1d3867b3440afe3369b0a22dfabf68e61c688118bc14c59ada17a364620541ce

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
Size

20KB
MD5

2a1d237e3f18ee6304016562a8c4a209
SHA1

5a2788644c30d42e752ac461e88a77aa1117a642
SHA256

1d3867b3440afe3369b0a22dfabf68e61c688118bc14c59ada17a364620541ce
SHA512

4e51b1ea3271b2823a3bbbfa43a6685a0b21e8981235345dd254eaa89ee96b2f3c1e755b647590429a3e5e16e59fa3804346281926140089612fdcb703fcfc82
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI048zUnjBhga82qDB8:SIMd0I5nO9HZsvgZxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{983D6341-0E05-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421422134"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2604	2400	iexplore.exe	28
PID 2400 wrote to memory of 2604	2400	iexplore.exe	28
PID 2400 wrote to memory of 2604	2400	iexplore.exe	28
PID 2400 wrote to memory of 2604	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eb796b189edae89619d070e98bd43c4

SHA1
dee76bb792fe0c00c215d083c05dfb517eabbcf5

SHA256
284212731d6de36ebaae166a7787d5650630508c28b294d90524517ec30abdc2

SHA512
194833ac58fbdd23298d816f937c0395bd2f622377c1c91164a540ce02c61f8c16f1f2e0a11aba83513b76758608facb510ea9231a4259c1865c91771d1519c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d092798a094cf847c88d42a6abb393b

SHA1
35a61fdd34c8f28a4cebd8f3141a86db8a9a1835

SHA256
95df4c93ded7269d4658c32aa714512a70d8245902a6966f6c99cd64ba2d67d2

SHA512
b9e699c74fd857534a6c80c88b34a51058f0f66d278a2998a8843907873d3b4bf2245affbaa8bef4169acb17a9a9d93ac25e21941c1538e88311253ec8b78401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f38cf83cd0acc32de36258a6e4f5c3

SHA1
d7533f52e8233e4d31cd394a011aae07fb2be28d

SHA256
6205c45c258a6f2b0f0ae71c39dbca60837aa71a730f7d92158b018cb70fd595

SHA512
cedfe6af93b69c10027fc20d72033cb840b61bcc7bd23a8942cd9156da8067f332bbf33401b170e6a4edec2958e233359a6c563ee27c5efd3f80b1642f9e7ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6090ca0496bd7833fb815ae2d69debb7

SHA1
286ed2f4b9df2da232b7dde779fd7f9d0e080164

SHA256
6cdbff2e5b71dbf3439f4ee032c8dbe681bfed4a99dcc52bacb14688c05a6422

SHA512
a90279152594689c7c3ff1b61587546cc7a8e96ba1e2a5eb385d629dde32b42d0cfda2ac17757c7c89119feb41df94350b29af27146636ed367c6245d9d30bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbd5e3b197315ccc124e592c74d2d699

SHA1
3920b8eb2d6e5c2691c45ecf4d98c80bb321402c

SHA256
9fd432754d8d8c6666a2c1c98b5d9b25a573bf5fe179b44d6cdaa6660b644fc0

SHA512
801a85365b5e6b4e2578e9c23d3d1596caf9266fdf91e785a3d924bb139d4ff9f002eab58492b7acc6e32d3b89f80d81606a0c4c147181e484f6992240202052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcd7e7aad3269f20119f7884cbd304d4

SHA1
66de29e3b938647f03fd9501e02f80d2d7704bc5

SHA256
e63e9377fc1eaa8295e737a3f6ff6ff307acee91848dfed425ce0a60cbb4b420

SHA512
0ae21b3960eaa138d1dd9907dca7d802da429cf125c8ec0dcf6f7c4f5a619fd90d967ba5d4c0c8a93f370f58e51d376b988f6ed73ff6d3bfabf17f6110924e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df990dd2894d59ac5d41c1bfa181574

SHA1
7b5b34287c0d378977b27536010c13b6c966c75a

SHA256
02c12089785f0c16d6bab7f2f0c7753f428b7b7e60246404412fcb3d5360e5f9

SHA512
3ad48fc5728379b35ea795598031e93c5f24e5b4fa4782f75d7ed4336c94a144dd7f8bf944b79c4b7c5897d3a2a8f663007df691b85f60854929767b61803d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61e8e457948901b2240572d6f04749b6

SHA1
e29939d95c5b1908c04db7ade75ad15f8d1b4335

SHA256
8a3b819568adceed48fa274e8efb0f40661b9d13b168dc3a3c3bc3d576f7bc88

SHA512
80ce66ef068fe3878cf326191ddb9c16113a464ff7a569c1bbbcf49c8df434b3fde3a24626435ebe71892e143aae9021cf2850bfbadfc860db90e6d095a9926b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3fe3e0e47cad2fc999dcdfc4c30cfbd

SHA1
e587764cee11c55dbaa2f044c4f9c735f2f0f35f

SHA256
5bd365b107a9b8c554b1f4cec1aeb176f2a4a15c98238c3aeac79c8a78c1ae58

SHA512
372172458f170c434775ace030d55d61531331e8130528efc2a4ff204d6abf7aa0b5f5ac33804274c1c62693f972ce39ddcad935b5e6751ddd94ae59ea90d990

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26A5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2706.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit