192a9ff9a08ca5b008d8422e8a241609d676f8b1fd8570dc2dfe9d02525e36d0

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2849f4cdeddacc065acd5ee739e99f01_JaffaCakes118.html
Size

19KB
MD5

2849f4cdeddacc065acd5ee739e99f01
SHA1

7922c56cde8534708f3c1b250255e1a396bb735b
SHA256

192a9ff9a08ca5b008d8422e8a241609d676f8b1fd8570dc2dfe9d02525e36d0
SHA512

6d51de74498a90f816226edbabbfef1865f28d2fb44535429495c4d2f24623dda3b181b47fa448a7a3ef273db9470b17e2170c641fb4f0374080bf95536963f1
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84kzUnjBhAa82qDB8:SIMd0I5nvHBsvAZxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421391097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54BD3201-0DBD-11EF-8442-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28
PID 2752 wrote to memory of 1296	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2849f4cdeddacc065acd5ee739e99f01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a1ebf26c36cfdc17a37da482b1fbc1

SHA1
6369b78a14f0ecbfeeaa75fe0c0088a2753350ac

SHA256
d1e28cefb33e3e793123a06a89a7297d44db4823714c06a15aba1ee7620c4ba2

SHA512
ce6cf802e51ebda6a8565949f0449dd193407ab1af99ff68f49272a59b2c4a1c9a9c69b8e9d1586f4b4f8f215a5f76932cd5aec64ab6697415f82b459691c4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af84e0968d3c4d265a5b1af17ee89af

SHA1
188656907e0d4947bf6def0010afba75e63d95c9

SHA256
b01b19f465d62f96ac6b1d2d05cfe8a6bc2a513df7e6401cce54f822aa342c05

SHA512
d13b6dfc6f769c0d7a763ac536d55982eecf43ef9d1ac99806cfb14fa424c27f5f148bfc2a703e97f743e12b717d4be7749d5bd8da1db863ea5b8f02994b962d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d860e80a5b130e03ed536fd9958e09

SHA1
0ae57a76dce54a93b34c3664c4549768fd7e6f09

SHA256
460d6fdeabe2e09b3886599c25e505187b62067296de671eef81059a4995f572

SHA512
c9aaa5a0cb4cdc9128d6b4a535750974b0bf2f4340f5d06f4b7280e7593ca80d9e48d91d655a1b6fb0b19f283b87b20cfda75ff69689117467ca360b9da27a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39500622fc36a2613600354a03d9a3e2

SHA1
7825e26998af16b1dcf882cdb8432cdc71fda6df

SHA256
4e9e495b3a183b37ca280eafe6f1a42fd839c9ab0c876d90f31a67cbdd650609

SHA512
cd97a2de1272fdb57288a8f209ea290bd27ee6a6a83ce1a3fea61d42767411ad85075814d67dce2d55ffb7e0bd55dc48949bde76bca6f5f2a4e0e141ad30ea13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a724be60ea96bc40ba9058d258b6656

SHA1
9b3dfc94198b5a71f001427f1298cca4ba899c2b

SHA256
11213453e82eac4a58dab181de87614edece796b720b1e2588dcbac0f7237e1d

SHA512
9532ed2c7668c50992a3f77b5313ade8133aae4d9e2d9c33ea67c80a03707448c83dd8a409194d739a216793365887acce1fabf865102c5a923db43caa1dfa1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e98540ece9a326357925006cee4cbec

SHA1
1ee2972806929125e0868e20bc41fe091b8dbd29

SHA256
9cde79f111e4b6d0ff460e43a59e81bb5203bd5c31d876f1cbc96f489cf9e3da

SHA512
73262e3e54d22f7b9d03b42b247e4b681acd916fafabfcade77ecc5ca7c383a3daf73d30ad46530ac0f585d4179dc3a512b5b4e27c7584d57be9198df1418b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65a9dfe91b7a113cc5fcf3e0c43b8e10

SHA1
6cb0ca5da4c4ccf03ed5933e6f0c7cb8a0586af7

SHA256
044d100dd8848f5762ac6b3019256b0760eb71ab69036b8048c77718455f7d83

SHA512
b16326472aa7931d6ffbe88193e3ebe81ef911f33dbc63bd35db3bba2e59af7403164fdbc19994488e421d07cdf94fac741520fbfe4ffedc8a59d1932e0a72e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9518fdb44a7a11250f0b64d63681a0e3

SHA1
2031d8db8958b528ce97d20cc86eb846fa475259

SHA256
45caab49f4a59a2c9b1fd82118fe1db30b860de2f6b27fcd82af8027125f31b6

SHA512
70ab111b6b397a091ad7a1c5bbc8b636fc31458e989cd42691a531dcb764f4255c074c4a6895ca3f76ba0bf1dd314f6fbd7767463d4ee8d35ad071a8427bf134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
059e0063d9096eb98e69e504cdbc3b3c

SHA1
2697061cfb42e8b45a026fd06f35d86294f02317

SHA256
b6ff0d52390aeec5f64a1da21ca32c64340679a5044d7f307bcaaab89944d26e

SHA512
26f93f6e992a78a6c006a5c1504581e2e966bf854a543b905c29a77d69dcf65bf583a88362512f66fddb16245d5ea5ede4e9223988a71b40792202d55d56f6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab210A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit