ee652a21f07a60a396277d1cf1060b066244029e8e86c2ff0cdfaf559b0c312e

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c21e813add9210fb733c836bddd741c_JaffaCakes118.html
Size

39KB
MD5

2c21e813add9210fb733c836bddd741c
SHA1

6a7a3edcd87aac2aca761fed0ce343de0669e0ef
SHA256

ee652a21f07a60a396277d1cf1060b066244029e8e86c2ff0cdfaf559b0c312e
SHA512

91b9af36c30de0d6775754e593c39cbdb77742379bcce38fe9a583a9f653264d96ba91c7e8c0dc187fa9e1f35f251b5213092a5f20c45ef45ea4db9eee9dbd9b
SSDEEP

768:PNF6M02cxv2Q8tqeqLqgqnq1kye+sVe0HasQ2LELDvDsTorsUuLR8md:PNF6M0Bx+Q8tqeqLqgqnq1kye+sVeiaM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04E01541-0E58-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421457537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c21e813add9210fb733c836bddd741c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a04c7a57ee39c5260ac33c302f579fd

SHA1
2f52ae5ea0cb56008fc1ffe24e68db97c49c36fc

SHA256
030be0173fb7f5083a988635be4f5400874249e9be78faca88f03a3ef4bc5750

SHA512
d58b23bb1dc6c09c1a898d1d01e4ee29c5beef4a14649ec12d1f82658e672cf661fde15ec1c6949e725bb72da6471300eccae4215bf79c14c30f69c40bf5095d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85499216b01d49afa1744965ec9c30ca

SHA1
4ffb5c15ca720d01490cd267c97462182440a5e3

SHA256
c4253561e65b91ee739aaa55443f69dc2db4b646fb3ef9f263a51096e89608a5

SHA512
5593ea5d17f8d633f239f46b5e18c4bd33edd4ae0ac34e201283e530fc4dcafb4cf8b6887bbdbef17c751fc6208b754ad383bf9fec3885e0c3c7be5225169398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53362d3f8ee83db2231bb25e70be013f

SHA1
a3beb51bf91154bbb976057fb0623fb041d29fbf

SHA256
4bb9ede8432e436287518ccf234167897e2c2b26b47da71d039ef63997215271

SHA512
a99da0ead530e6c5627e906c48350a9eab48f14d43c0dc83e5a98746a5262e6165fd9f6e94ee2ec115f46d08df5a98d722bf406b41260f5ea041d26eb58c7ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b36d9f4cb5e6f9f8c624d97703d6e727

SHA1
c15db96cc23a0e40be72e429111f4ba25aa42d5d

SHA256
0efa44456a6fb394dcf9e99d464845251bc6a102c4b2f086de42427d30b06282

SHA512
16d932923b50fe509707491e1c6976b21bb571baccc483b963ec5c85e3edc9842cc6df3940b0ec13c271a58c23a6d745eff4f898b421ac45d0fe8c422576dff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27c51bbc2a6333459a6cc98e08c7c3be

SHA1
0f046280ca13072c620e4ca127b9b0fe847f6213

SHA256
68bf46030983ad19bd212110b1565f695ceb01e80da3aeca74e94d41fd542594

SHA512
61ccb402d0fd8d080a9ba4a6dc85d7d3ce0ad2d56a180b41ca6d6550e1de56cd894904f5c8c7215e06e19ba44d835b4d67fad4aff5a47ce74be212b4b74ba7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0169219861bc912b6c5cf8e12f68c2ea

SHA1
e228d181e62f73b89ca7f0e5ef20d24fddf452c6

SHA256
7303cbcd7a33aa0e46fb1561fad92fad35d8f735334f248820484d16e2e1e270

SHA512
6559240ea3cbeee54a99e7161a044c8301d75f17a9f5abcacfd348f1b1548a9dae0f7913d0796a20492b0b08fe40f329badbfc02560dc0724ba0a83c9220f989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df284be1d23cd4b88b28a5c8ff2b22f

SHA1
37898176371a3f9e1bbe826f94f58c2fef48d87f

SHA256
f40fd4a38579a532f10aa78e90c9622b27c7444869574f2a53c291203f9f4f58

SHA512
eb2530c9867b679e26fa33544cf902b231728c78a1d75063887ed5e1bb00afa91516717d9a0a033b8ff8c18edce2a3aeb797ace48daa0bf0db1df56f587fe2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\f[1].txt

Filesize
35KB

MD5
fe3622bdeae527f5f9b8056537e60e76

SHA1
6f0dfb340f428adf1737882519a6afc3adfbe04a

SHA256
80834ca28243eefe85d2bc9985d465da03cbd0fe7768abc6a969deba7b3d45a1

SHA512
543fee42e146e0b399036262b7a22e57924ac8b0bcf5aec1491bf3fc397e1ed1e730862c0c7df4d747d713544b248ab6f414d8ae1c2c396ac7e69126d155aa76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D91.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DE2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit