83308dcb33dafdc758c4f67e158500f7a98de3339216d1d3abcd086e5bc9f70fe4fff9f3a5a2a7d5e0118c5b8ec6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e0305be7a2c92c690485ac5e892e6df

SHA1
cf5206c5fdc1170ba1eac785f83c2fc817f1c343

SHA256
96722885c2e12f8b8cd48de391bddba5daa12c40922afbdc6a5c935ab16077ca

SHA512
54b58a07183a3792925f56027b768936d200c4162507615e885b0585a38f3e72d3e8a1f889c4fb33784435867340edb596a12769213865d43e0005861cc67085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b04daa2fd31dca300c814f348276da72

SHA1
e007fd8805698d111227e7e366e4a5c45b44ae5b

SHA256
b8d542fc1a56797413a062f496133854eb30173202e00bda1d0adc0cd90f1e79

SHA512
dbbb55a882fffde2239f114d4b42ecb1aa0978fa53a8eccbbe3e3171b320019e699f2c0710be336f369bab3977043787471d631051defbffbfda5a2e5290ee6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab53FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit