f6b22b3fab957c951d15607367673636403ddde9add461063fab60e87adc2d1b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

282c795c9146df08eaea2f1e3790301d_JaffaCakes118.html
Size

16KB
MD5

282c795c9146df08eaea2f1e3790301d
SHA1

ce8259d3028dc27b8d95df6750e3cac270b0208d
SHA256

f6b22b3fab957c951d15607367673636403ddde9add461063fab60e87adc2d1b
SHA512

6aa18d58dd679ce6074a119a6b51b5a48299cc4596f7bec5c63b38e16e6d456338306f6c7e0781f377a0a464f38382a07ddd30a56a61843de8e4fb056c01e8ad
SSDEEP

384:X28H4dG3/i123OJ+HSBUSq9HI0/e2BMKDJ+lP0Du3BCa3bS950:Z4dP639o022CVb353e8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F271F21-0DB7-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421388456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2484	2124	iexplore.exe	28
PID 2124 wrote to memory of 2484	2124	iexplore.exe	28
PID 2124 wrote to memory of 2484	2124	iexplore.exe	28
PID 2124 wrote to memory of 2484	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\282c795c9146df08eaea2f1e3790301d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974443f5dde7be8448917fbed89e85c6

SHA1
c8ec8036e8fe19a5b977906faaf411266bba5442

SHA256
d602986a20132bfcab64498c12f09895e8eaf79a23974bc5f8ccd069051f46be

SHA512
4cdd1b755c2441d68a644e3aa31364f24ec9318f91d19a1620ee06585c78941b8934396c12a3204cb6f2f081435b0884701df921c440ed6ca59e45a5d1a128ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6faf2c836038b60456ff8d75803f749

SHA1
ac09193c1dd2d97661ed04860a5cc143250f90a8

SHA256
d44de87a48a046cd41730d347416fe51d1968a1d31fc8714d9436b6bf012abe9

SHA512
f90b7f23e0b6eae2a659a5e04c1baea9cc91401cf7d0d0ca8e714edcd48ec4c4167d13fe627409e137fa978237fdfad5f0cb7c48e0da602609664394555c16db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a5329f21b1e472b87a9b50fe72eee21

SHA1
d1197d0cad0016e9a105f7fca61aa4612bf8f0fd

SHA256
548c519588fa12bc053f2fae9b986cee0821848f20d1bfa3b4a8c03ce11d5634

SHA512
1c26bd7842346e050f35ed2db6c1707ed33926d51e52ef480c8d4726435815c6b60baf07ca70ce90a65cc4e477e241b91d56770133081c3e9e6f25d9971284d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f352b5ca370701d03a9478618646f99d

SHA1
f4f03f409d9cfd0a72a40e851e21e0b563826a9e

SHA256
981a7f0dd728d23b6e2e087a06067876553609eaecf3c829e00f945fea60fbae

SHA512
7e1441b34f14a4e55cccc6c48169913b0a4d6707681c3f51e7fd7059c0ed82a2f7652ac9e5606565d0bdbe1e9aad29efe2f17a492c51badbd78eb61fbe4ff758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf5393529c16847cbc4f6c32999f9eb

SHA1
8c483e56e0cf8b17d40fdc39c4eae834ebbdfd46

SHA256
59df6f74a954c4f82fb62a0a344a771fd780666692f4b15837250806ff531485

SHA512
bc83fc263eb1602c0c08cb5b00d72dbfebd835c2cbecf6a86da8373f8f96fe9d2b26c324b91fda458f0517151215e9d5d36c3d21d24bab87bed18b60e7debedc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63284b011898051dca9c28e777a62e12

SHA1
96d875c4ec8f5e62d1fc56122c9fd94051d87218

SHA256
d0515485f5c4895a1547df9ba2fa37229c9ace20928ddcb7517dd47fb686ac8b

SHA512
32500bfaef5a58a00fcfe925b5f4144f175a4a09816ad7e87887d3df8975e70354e7816e890790ed5e08eee408f7938eaf4da0c232fd299037f258b77fa8b387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2b2314e0ef230d11046b027098e694

SHA1
814aaed0bc987c42b0cc3d3857c03109772ea67c

SHA256
e7fab6c298d109682f47aac21ff4c3f42cbc4d5238806613db087b00c03046f0

SHA512
1a41eabdd610f7b44618ff7ef9a7c59a024998fb3cc5092c67fe88831f0d417475a32ce44795efae265d4242f464b44ab6523bbc7503c3540afb7051486aa8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae158222589d4af876715f93bba09b52

SHA1
941a854b2219d940ae9e5aa2414c9ab573f6f580

SHA256
55e5645640624fbbae8ccbfde011428d39531fc435a5f6c93c6407b49191994c

SHA512
00c0c4e0609612d9271c6782d6a68266ec7b5f5c1bf9df6dc6d1623ee4bbff60f210c672d8868fe9ff80d20ba6f039a1caecb20d7c76b86e38625769372f1cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5419fde786cd66d44e8dcb832ad46cf

SHA1
c983d673be89d966d60b89e50e3fea8b85f2cc1c

SHA256
8d9ddb1bb2d3d4e58ff8281e81d21ae4b9db93944b634a11d180eef762b2933c

SHA512
254d61361b1c04fc0ae8434e9450751e7c69bb59575151e50f187b241081e8e2cc23b82bcddcaa2e98519f948b46d806c04c9820759b29f1a0662371c1c96891

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar156D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit