c7d08a114fed2b8b3bb006833addd0439a95c015a13b0458f46a6471de5d995e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28bf11f5e778fa5b5946adb8ce0bb615_JaffaCakes118.html
Size

29KB
MD5

28bf11f5e778fa5b5946adb8ce0bb615
SHA1

05605f86c7aee6b115e2b80b7ae9fe51bbf7ea4f
SHA256

c7d08a114fed2b8b3bb006833addd0439a95c015a13b0458f46a6471de5d995e
SHA512

2b0fbf621bb3e2a0c4e2676c294589dc9d5a15adf257782620cc9dec8b570078be5b035c552e66e60f7783271c65d902b3c66946fc4196fc6cc9e6e35e18a151
SSDEEP

384:BAdqGTHK2UlnHTHK2UlnQF1FsOo91zpNF60jj95yMBPCNqDcR:mdqb7JEVJFtBPCscR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421398581"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C183B101-0DCE-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28bf11f5e778fa5b5946adb8ce0bb615_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5b06bdd318aa15601bcd580ed069eb6

SHA1
37294d5345ff49a8525786aa1abc4938d54d8b02

SHA256
3b45b8124222354409e3f18a2fd1c17745b7090ed731b81ac62cb8a45a844086

SHA512
6652e973b76fbd2c80d6d3777e91a01bd4d6984caf36f3d9f366afe2e0edd35f8c75dcb568eac48f2c79c3d956b1db61acf8023998953a39c225d9559f34c994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a457d8da0ac6863c1454845276176e8c

SHA1
3c99e1b3ecae7ac485310b288c8728dd249c7242

SHA256
8582ad9c6b19b9349b45847a5b147470a485d0455b7f5279104e83d7535749f7

SHA512
368ff5736e951945d82f092f0e8762ec6eeca9a7d66c807bd9f9187967623a7cede6fc58b6a013fdb7a53866e5ca63f6fe21b4073c008af6635e65e628108df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f2effa8271df5ada869e8759c99e05

SHA1
6001977ef6a1cb38afc240f5160bc07db5b3875a

SHA256
c170124efa3ff949dd019339bca651dd287a704dcdb070b7c02b4e9b17ff5482

SHA512
caf7274152225c9228b2d1643a366e79296ddff7cfef964a63a64a0e2e1bdf287003dd11177afe64e23193b97cc21ed6684088ed0b290e03a3c632d74c6b307c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ac310f5f59b60d11afceb926c0c478e

SHA1
d8cbccd1ad7c112dc671795f0e02be7109b63ee0

SHA256
07eeac4095c035ea0d5407ea6947885c5d0de37af8c189386be8e1fcffc68ce8

SHA512
c6de962df29663b9e15768b19e2b1186d639820388f4cddde21f6ba4fc1c671cd596a323f8d9fb943e41919b913b31017fab8ea7890cd37951f7cb90c4c7d177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f1c1cdffe3dc84e91f2914586401af7

SHA1
e0c50290412d56d4d89c788f2d4320a760b83b0c

SHA256
e36c5d7b1c21956f6a3d2fd485ca365d822e1ca0aa1819bdeff53f1d7ff1b5d6

SHA512
cad1e2b733af092615184784e7d5c282fc27f585d214d080dc83d2ad599d8632135993fec89d14780fde9ffdc446c3ea8ebd525b1d1ac6ce795fe20f730674f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c00dea5a2f81bb675cc5291a0fa3de4

SHA1
15740e3704122df1286a2774ecfa92d08d91a953

SHA256
ee1b1a71dfe9cddebde7dff8b12c66907b1d2bb01cdd639e35621ea8b3429dd8

SHA512
eb885aa4e651f63dd41e58c66aded9156fcddc0331ce0e78e2ea10ad5d9c628a2c1e3f5059db582646eafe5fcc2e22236eb2e21c321b4e9fbc00382d84927ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d63f17df4a41b8b3cf76e43fd85df449

SHA1
d02bb81970099890d8156c0948bdfca96f6c197e

SHA256
42469593cd7ba82e030e731c772eb2fd6ed7487ae5be0023b4b7a7007b3f9921

SHA512
fb706c7df3c4eb3f54d3eade754ac934404711791f0376b71cecbc3d9c2ab1f10cb9fc12b9319091c11975e12ec2a6fda8674fe4b3344de597c5b5e3b3b8f8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
876c5f961c7c471557d786c761836f66

SHA1
a052493e724e99c4381b46209e1f8c259f6ddc98

SHA256
8ef7244de642cfb63b27f40dd659e11e115f953388318d234c4a5c306a6f4ea1

SHA512
2e8ee9087d267cdfc7f2af3aba68cb1b64e98f52dda4faa0c7fb0878c75b3be9837bd2f42c024408e115dc47c0dc7c03aec35a4554c9eb13eb98e39589fe9626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c25e98771cdb65e5346c43fda8f0c7

SHA1
b22033a2e737f7088b780acb619965a84b30c692

SHA256
e2b68312cc26afcca1b60f02005d604006d77088d1fa5ecfc577594746883b5b

SHA512
9b8cb90c4d54c796db90f9f60530468be448fed15cc7a37f316de47d22ac768c0dd4f6558e5d5c773b71579f3218d4ecff4b7c47179e22f1fe916b932fd4301a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69e645f204f76e15ee6ef2a8b3788e46

SHA1
42c9756a19a1da541aa35f7e2bc5e4beaa898d50

SHA256
c942be4d17c8780f48f9d80d75131a3142d61580c9b9caca2bf1706ea26d3ed5

SHA512
c8d46c3d36beb62d61a60c435cc4c73ea65c1b56eddb18f96b5d208c945c65762e89ffe68dfbaa0dba74a21dddb2c78ba942747af11eaadac2f2d005405c2a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab123B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1308.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar131D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit