9c382e0e2936deb1a382da220e6b06d2e40dd27e440df9ffbd0a7ba1ad62a575

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17dcd1ae3d198a873701c977287d26a0_JaffaCakes118.html
Size

20KB
MD5

17dcd1ae3d198a873701c977287d26a0
SHA1

3f9ef4009f43a768aac86f526bf54e7d9d9effac
SHA256

9c382e0e2936deb1a382da220e6b06d2e40dd27e440df9ffbd0a7ba1ad62a575
SHA512

c4d5f547be9700d624d855641a9f13d97262915d294749f3f0d551160b76a75f892b1eb29a4ef0a490af2bf7bcb9c586a5b9207af5b5d368af771cf520c03c81
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIh4lzUnjBhnZ82qDB8:SIMd0I5nO9H9svnyxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B316411-0AE2-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421077092"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17dcd1ae3d198a873701c977287d26a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8736836a6e269b472c25bb0587a550c9

SHA1
2e6456f1533b1466de80e7005d846c2cd64cbda0

SHA256
fdf7c91bbf756f5369dbd8e44ed0d4625c6f89237a7e9aa2903f9985e9df1263

SHA512
6d8fed4d8644a65eb4ce61348208cb889361f21b0d2f7deb6ae8490375b1b9403117f0d3984d2d3eb04d4e08c4fc18c46bd0aca953d1ece8a46007683758f389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f29607eb5ef107e122c31a532c83c91

SHA1
1570dd0d849a7728b3db82fd690ce63f9e309f71

SHA256
d652cc07922302521e096903a34f3336fc1e9dc974fb2191e4f19d1c0a318401

SHA512
802e848e1e11dcf4a0ca6f2be7905f1ae458edf490553da232e5d50bf6013c3ad1a9aaa33e388d9c4c687d1913dcde79d9968d72d93e70688e49cfc442281192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a236a7fb73710d91ae34b0800976470

SHA1
b52da9a5ec7721069fa3b75bd77f913ddc9deace

SHA256
f2604b9b6f4e9eee480e38c5a5c42605ef341d39bf5f94c12e6bec9e0a1bb2ce

SHA512
441a6ad69df23c53ce350a7d37b4d19cb63f1b416dda11f1c9c353ddd233d18b9c8db7e0c5e56df773903ce12d863ac11208c5660574395d15c53cb231606dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0713dd7a3c2b3c8ab52535a6268ebd5e

SHA1
1b714f58f0d39dde715d2e3b9589ec579ab39dca

SHA256
5429a1b9513d0e61105e1a76591cb416da7d2e612a0343e3135d75b16c230fcd

SHA512
c9ba1f690e972bac3ce776f26887536e6137138ef36e9f5f5ec68d3576064f2e2f3fa89ca8952cc83b9ce26effbd4617e5e40eac61f24794cec8d489673ba133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5f78e0a9f396f4202f79f0dea318e4

SHA1
8a15fb008869442ae6b07db4d4fae13432b3ac32

SHA256
70d751e03eb49894c1790cc07589413e36044b36e5686b11dc4d575b6fb3ce1c

SHA512
6381f436d962e209815f1d975effe78df334b67b9e5fd0f3ffa00fbf6fbdaceab28b73ed7bff11067106a175d0e303f2b72ad100d6507060559c2c69d9f27072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd2df0718eea47e903d59db83f95c70

SHA1
229ffe0202bfd424e49b00f877d52e9ac3fea6c6

SHA256
a42524df544f5738e6e3ce50fd499f3d8f4df7bd940744a35e6272fb8d71202b

SHA512
10c7ce5097a47c5e7426fb09dc14f138ea28579624972cee96c3eea21610e4316f8b7437cbcca3a29009b7e3272158eb94b2c696353416c7a3b44ff3bbc270a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed465be89908364ba0ba66fd7c367f0b

SHA1
3cfa9a17b4b8ceb782e89a3141fd6893b18b94ac

SHA256
396cef0bf9f48e7a745b075fb62eac0311e858f737a51cedf8957497e4e71c5e

SHA512
84d7b516fba7bc54328409f4492f21952243c00ac84594c79e15d70d3d75bd97d46d53f812c41e46dfaf1d62303193a9e1863e4743f56f4df33ed64b1588f2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2e9c80b98c26bbcfad89d3be6f7390a

SHA1
f178d1d24419bfaf3d0f426e62860ac6b09eeb41

SHA256
c8fff7a38f5f5d3adbc6cd0e3410df66876f78329979b63ff016c6888c65de44

SHA512
9c759db6c4dd5e513525f52e97d9d95fd8d4cd19c61f7cc28fda08277e25e1dc93acc8af280e738d1500e71c331ede7b86b7d6e65a88a87eb0b81463bac18058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d84f7bc363913561e854080220614f0

SHA1
3bf9e91d90cc2d0d9b595b26969330437ec7333a

SHA256
1f1f32d5256896ac73353d8650b9df484cda40489409eaf1c68def244f095c86

SHA512
d12fb305d7f644ab5bdcde3d8f2b9e09697cb01b88f76471d67716032cc9b36dc5c1c899f2a678302488508ea569dadc1c046e6ff1b6d9fe2d4e7efd56550489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B06.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BEA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit