4307e6e294426627492547aa5028998f170ffc4f3fc0df8faeac139bc5a22729

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

291dc37d1a1a913f8ea8e6634b89fa24_JaffaCakes118.html
Size

124KB
MD5

291dc37d1a1a913f8ea8e6634b89fa24
SHA1

ec13a2523f8df00169a6257c5d69b7e104a3ec9e
SHA256

4307e6e294426627492547aa5028998f170ffc4f3fc0df8faeac139bc5a22729
SHA512

997ff689422673f383df51f20e53627b15e7ce8ea179ecc2b9d5cfb8a44f6d3c2faf919b87d1ac45becba64918dcbd4aaaff16d665813c117e066c1a1f939ca4
SSDEEP

1536:E0iWnA/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:E/WEyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4297D411-0DDE-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421405239"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2216	2320	iexplore.exe	28
PID 2320 wrote to memory of 2216	2320	iexplore.exe	28
PID 2320 wrote to memory of 2216	2320	iexplore.exe	28
PID 2320 wrote to memory of 2216	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\291dc37d1a1a913f8ea8e6634b89fa24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c974970e7a4dbbe4b812b3d83dfac4cb

SHA1
4de3b6cb1d311d8d3fe5c01b80519c5d5f68d330

SHA256
5d5c2fbd79d0fa9566acf3e479a1eb4a72769711abfa98d54c07f02f2a58c6fe

SHA512
074b84d2ea4859d263ca26955852eabdc356e12d2ce934115a43113464c637e8389a543c1945d39c0b7ea0a4c3157b4eb61d962c79f3f48b948c62a13887fc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af12e3830429a498c0b413366dad797

SHA1
13ce19caf87f478c207f9cc3731a199be536dc7f

SHA256
1e8dcb7134d12ce95f3fe2ae8f1b423dab9a105fed5851494085b4e19dd4e4e0

SHA512
6f9bc577dadf7095b05a166372ac5cd375704a0fe8b5819c3291fc575efa5a85b11073cdefc9f75547a884f0a6348a4ab4026b81c7d37cf0d867b3e800de7563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96e20675af2e3bead8099320ea56e361

SHA1
988f1bfc0a7e07ea02825ff3fb325c256171df42

SHA256
87bcc0df52b74641230ae27cc294dcf13aa5cf0ce875d1ad30b8c3ba48b3ded4

SHA512
ce7caa1e0d1f74811ef34389e09c7daf1104c7bc7e882ebbd1ceb761982421feafd01a5521d242c1bc2d55840b5e01e1cf33fe555164d4bd38951adba0c8b0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba3e70a3a4a024661239c071e7bf1180

SHA1
58ecd7707d8e0db61966a471641ffea8db9c9f69

SHA256
90bbba40bbdb944515fb88ff975a2e69a96f3155b26acf1741884e50e1ee42c5

SHA512
3ae26aacf715d8c99c0099c2bc63ff4cc36cbaa6bbaefc52c8a81e06f251aea3205a6c43f36a38148f008ffb9b2a5253b3e16d8b59143f343fa667f0c2b237cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495c47c2b5cca320417322d9b8763099

SHA1
ef1d3896ccb36e6be6022ef89dfcc2b93f7de20d

SHA256
000c6b5945839b841cbc9619305d552f39409bdb77a76cb61d7175ca20a6f7a2

SHA512
7d2264f91af67e57a86f3fa0a1505083b397c9466e220a3c7e26f6214b27931a74f056be2064a6cad6316d05d8d8182ac409991fa66fe572a96de20aa746f1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99ca1b0108bc655427f43c57a3b6c477

SHA1
904da41bd197c8f370afd203afb4959c199b2b6c

SHA256
ea0eaf98f5b93d26580056bf4c3d9cfa09db44e7615b2cf45293cbec8e1689d9

SHA512
87443804296359bb45295e7f7db534f0d574474ee659b0e75c573e84f3f7c5300a8934b1d9b458ff7d0ffbc85c8169b471d3697372dee5fe67d0ba058fb14b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d773374bd962c6a2a4dc7ac7270f4843

SHA1
86d2bc02f5bf96034ae02631fecc57d9ae68310d

SHA256
81c9f04233596a6ad646d6b310c3528459b18ec54c42f408f22375d0ac67ea97

SHA512
4aed7565470c43bfc90ea7c8e3d9e94a6c32610ac502b580d11e2e85ea13457fdc200fb907097e7e973899a69217d2d6d4a576308eb70c5a964f19ea78d85868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a98c8a9649045bf65fadf7e2c0e6fd6

SHA1
66058ed3b18810fdab255821793f4f113fac9533

SHA256
01c8db700ada4656a9c8b0d9c76a0bee83ee94414a78412b643d96d7c8648ed0

SHA512
90413a33a6b675f7dc775c719f427514a43161d932e5e44fc89ad0fa84fc338382ae83c3485b24aacdb99a62653b0f1737fb76b26e4161d424fe207ddd4e5e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1acd925619ad415d073d2819a7b76f70

SHA1
d4186f50669b513ecf2f27fe3fd47e647dd9796d

SHA256
16c5a678fe85e4e6f113e10e466d621723794d18d655cd3e2087c1581cee19b5

SHA512
ac0b868f457def6a6938049382de0a51a64008ad67a4a4622133b309bd918a3256922a6fa1e3ece1b4f8c4808efc55af7de5f3aa3b812c70676efa04eecd5fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f534ee00f0c163ca60a7e068fafbb53

SHA1
5da01bc324f29800b0e44855e5dd664e06d1787d

SHA256
5fb1beb573284071530e9f15cb4b0bbfadeb84f8defc5f3264a70911f7a655c3

SHA512
2f747631259f57364054866ca180f9dabc0e63d8c0cbb9b3e14ed49d136969e828c098c43976648c282ab469a9ed09bf7fb950eedbd15f0358459d758f57a9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1882.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18D3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit