89ec8b9892296a09419b1f3f1c9223ad0b20a694bb56b120981cfd7614649fd3

Analysis

max time kernel
134s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2989ac08fe26a3085c5696c4cb0aaf78_JaffaCakes118.html
Size

797B
MD5

2989ac08fe26a3085c5696c4cb0aaf78
SHA1

e0e94e248c6d6c4b36909c824f3e01d1f6309314
SHA256

89ec8b9892296a09419b1f3f1c9223ad0b20a694bb56b120981cfd7614649fd3
SHA512

effaab81527023c7fcc2a4a21cf8e4c6bd5a71ebb2863b869997edb74b3dd74e27c90026db1943faaad08b1379fbb8f7b831d3e344fede75516b9be21e71c7fd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{615AF331-0DEF-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421412592"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1964	3012	iexplore.exe	28
PID 3012 wrote to memory of 1964	3012	iexplore.exe	28
PID 3012 wrote to memory of 1964	3012	iexplore.exe	28
PID 3012 wrote to memory of 1964	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2989ac08fe26a3085c5696c4cb0aaf78_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d31d95414ca0ec9f82c5ec4ead9adc3c

SHA1
5b2347a5fc10e637a564aeddfc305fb4b54f6a0d

SHA256
c04be74c65b5c0464a3ea745a3ead278d9ee0ab9ae81197ccb28d3e20d57376e

SHA512
9b9642e4b49b98deaca36eed46661488c83cfbc06e71329182b7df7fd4c3328da4254a860717d91ca43f73cf1ee699b7c3fc5b13f4358de7e21358ecae844125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8c6f7b6126efea81725a3278b20ae1c

SHA1
17c2146237b44e378c6e6a8d11ab61d6147d3a28

SHA256
c49f0274dc974cbc3dd8fcbb1b0deae650e98431602b604854a6bcda495dafe2

SHA512
e2c5027f76dc7e2021dddaf13bbe928bdb4155a4a4b6be892235d8a410b6bab1e7cff665f71b828727e16e0fa2b611749497bec337a3c48a9d0cfdbcc3048d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bfa8050ac0b84098bb25a5e9e6f9edc

SHA1
78f55f5751d9246c0d82e1645c4c8c9867e2b1de

SHA256
6da66d1a37e0be92ea7d4701f2d31c65bb0207f48b2414452afc2f9eed74a682

SHA512
571440ab48530d2f148c0a8b0d388d14bf614867e645a275bc27d46dd6e7a9999fedaf6a90af4bc85fe30b3f9c7a6385bbc6b8464edba3c28c24d2d5e4068531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1acd4b37f352edefb4adec9ea27e5d8

SHA1
2fc17571ceba348019aa5915ac49003c7dba23db

SHA256
8ecf5cd502ad5a70a8d1d81f0feb232d1eef21c3c80516a97d37f85532497c1e

SHA512
1a1457027d639c7f2d62ddc67559ae6c660d9c09ce3806b53506ca8b40701e2fb9721cb7a70cb290ce0b74cff9fba24d959a1ce799f4f0ed69d8f0e513d71c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b813e412a144b46aa01fb4370c7e59de

SHA1
3898029000fb445bae1c9805e1c0441831bd0fa5

SHA256
c5fe4bef7a0ff1812cec86f5963713498b254b8a26775d081590d34586b99763

SHA512
41c2ab4d87b05752b03c2e4ba3cf0ba001dbb66184b59d6802978a838c79c4853a8e0004321cb7c79684e1a6e9e0f4269a20676de58e71e96ed45ce8e843d2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff73db63d3b4dd7995b557d658e181aa

SHA1
d87ba7bd27c86ca9f752671d129db8fe90fd141c

SHA256
4fdfc3786137ebb9dc53cf4ff203f0c841ebec6d69f42a95a00b5f16ecf004f0

SHA512
bd70a6682543560f3cd9d99e0816c7093921931af37a32560772386d981e22953792abfa418f8e163741d83ae7e452ce3feed35ff316a72c8b0be9710a500d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
323b7e61b6763c1db87a0cdad38f7b63

SHA1
5e51c968135247e4ea3f7a7764dfc84fe78be466

SHA256
daa04638cb5c0bf6d258a1090e660f13bd4a39522e37d86fb01b293868c7fe59

SHA512
3b70ec2cafa1521cfe0733914db931df91f4c8f855d3aea8579ed6c844fbf7dc1d6226af07e272ad3d4f401a7f05def665710244e39e5d7990cbe642078e5772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f79d197fca34327b6ab83f1d8f787e

SHA1
c1bec4528bcce0096cab5ba8f01ed9eb0ced81ca

SHA256
79689337e5fd4ea33857b65a10eb19694b5dde1d09c3340af67754156acbc598

SHA512
b513e65bb8c8d3bf9bb345f2aa7742faf2b409670c69c1d92ae0674b41f1913b7380ed5d3cd5cf6b7fd027bf7e934f79127e9ae20b361bd1c75171a70da527ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a6ee65b2eed157663a0f99d66bb3d5

SHA1
981a28633fa0da5abe6b8cb323606975360cadc8

SHA256
8e7051204391a9d57ca9ffb519d5febe084a2c33e6dd760062447328cf7fd8d1

SHA512
14d85b367597f3769d2bd9d0272d8df099fbfc9c14a4b266af490ec717585e2dcc27ae963bf05ff710db2d1a1b57d885021d98bf330f3fcfa436c5d5545bdd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E9D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit