f0c560ee17858c15e08150d9b8509fb47f0672d82d8236d6996888f7c101433b

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bad3d9627ecdd1c5c5d6240da7a4873_JaffaCakes118.html
Size

18KB
MD5

2bad3d9627ecdd1c5c5d6240da7a4873
SHA1

009b7722c58552ff41cbae84022b6c14f146adf2
SHA256

f0c560ee17858c15e08150d9b8509fb47f0672d82d8236d6996888f7c101433b
SHA512

c9947053e88d92b801e499428e19185f564be94122f5c9cd7ab532ee2d0d58d1fc7e8f3d42174fd96cbce15edf5b9a604aba0b430986b7c3db373a649114d314
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIr4ZzUnjBhbd82qDB8:SIMd0I5nvH1svbGxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB9C0361-0E46-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421450217"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1800	2052	iexplore.exe	28
PID 2052 wrote to memory of 1800	2052	iexplore.exe	28
PID 2052 wrote to memory of 1800	2052	iexplore.exe	28
PID 2052 wrote to memory of 1800	2052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bad3d9627ecdd1c5c5d6240da7a4873_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775cc20811c8cbe9d0ea4af300ee1b51

SHA1
16cd96d0cdc4c7355363602115ab524ca1e7a746

SHA256
1bcf1497018a6d2758575723598b07e01b8fa3804bab22da8f8a676fae8f94bb

SHA512
af6de29e6919517ac9c4d32b5ee14d7658fb8106671782422d41184c656e21afafd0e3defdf220f5051b73e3fb8fb96d40b0403d4cb9846dad80cb16e7d4d85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8a50652772e55aba0a6cdc685b4e48

SHA1
a06eeb48e03318c400191faba2770dd17d7ea8fc

SHA256
ad86df7a150758130599f98fae7ca4280c454e14d68807522dbde21f5e6e4f1e

SHA512
a8a1ef9b7ef0251d894941a6fcb8c251f7349841eada0bffcafdd64c87f6b74e22898efbb65aac72c39096229f7df78543c1456dd2e9e305158dc7920e65f57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed3616abe49b3218c9ef75ae8b7bc502

SHA1
fb415dbd806edd1a1048a2daf5170beb6603e3fe

SHA256
621650e2da049a1a053764b2313e1baf33eab2ee1ea8ade9e5361a028f38e25c

SHA512
bcd699e9a6278439db975c5e68f620f55d6b134b4f8aed052af9b0430cac41934ca02386e9d7f07dc37d2151ad8fc146e7b2413af60e80b1384e19e6f8107474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e936cb6d16f0e6c248b5ec900807990

SHA1
7f3fd5bfd652db9aa286d3378afd698e6b0ef55a

SHA256
e37072086d04d4869a6ca17e08f7ebc73cf49de263f0f4fd2955f5ee96a7f0e6

SHA512
da8233e8cf03baa072b9a6acc79712520d477abdbfabf7f7a745089e7e1e3a282b7d1322d8547f14266ffb0a3c97138129873070c8dfa3736bad4591e17b701a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d521a98ecc093704313e5217ea5660c8

SHA1
0e2616d663d6b9841444e27b0b2603fbb078c311

SHA256
fd45c4b08966342829d37d0deb23747ef81202bfed714c994a5ea4e626066581

SHA512
ac321f0d4f1ced4fe756371d101dc8f9f35a28ab5d3091c66debfdf2227d2f5931024ddd6b933310144371aadc97f725d724ea882f075da733a9c338967ffec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3eea515691fe2edc4ff17f14965735

SHA1
f5c409f2f85610cae38b4ab7549ccecf2ac29d7a

SHA256
b73f4509dd92db3cf82a9c8e38aefffc4cbd4116dd3e4cfdfd3bac09c4ed89c8

SHA512
4eb088acba16f4764f950a0d7d1b3ebb461e78a692b186a288a4c10cf565472bb3958e8006a842e37bf79dc55b8bdef3e8be9375543f11d7616e2967780d651f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f96d3894c22d511baa265f3bedf1bb0

SHA1
70e701f667e65a97f840e8f493a70b9857b08947

SHA256
9bcb49635f761ed006458e20470142ed5acdc980db7382caa9b543151357cdd3

SHA512
250a14f3ffde56b96f47dddba9fc447eef10545c2c85311bea45827f31f5d2941f1623d3faa68ad4d1fe1593e8d0ea0dea3f0c93a808d2d882ccda46dc04cd59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2adc49da5779b09f118f1b0bae69b8b3

SHA1
4b9090f8388045e587b2401b8cc6e8a18038ea93

SHA256
78573726db98121cc3b1584f1700f24a9d27e75dd1b9c5c672a7eccdde41b2ce

SHA512
daaf1f0725afca5cd7258c8b0f52ee5e9cd843971bad95464c378c142d15c7b79e56a418e0cdecf6cbd2b6e26afb5a17d302a3a96e8e418ab42b91b007bd91c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195e33133a2e73bae4af73264d0bbd2f

SHA1
d1d3d1443bc5b00ea3d442260381566278d88d37

SHA256
dabb98ec7a8f2164a1f1b77a81bbddb8a67b49339d8299dd6c73583eaab830a1

SHA512
4ed1dd3b58805b9c3c748282ac2224b79b21f975a7185245e9d082ddba968c76d8784fb7f4fc92448d3242dbb751d866ac72db6200c730c737c14dbee741f2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB68.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit