e310172922bbbcaaff766054dfd29126c8d55a1c78f263ff0427b70759c037a0

Analysis

max time kernel
117s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eda28ac95da6b620d125824963c82e29_JaffaCakes118.html
Size

11KB
MD5

eda28ac95da6b620d125824963c82e29
SHA1

5c268b101b1a0015a0a94e2fe64ff773dd4b2a47
SHA256

e310172922bbbcaaff766054dfd29126c8d55a1c78f263ff0427b70759c037a0
SHA512

11aa8378bb14de872f6e2421174d70a35c468080bcd8b23048eb884cac0ff886d3a24e78ccca7dec5f9724f069d0a2fe9b1a601fab88ac662e8d8f24d6a65463
SSDEEP

192:2ValIsr0r57MLxwT8F/w1wvqa1JauBuLbdU8d:salIcIQLxH/ggJaguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419007558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8D2CA21-F80F-11EE-8DE7-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2256	1628	iexplore.exe	28
PID 1628 wrote to memory of 2256	1628	iexplore.exe	28
PID 1628 wrote to memory of 2256	1628	iexplore.exe	28
PID 1628 wrote to memory of 2256	1628	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eda28ac95da6b620d125824963c82e29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55ee2ea237aef4656ba83c2aa71b8b0

SHA1
128100a03a5ac392a7f313d816a219807804707e

SHA256
446a8b4f89081ac5aa34714150bd119fe0311626db7c2edd2e0936a510070253

SHA512
962cb14b76e79ba459364b956af5c7d3938235d92d75a347971ffd85de93c392233afcc8a1919881bec403e46ade783517c6e73daa4301c5f72d06f41629ebea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292283351d42dcb79a5b35fa86d2140b

SHA1
9338815f92de1675c75c0322f8ecd14187ada4b2

SHA256
8249bbec7fd2dcdfd5f8703d20aa63bc605ba7f158c8d30c640a62605c6646bc

SHA512
6a46aa0b8cf0b06ed5f9fb19c03bd1284b212c5df9b4ab302ec8312cc012bff68ce2234f7767673c4ac8583f055d8580f3646c0b98644e6bbdecb8e03631b410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acee972736bdce5f5ba79ef5d46c52a

SHA1
e5a4f2231b107a384bae9155337b85e4cea42999

SHA256
ae78c228a1db9bdcebd16ed4e2137f562cb66613031ba0e79667961c2b990a60

SHA512
8fd6e947d72bfa96a127ba5f935d189aef5f9aa053ce11bf1c32e5f44a0608c3adadf017ef723f08f8f09da56a89b087b0c35da2ed20296a682981de15ad3d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2db0a5cff6cd8c9db6eaf96c5baee4

SHA1
fbcbba27c6c62acc3bee468a8a478a370f30d881

SHA256
69673ebfe1f4c7a812c35eaaef29a531a1f57fcdd3a13c7b8e8efe12bad2bd41

SHA512
5eb3b63e89a25b13d40fc10137d02e63ce1d90d6ef73eaa4af004293f58fc35c08434df2ad79bb3ca2ca41062048e7b9369473671ddc66342beafd95639bfa8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd421e89c680f098d4246b29f60c28fd

SHA1
5fbad9b0dcb649b69e9d69406a719ac4ea4dba90

SHA256
f03a8e83fdcf2a8c599cf91921631804ba92f6c220a5732ef3e4b2d4cd070b1a

SHA512
4dad4b0b024070e0d60d0ce67b4edf148b3d309628e2f6a747696eff94391dffab316a3235e53dfadd2915247da90ce645eea233153ff99aa0709ccd103fe394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1406344752cdc60864b720183be892c

SHA1
fee92b47dd8f0b2bb7680d737ec623107aa8af79

SHA256
676264980392dbf762de0274336f2361b6b6bbd45504cab4ab527ddedb55b172

SHA512
4be144dbe2c843d04ea8f547edc60f335a626498fda2e49d0ea106b37ff27626c27da17bb7c7849384b3c8c64d3d969a143110b20bba760cfe78ac4f8abb0582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2116bf16932cb45ca1281ce8cb56ae16

SHA1
3707480d418ac80ec8638a956bfedb71706e0dd1

SHA256
81d78c9060b73dc4f1749e6af79d8966aeb05706d7730fef8a131b91a4089d34

SHA512
0e55682a28bc626ebc20516ba247cb1a6d0cf75489227fee88a643a65d426092550808e1ef8587a07a8e296bb4a3f800cc6a9e5720f400158dd642855b7b3a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9cf8d82dcf8cff0f248f5d56cc09582

SHA1
1a1d031414a31ad050736ff154b22bf23026fee3

SHA256
6c6f2b9fc656dac599cccf956d9c4e1fc221cc37d1fe3d4e4b5b9f9129198afc

SHA512
f05b936ef3a3534438b361c647b506c3d5fae894594a58f775e3af4a97a7b07fe351cde7c9745350717e373f600c70688d72af391da07b4cb40f02dae9cc7db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2925f8dcd8ddc006713d10bda5e7ac36

SHA1
72344ed6ff495171812d577af436c4ee3ebd02a2

SHA256
ec6a6a569144f5bdd5669dd6eb14c0e1152abc7f17d0630a58c89f2ee59c8346

SHA512
a503e7ff01e31d58a01046f130c0357ad3c7ae60a5e15e3713bc918e807d42c109c59822a6689b60ac480225c12636d7dd1312c8eda0c68cc12873d33ec2dae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3304fcc7ce313fad090275aa9a612834

SHA1
f2270d0661418e2bbcda2bee128b196c818a9ba8

SHA256
c480b0694dd01e63edbc011b139591826b7010181c120e0a5e0757a594b99adc

SHA512
d2caf2b0801f442057ef306ac6b9afe3d7d65e6f556cf049cbb46c67e89f4745d2fb96c139f87a60e84553a44e890aa4d22f33ea07973a78693a345f3cbb74c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1833.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1915.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit