e7458eca04becf2cc8f10018ab20369611b64a3e3e31d718b1b6421f2afda0cd

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

225f0ebd3015f419a75f480a2b3ff37a_JaffaCakes118.html
Size

12KB
MD5

225f0ebd3015f419a75f480a2b3ff37a
SHA1

bcddd6d28cd3ca5998097e6f17f8c19f8554770a
SHA256

e7458eca04becf2cc8f10018ab20369611b64a3e3e31d718b1b6421f2afda0cd
SHA512

cb48a97d8897b732c8bfe79f045b5de7632f1b6663ebdacfc4da93839f2fbf87805cd648ac5f3c71fc8c9c6cfbe067388aef98341462183181dbf1e470ff9623
SSDEEP

192:FozCCloRJq2xgP/ttjifrR7YywM+GV5kCJQjw:2hoRJq2xgP/e7nwMRV5k0QM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADF03451-0CD0-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421289455"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2484	2904	iexplore.exe	28
PID 2904 wrote to memory of 2484	2904	iexplore.exe	28
PID 2904 wrote to memory of 2484	2904	iexplore.exe	28
PID 2904 wrote to memory of 2484	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\225f0ebd3015f419a75f480a2b3ff37a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a6e50b7f003da7338ae88829265f2ce

SHA1
629650f812b4ca05c8381da4bb72623cb9186a77

SHA256
4d8b7f8f4814869455fdbd42134f5bd92070c6cf960e490ca499d8c686e2b917

SHA512
b8b0c19c56de73b5f2183d8f48e02973be9818bbf6b0ba6f7a56fbddbecd1551b5216ea22ead63dc2b77edd413f9ef46db593d7aca1b46760540175fb90b0545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7478cebfd04280f78c1cead725f950

SHA1
640fea4c3682b078f8432e5535b7e96b10915afd

SHA256
27d33fdd173c41279bde96c2fb8fbeb5a8afc09d353af5f22e92e370542615fa

SHA512
6e745b09c0e0b8d0d8d7056f2a9a11e5fd08f344ee3cc2212a442f035aa1f3323c9af383d78e2c870ab43ea1fac66ef70d9ef8a72bc5e19f25da8c4e8a5a950e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d18ad48d741b8a78cd549a4d59c4d6a

SHA1
42685128ebd64db4c8c3210f95012479c24ee703

SHA256
41a231f824fe4cbcaec6109393190daa172f2489df8638134b5259671fc0894d

SHA512
d72f510eeb93a73307410291c4efdaf9a4cf9429ba218e5b946c00b947ff88234ef826ac65ff00225adea40d5f8982f7f7022a7784172765a4f0ce9dcc6bed4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34805ef5f2710c7128036e583c0e87a5

SHA1
a67f9dfdec0b7d87ad6a103ac8a8e8e4f812a3d3

SHA256
67b5fe6e613f2515ce430e90dc8e08764206373976e110aa6b44f196fb2f7dfb

SHA512
a73d7ccf6bafad9523a40bf82cd57f01eccc77c174337d49433a6fc86a7b8e205a8e8dcde95ddf8f9b338166cd27de46eac5d00a0d10fe141330784a5f499186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e04cbffd4028c63474f95eadddb4d0c

SHA1
1bfc1036b0cae879d4ea2e031417f6e31397b738

SHA256
d413b557ca10f8192b91f045adf3d792d1d058f8bdb3cd548f8073478e64b0f7

SHA512
80b1df417c46e1b19fb2b79cab0bd4606e4d289bfc3e057768f682c2245cd9367f450ed18418432d0586887ff586fff5d927f6b54aeb61a38ffcc806ca5a32e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d80a293aea824f935d2709c6e0effce

SHA1
bd52c301aa8be826b89f32b7e15d204e81aada30

SHA256
1e13521642c067b9428612035d8d13919a006cbf100aff073068c9335512a045

SHA512
7d8239ebd845e8b4c41ae9b6678d875600c57056876696a1a3980ebf5de9f8eb33ff985a15d59ca7bb7057b3c306c4bbfa09a6e9908def381835cb884f89c60d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a21a3ad10457fd207fcf18cae7fe07

SHA1
cc68970f50290de69b0422f165bc741792dce5fb

SHA256
837667474fe3fbeff3347b9beb247b574341284be04bc8a0e767e441dbbfa7c1

SHA512
5def3147f376b1fcc0e957ee60401f6171a40349119ea62ce3e6ad0373f98d7d07f1dc61f734bcf6d116482476ff77b4631b4da3bde4d786e98c01ade6847d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8f2fc39fe647358dd390c847e2c4b9c

SHA1
c7c5176a22dce94d2f6d25f6fea1145ad5ba253f

SHA256
3dd0a224248363898497c2d1f01311809779c110bbf30f2611ab6684e59947fd

SHA512
be49add3eacc5ce9e82e64aa8c9305dd20c2ddef5892d397223b4a9cd5f5dd700b4f66012e1c3c3e6cc8d45de3a64646117dc747f2632df45df4f1fc1c9e76c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9533bed41da5d7051fbabbd2cfbebed6

SHA1
6201de6082afe997ad3fc1f6542565521d55ab64

SHA256
836199d1f114800fb6d46468bc1e62bcda27d85b56ad37fec58759ce670b5df0

SHA512
f12666f7b400c062a634de74aba3801eed22093c746c1a4e5f484ce759e93f3a6a99c7fd45ed9e6f0b923e3647dfe5a8824c64d437f33681fa2e0799b9a511d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12B8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar138A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit