47faa008320b96f7524f680defe13b81566c9e7c5fad59551f6d82e2e75fb370

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a828649a4a1e8fca9b108ca4866e4f8_JaffaCakes118.html
Size

88KB
MD5

2a828649a4a1e8fca9b108ca4866e4f8
SHA1

27ce229c9c70086342cfc6b88105ac97ad7756b2
SHA256

47faa008320b96f7524f680defe13b81566c9e7c5fad59551f6d82e2e75fb370
SHA512

5397ebcf0b00dbeb5ac97093882058660ab7f3ebc53e6b2a5f16b086c6304258fe5896f04c5021bd30b71e5d5894b0f343ff8b06119b079ed2be7d47f1364cf9
SSDEEP

1536:Vydg8WAIj9WidowMJMiMHX+RqtKdbG7nxfUVevQq0aBCivpdJkSbIPp20p7C:g1WAIj9Wid/+R9dU0EkfPk8C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421428541"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{814EBAD1-0E14-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1152	2184	iexplore.exe	28
PID 2184 wrote to memory of 1152	2184	iexplore.exe	28
PID 2184 wrote to memory of 1152	2184	iexplore.exe	28
PID 2184 wrote to memory of 1152	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a828649a4a1e8fca9b108ca4866e4f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1878fd4796a815e5086ce0231d79f1f

SHA1
c4b0919b0d43df96a8ab773fc41d6a54823ecd2e

SHA256
a2f73a3340d2150e2e271b53d6910e6e7c0350f89fe38d6cb460c397c264424e

SHA512
2475681e9595abde23bc4d5c703cc725f0699b6ca6ef496e06e5520a8fb8cc35aa13ae9eb78442518ee657b9462aebe7df5c7f04ea27a1390b919981f480334e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b6428499896413616abbe39910b3897

SHA1
5301fb35c96e17f46e79d5a7a01b7caf9761b8d7

SHA256
4ecb84f565224bd6c55038be59f05436548ad2e2cd93687c9380ab603bbb9f1b

SHA512
2467062856fef7fbc8ecfc96475a11509ab16b4206c380bf233c76ea4442a5e337a9aee307725cf21f02363298bead5af4e8edc81da9f72fce44e6a0dc6d0b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
643ad973b5c47f936f7cc1dfbd8ab4d2

SHA1
9dae3c86faea6e3482ce8a17010c3999dd979eca

SHA256
a1f642bafd6c5103121473f1dc72344189b8c821df6074c32669560fc42c2fdd

SHA512
1e5772b83c2daf1acd9af21cf1941b3a7a5b3c76dc0c5a240f1d621ceac2d72108ef5a4c8aa4b417e1f5ff9e418024353aea215c0111bf2b51327b5f3b9ebf87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e783c4466639bf89b48558a6e44d49

SHA1
381fad6472f485c03ded43bf9fe831b4393aef53

SHA256
78db51c31315c68911b1fa4b19002d6900bbb4d8538bb127195829e00b74e3b2

SHA512
ec2bccb989f3c378088cf92cc3218d2d8e3e302c87274fdc5e5b20692b9ad8e10f8a678b28b85c55842e59780423f78d6dab480140afb1d57a5aab05f3d8db22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85051a7738a9fe3b4a8f2dfd1833c37a

SHA1
8b9e6a127c02914bf2c5bb2d9654a1d9234bc4e2

SHA256
4f1e2c35b2a8f25041ac0c9b2dc7420cc150eb5d432ce34ae51d6f1731de9ef9

SHA512
080fc0760f5f87dff88f8d0b01a2e64f2cb415e3584bc40138a1c35055ab8a23d033eb8ee9de2dba74bace09ae91cc87b469267f70e56b6f83ba6f501b669d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9ccb16ab64c6066f4eb60bc90a5c97

SHA1
51e7513938c6f4f4c80ecd6b9ee93ff14cf52af9

SHA256
a1de22940fdc0bc265c7f58f5c527dac161005093bea4cfb3471b3cebf444919

SHA512
38d66a8754b138a986e7844521293a621a5a8c5a1b0bb18c921048a0f9826e2cb5004ff697f4b1fc2f64e66a4e27ff212e7c16e49aa2f2eb8b363c2827fa60f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112de8b6cea4964bff782cab7e88064b

SHA1
59cb436ad576b360148a34c6d5fb4d14c00981d1

SHA256
e47e1302817222115befe8143891251f278e18dbf3fa4eec0849233751d79962

SHA512
75bba07969dc87207d6c9a03f66f24a974a343cf46cce346efccc6497a3a71cb029b7c08c6ad0d0be3fb1a24c835b208c03a2d49f6b009c3fa63d631f4937b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af23426924a39da5f2a1c135f352c59

SHA1
2a0ff4989e0f7faaa7547039a4d5e6c0fd96edfe

SHA256
750a1cba335e2bf2d21c008a8536472cb9303361c8c7a6f401fbb878458dd602

SHA512
b8d13ea052f023acfbfa5244b649ee68592ecfed959f633e3d79cbfe287eb909a342463d527e5c5a6dbfb28499b11bcd1bfa5f61d57a72bb382937a994ecd4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3877aa02d52f5a5ee60d0df8df2fbb

SHA1
c787e229729f95403897d01fb9c07f7a5a14cb1a

SHA256
2716df3bba66b55ba8e04d7b315395c046e6a49c3eeef48312bf66d0bff93205

SHA512
e842c20108d08200843b03ebf4258da02776149bf072324bca221684ed34fe23e9a34d66233aa92168985e2e98cd90ba485ba40d57dfbab4ac9dccea8deaa418

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF6F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit