6f01f33072a0db472089c45e178c465c271443221eacf96d0d09f8f32dc89dcf

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5d80fcaef4518443192ec5c8f5f6e9_JaffaCakes118.html
Size

14KB
MD5

0d5d80fcaef4518443192ec5c8f5f6e9
SHA1

98559a5d4a9d37e9b3d4c30b0b20022a9e3182ee
SHA256

6f01f33072a0db472089c45e178c465c271443221eacf96d0d09f8f32dc89dcf
SHA512

9f30c48a8b36ac670926167555580985905bc0fe305f13d183918ebd0e666570c563af34ec3d07ee86d2e0dee2b4ec4d2eac65d13157e7c6ed0744efe73f0661
SSDEEP

192:obShu5jc7779Tx/SpqA7niP11MzXXOvSfU3V+CVkCalmP3KTAL3E2:om2c7dx/SEA7ncCXVwV+CVkBJ2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = e304000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{350B9F31-32CC-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28
PID 2436 wrote to memory of 2996	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d5d80fcaef4518443192ec5c8f5f6e9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55eab50e8f7e7d2e2359b19dd5f48e46

SHA1
2496bbb57e3fd3121f41790478f55cd9ba663070

SHA256
611098f98d259edeeb60636115ca160b9b6dad52a6866d7be6801008bd6f8664

SHA512
277f5b19de07416c4e9de06ff18e0432eefe1b49bfd24703bbbbfe78b909952688117b013fe570d3b47bdc8e155d12c024d83de6652e7e9b95c5a7e54a878f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2215f4d5900f500b57a9c069ecc1645d

SHA1
84f7841ff787108952faa383cfdfd2a5f625feb1

SHA256
d1db9df701a95113561e0071598fa31cd61d8486aa83106a21299dbd94135a13

SHA512
810a407e9e7e7514b8907d11b621d15f0f8c74192f84dde45143f09d45502cb289dc4af7c5a6cf5eec484274058847d650f4f38b3cef3ef32ab784429d9b8503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae33fd9f0382bbb09b2b35356c13e343

SHA1
9a94f276b854736cf9778a038033f21ae268c5f9

SHA256
1dbdd633d3d5382acf0cc91673cf37da78d9ef26ac382a731c24f4b552308382

SHA512
785fa3e46f0f3171fcbb5766a3e020c49a87f23c5233f82dc2d1b760efc70e393980cb62a83673fa9ded3832d041fe191dfc6255e7bec83ba61bf5d17aac94a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a753c3ef775cea1ccc2b18a3dbd40aac

SHA1
5e1031d2f3a2ca16c446779c75e35cedd19fd380

SHA256
ea9e2a521d0208e2aa91cef2ee1629d205aa8502c7f93f6ee2306cefb1996cb7

SHA512
e30d8a48d5f12a1b202af39d5d4401feaacb35797ff7bb015ccbe86bde183a993c7c434b24fa557baff8c2619df8df0500343352f57a9ab31110650dca441b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dadea354bbd1e9b925546e125e06211f

SHA1
d2ca334f39bf83212a037c03e4a2f42674816ad7

SHA256
3c032762e1ee8a21f51a3bdc010fffc7aee07098c025af98b69f1afce3798943

SHA512
d4c26815e9840c61acc73123cbfb9ca5a89695da541bd60eb8038cd8220577fe5657069f8aaf041cc75e0c6ba0d180f1137231fe28fb3a931c4893417ef33d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c63469945edd7f40ffd37788985caf8

SHA1
b499adf38ccfa5454412dec7de588b141f084287

SHA256
25cd0aa3fc2e30f02f171543b76123083e57054b5785d09b1129a41c8aa9dec6

SHA512
fedaf58788c555906e33946250fe9b4b0c7ae7ed4e4a08c47e6bf07819bc93948502cbfd46551b3b0494a7fadf2587a13acb01caa3468e9aa7ae39ab9f4894fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbf0476c077148b243429e5c67bac420

SHA1
318dbd9fb350468abecf59ca48f6a0c887d9f785

SHA256
05edbd5b4a0051693529795e8c6c41e221f0a50e9754bfee59dfcc1c1404c7ca

SHA512
2458a6ed5668cd00628c2c6e670e6570775241d65e656f2f67b2411630f0efff22bc39d311d552c9de17dbc479207924934b801a1eb211c651e718d7c4c12f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c15792394a584aa3688d8b47df3af8a

SHA1
4aded605813ff5096967b304336e3a3732618e9b

SHA256
eb827a11926eeaf0d03ba5601bb75cc967b51967ebf971842e7dfb4121be7a2a

SHA512
55225910912ab143121f541e4aa061a94c54f90d3f53b1018802836d35a3e7cb128f9fb7f31405f20f0b54f3a52882959a8be73f93162277c4ee8508fc7e401d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
ed842474c7819b9e4d00df009f92181b

SHA1
c36127656a68c8d9093f25b17ca53d647e70927b

SHA256
3726ff78912aeec74c60c4d810fd62e015f5741cafe66a6b9e24b7e76cbf4fc6

SHA512
9c54e09e4113e9cbc65c43503bd62e102c8e87a62c62e19fd45ef0563d33ff752f97352d0579291f3ff8e20d817b9b61849721f6b9b889cee3f83ddc908c9706

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FDE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6389.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit