5c9e58f14f06c0623f2e309c2753cf69e5e8071a3634b0f2f5af515891e9283b

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29fb0e7f06e30136b0b8c6e63a6291e9_JaffaCakes118.html
Size

20KB
MD5

29fb0e7f06e30136b0b8c6e63a6291e9
SHA1

581d1b0d016a56d039b7e99263a9debec31257c9
SHA256

5c9e58f14f06c0623f2e309c2753cf69e5e8071a3634b0f2f5af515891e9283b
SHA512

643d3a3a67acd50005065768d1b8605d8fef72e7a1c566643edbb69764f7426c971349999d6a5b35a6c32c254570f37c055323ed3edf9b71317936d0952d7c9c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIe4QzUnjBh8W82qDB8:SIMd0I5nvHHsv8VxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1012B101-0E00-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421419758"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28
PID 2272 wrote to memory of 2980	2272	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29fb0e7f06e30136b0b8c6e63a6291e9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247e6d9c6d007ae641792e680912a406

SHA1
34b71fa72a0438beb508c68585330980c2d8b9ad

SHA256
e5bd1fea9494e601b9abc0228229723f80d3f775ddb0d5509cac6c16f9d5e991

SHA512
949d1d56ce58bf1e1cdb4358c7b8a9a66a060164ee88d46dddb7c5374636d5e74fe54dc00aebf72c740d12627f1188c7104ef6cfe3a87cb142ad3cbf1e26825e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e62cb09bec9ccb425560ca0d0d5e39f

SHA1
ddef1d720d3a1f44513a095ed7b2fe230da989f7

SHA256
d7987dd2cbff4b910b50d7fbb42c5bbf7a4bae0e9d95596766b39df4c351af2c

SHA512
9d5f5d387c0e65f727fd694c1ad1ebf68166b32030fe96fd25d0a8ef5817cdf9fd6bd74b7af121c8377c441436c4de3dd8299750e07a48ffdc7feb2309c8fc43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff25cebf6c6f765401614873c6620e25

SHA1
2ef3099cad41d943890720827786a9569bb0046a

SHA256
52e2c91d97d9ac20bbde6ef3c2c21dd57607ce4627cb7546f5d8ed5db1d873fb

SHA512
94e0db9c260cc0bc41cb5df3ecb3d86a7df2d518c66e0b343b0e4deaa480dfec04097400400912baae84059552938df3ea252a105f7016b80b926bfa6517477d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df9be1dd76055047ebb006b5be64e372

SHA1
ff22e2b86e2c1a52583b6877e394472560b5a29f

SHA256
6d7c82336d180603604502547bc7a3854f2993ecbb455134f3344ffa7246a743

SHA512
7db454260b1d80c44fc0cdee3c8008685669939cc6f8f727add5ca8507e36522c31451bc4ef44880f915045ce5ebe58426cbcd1d2e8bda15c5caa6a60c971f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6791d2ad00a8d23d2fc145bb136a7187

SHA1
c1b8f0a2b334f00b574dbd1208d57ecd7479836e

SHA256
eab72e149fc67711d17a3541e0daebe7d809f72a049c5da6de199f94f31e4421

SHA512
cc12f4ad2ab3389502a6b1ba833f377e3bd679bc9d25e511038359d73bbdf1f3a746af72035e85d7d2b1e942e09957c1d1b417acdd1ae0b1ef87b3bef5b9dff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6730a062b437df6fbcb2ec004ceff40e

SHA1
dbfb1ad17834c13daf9263ca33421a97f34cc5a7

SHA256
2377a747231bb8c287fff0d6dee6374aa13c007a82529396e26cc6f7fc6806fd

SHA512
c737e50f62945b27a08737a24301ffb405262da117c065be4ffc61626e4b754fd64150d4562c9ad066485904130b067b1b5554e1912a90b43c55acf3612cb2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b99a326583f4644b11f81c56e651984e

SHA1
528657402b150656957966e24563c62c8a1cdd53

SHA256
28809794f3e32ee1c5923e29ddc684aa8b5938ca9f9f76e752ea8bf55113fc45

SHA512
7a6055f350d24126fa4c0374fb97fd207c4c052ff157d227396891add4addabccbbc50a16112adda7c217a66b9f83048a62a6b542791c42b5765aabd79a50e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8443d11a254b0d553be248754fa4977b

SHA1
e5c0635ba1d9f7a547a64939882b5b5b1b115164

SHA256
e6e54696469208744094c649637e123f2c7733b93493d8ddb612faa8b509a942

SHA512
26012d814516bae8e70e032e0eba165936ecdbdf1f3462236ba8e41cb3635919452d545c15087c6a87513b0efac9aad8fb14e8802b5d387544afcda88e2c9844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d810fc7cedb1d862527df7775fa2c2c2

SHA1
d1bbcfac53f05f8cdd961e5253c457c366ce69e5

SHA256
03a572a4ed64c1bf6f4fd254b50df1175f883d46b1a698caccb4077948e63f40

SHA512
bbba5c3d4b1f800cd62582a320341bdf1989074c49c4c8ddef1cbee6f4e6e62a36b31d5b3c3ca2871aa1d02c1ea78eb2dbb5830d92445db22527fc417f51ef48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1001.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit