a35d9ec0172a62410aee0033f1fc9e94da02aac9b149ed059279861ab84b616b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10f01fdefe6f7ee2af6c7867adfe8d75_JaffaCakes118.html
Size

88KB
MD5

10f01fdefe6f7ee2af6c7867adfe8d75
SHA1

b6e78177438c4c688661cb8e7fd17e39b50be93d
SHA256

a35d9ec0172a62410aee0033f1fc9e94da02aac9b149ed059279861ab84b616b
SHA512

01d34791acf75cbd832320bce153b8f9d3b7e8a16f0ba7fe750e52a9451b7535287f86663e3c83c8bf34fbc5858739f51458cfe34046def4103f291cd07e6f2e
SSDEEP

1536:iFOMbIuPSZd04OSpmLRC0XH8BRJbYtXeIGwesDmBSLvK6rwtEzaC2aq4zmmaAu6u:YIuPSZdBzpm9NH8jGdKsD5vK6rwtsaC2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420915481"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F37F8761-0969-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2884	2080	iexplore.exe	28
PID 2080 wrote to memory of 2884	2080	iexplore.exe	28
PID 2080 wrote to memory of 2884	2080	iexplore.exe	28
PID 2080 wrote to memory of 2884	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10f01fdefe6f7ee2af6c7867adfe8d75_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba7165a86a0fc0a427d3fd299da86991

SHA1
30f80a2af0b644fc066bbd00809026bec98606b3

SHA256
b4467002d6ee75c3a81d27a6c4742b42cbc13061f5c649c60b489e3e7648b88f

SHA512
066f7d7bd5472d0adb5d1097c7705a0a89c2175f86bad6a908a93d2346bc3fc3c0e38a7e1433ed5096b0a86a2074a226012e6101cdd40d824f90bda9425e45d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86613a7e4f3b788134207bd58029f0d

SHA1
76cc639f97db754381e088875313cdc6ab1ddc24

SHA256
6ee3935957aa6cd1cad38122de7466b04ec68e54ec928ed7aab3a073d608144e

SHA512
f20b4f33ef022e1ffd4788671f14e4a8eebb8b0f6ddb27b5789a651d4cd7d643d271a5076316210af691f5053090ff4b181aa71bdee77dddd72b261b39426273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5721463c6aa446a5bac36534923f239

SHA1
c34e26ce3777b1c1a3a64cf91382f85a5c5956ae

SHA256
01c1e3c5110edd588271e361bb3431aaf2a2347663b01e5d2c95301bb1f3c711

SHA512
8823ea5647498937a08d79fa65b8dd3fa8a838033aea800673c0bff680378d3a72872c5850c3a083a1202e3c3b5df7ec798b41a39848926cf6580da1a2263807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
630faec57fdf74f4456f550076edaa1c

SHA1
b9f2ff80e69e088a2636569cfbfc3853ac8d2a6b

SHA256
ad994e4aa29044c8adfda16749ce8e61a58e921b9ec84dd034a72a5d4358aec3

SHA512
d14c184d1c3c88431e85e0cb3352cb13c64cd62a7547c3dc962d9c1b960bb08b08a34dec75ea560a7eb309bc2a3d1d2cecacb1d9c23af1e65d8317141e3bcb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90058584d68049d55624576d95ee6d44

SHA1
ff6301cf6d04f99b84d72cfe673bde504f2976db

SHA256
78efe340b9efad94153e6ec5988d93b0f658f74916b00f0e08938326c697c2f4

SHA512
329d99b0d5ae80725ff594712d6645bc4d16ab3b33f0563a7308021c20608f604950e3838b5bd7b1cc0aa406fd7be152e00d235e82f9a6f75617bc2272fb0a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b398a01bd5f0834f02e40c39f49c38f1

SHA1
ce9c851440ee28b58126f5d6fe3dacda34592fa1

SHA256
7f49288c2bb209a242a917bf29d524aa066e6c10a6e68f0908222d0a1ace8c53

SHA512
d13fff2ee43368c439bbb61b83a71f96438e5185b140d6942852bfea7afed75b7d1a0699372868b3fec8d286d4689d9020604f1c31c2d1a47cb3ee0392d61ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ddfacd05c53496db114f71a96d3f7ec

SHA1
ce24a64b2f9888f2d2946599cd76a6c7c72573fa

SHA256
de605ab7f158c138dc9c381080881b93a7c4de7cf4b88505f7a8af570c18648d

SHA512
0e7b5cacacaab7b1458647ec8be3de23f440cc4f0f22cec27145fb1bc470e890bba2983a0b8cb00ba2db3286c6a65cd8bbf4ca65f2663c59bb732db723b897bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aa2e0af40dab8ee63ab78d37e2bc091

SHA1
ef012e1726ceb147a989219069e120a4b15db361

SHA256
84e74b376b05862b3795d3e2e6e7ce08e190095e4fffb6e2c6738241bb2ea856

SHA512
43977d65086c9ffb5a551bf40fbcf9cf015c73df23f403094bf513048238b46572b755f1290dd06061f9d5f062b8c1be56b2dcd8a159ba966affa20b03ab5fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1224fd2eaa07646247591eecb27ad998

SHA1
d6b49cce90cd3be04536a886a4cbf9af0063b0b9

SHA256
a9fe33a9680f83ecf4978e67c7b9b4cb62d18d31a9957d1ab88c7b8d52723933

SHA512
98c813856d7844c69e0c6579fed0951b67c7c92d4ed98cbab08f90145e3d7e22c221b02c260c296c2662d62cd8ad51f93416a6d9241c10c3cb7e05a832db5e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2464.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2512.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2526.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit