a54367ce34bc0c975b3e365e5aaa9fb260d6bb8d8384a7e499de21420d207159

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html
Size

18KB
MD5

2949a1917aad3f306de29f995cb842e3
SHA1

8faa5cda06fedc21db8b87427b680bfa40a6f3b6
SHA256

a54367ce34bc0c975b3e365e5aaa9fb260d6bb8d8384a7e499de21420d207159
SHA512

bcf9879a6b5651e8c02ad5448881a05a5dea36189b0e7ef59bb9838b018fb98ac3b051a8a8685f036a407a0355b54072ceab25cb68e763ba3e99ca811a4e84d2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIX45zUnjBhT182qDB8:SIMd0I5nvHNsvTOxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421408219"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32379CC1-0DE5-11EF-A57D-4637C9E50E53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	iexplore.exe
1196	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2208	1196	iexplore.exe	28
PID 1196 wrote to memory of 2208	1196	iexplore.exe	28
PID 1196 wrote to memory of 2208	1196	iexplore.exe	28
PID 1196 wrote to memory of 2208	1196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2949a1917aad3f306de29f995cb842e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fbbd14137c61837e13b1e2c55231529

SHA1
bdab5e2588852d7eae5e4dc308ff9627a81461e3

SHA256
5d343ae76b70284437c505ca27747b21e9c8a58b93c604287d2e217d5324a8fa

SHA512
ac59a235ebe088569ee81764f5ede30ebe90c5bc66943836883b90b6f50455db7a3cbb58b41e0d4b116cbcf43603dc529fb736c98d516c356a6d7956c96a1bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73e45b2a71904dfe095338ed027e993b

SHA1
7c26666e0d5ceffe71bbde3f3c1680907a0b2532

SHA256
61386aea49a639902c2b97c066f8e2abc99f75b7def224ff1cbd2ecd96b764c2

SHA512
1f31210cd7372b4fd04f47f3a28f7720bebdc8b754a19645317b317b13f4504511fb4f985859ecfa3e8f71d64900b6739b9ca76da9b6907befad32c254010d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9088c4dff0b23cfe24e96c081dabb941

SHA1
0fd7cbb35c56b8a775ce8c8391dc06262cc483aa

SHA256
086043d5711da56fba439a11396f8a7d4b5b5eed57d8416d3d00368b46f9f35a

SHA512
7c91fc158573b8901b3cb347c82d485c571798a86f753e376ad3e6d563181b895774d0b94a5890b46d01d24559291647c52183b75ad1b745093d198e85c87836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0b5e63eaa5a109a56bc3d6518973b44

SHA1
14431e7f71243c27873733faa8be9109d4412a38

SHA256
cfc3e2b603767234cf22cb52a02e45c759e013a60f643a734e4d1bca07293d64

SHA512
4cb19540052566eeb9d8110f9f19b2786b7072d76a8f99b93c98e68db28d55d1dc7f35a9ca2740a9ab0f13cdad9a37cd06e4cf098c112ddccd045afa2ababaf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f6ecf3b9dfb769bf7fba25fb320d70

SHA1
505f8f1b3b45ba95e8cf4086a9fcadc6552fcd1c

SHA256
2ffd492e45c015df6c2edbe51bd311971bb2d469343660b4836bfdb73ea665de

SHA512
9657782df4dfa04a3a772402e03ab1908849b78543c641bbfd26baddd68affbee5a662c5dc0380fbf5a5e4cc68bda4502bbae45d90948c8cbd2e2b3124cded2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc5b9c2a882634c6806ed93db44bb81

SHA1
2e0691c950d6c16cf1cfdd96ab591591706be65f

SHA256
d673b51e91e3ca4c836b932c4a33652c08f921546dcef4a252f822d32c36f1ac

SHA512
e3500fe63f142ef002120649b808884eb49a9acca46e1b7dc387aec44fe148541bbc88972fcbdb5ddd79fb41214ffb1e32d576eaaebc944fdef1fb510b1d5225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5257d3cfd8b1eb427180dac061e4f7

SHA1
49144e3ae9611f481a638e106939710a5a032756

SHA256
ab87dfdb8a0a6c89a4aada6276962df250e3b8511c2f17765ed472862e422109

SHA512
1b62194e1afdb30c0d5685e16ae111f424277cd63a5f897b42abb6918c215253cd56d2e93f1051a0eb676876f391f6b8393658be357ddcd46f85ea015d8abf0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba8f5cb509cab53d40a83c42a71f8362

SHA1
57eea9b0bdb8be8e9b2870d979c75349fe808ebe

SHA256
cc6acd188eb25be183441416bedf49a232999b395103b1e29e20f475ef380b58

SHA512
0c4344c426a8211a0259e83c5cd84989b76d7e7e752b791e88db3160777481818ba97ddae136fc1624fc34419b37c1ca61667f2fc57b834226e26974b30fc4c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1803.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1866.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit