e05d362ed33a0b4790da32fb12148a70cd224583eabe2d5df09565ae5c1e5a94

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dbc32de62d1e60464454e6dc2ba91ec_JaffaCakes118.html
Size

20KB
MD5

2dbc32de62d1e60464454e6dc2ba91ec
SHA1

51bc907d794377f534287f359027ad81b3c3be93
SHA256

e05d362ed33a0b4790da32fb12148a70cd224583eabe2d5df09565ae5c1e5a94
SHA512

49795d47d627e6019eb482bda97781c1bd8e80597e37c1a83ed2a33cf5f03982defcea884de9ded14fbbe9bf5012002b7d21a9c03663df5ba3b523462499d075
SSDEEP

384:STpPIAZ6EeVYR8e0eeVveGeQsbevgeVOef1GwJx/fwm4RStDthAJ:SxZ6EeiR8e0eeBeGeQKevgeMefH/fl41

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421483399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CFEF041-0E94-11EF-B411-768C8F534424} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
768	IEXPLORE.EXE
768	IEXPLORE.EXE
768	IEXPLORE.EXE
768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 768	2240	iexplore.exe	28
PID 2240 wrote to memory of 768	2240	iexplore.exe	28
PID 2240 wrote to memory of 768	2240	iexplore.exe	28
PID 2240 wrote to memory of 768	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dbc32de62d1e60464454e6dc2ba91ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
179b83ba39fb2890332bc514afaff2f0

SHA1
5b1ff07ab023ac2db9c917ff6ef52cc6f674e1fd

SHA256
e4a7d2e1d58dd5cb0fed90e3adce9c299cf54a66e0e5033e57a6e291995886ce

SHA512
db2fffa04048d96448ed7131db99b3ae7d8a1e1bef9a6318b472d8287b14e007caaa146677258591796528ba56697cea4342a2db29a80b8002676cac40dd1ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e28cd38b33950acbe03fff17f257c3c0

SHA1
614f8610db58add96142a211b37afd8bf1913b0e

SHA256
ba62a142ac563e233e7fd2be6055602f7fef878a43e61412dbc2d35d62c0d70b

SHA512
2e3eecdde0b08621e825d5ca4480850ca2c7a523fc139d4c1ea6244c6a6e269253f92ae1f8c6b5c127b324945c8ede36d26b03f1098b36f30f9909cad3e87478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ad9f060f4fb97495bbdea72aeb245c4a

SHA1
8c9960e221cb56cf68f0d0e4423e32a3cdd2aca1

SHA256
f11539a1d73923e78e645d1b17335e0ce2bddd9f66ab6841cedb1323cc3547fe

SHA512
3833ee335d7c21616029abad655fdfa2d1bd76e09e4515846c7d9ca2c5c893dc2d52fbeda77a57d7625b15561bf14fc99fc952d6890028fa01adcef6855ab308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
512b2995d0c9fa6f35ebf263617a7885

SHA1
ef5c746fdafd4e6bea1f33df43f3398d0b1c10cd

SHA256
e5149bbf78d710773276730e87117c1608c9f853eb45f7efd80ff78242fa9257

SHA512
97ecf96bacc0354ad5d37445a73aa1b585202a6a9f8977f090a22dfa5df0c157411272b05043c24a5a66b9bfcf9ee5e08d52deaf3e3baa808e0cc6fac3ecbc98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8cc99ac7913f640de64fbef2caac2003

SHA1
fb936192ec39fefdcd7d2e2b005f73d8f15400c5

SHA256
e0e5cdcfa31cae4dc3e2759df7204f84e827b7780f2613962885c8d8a047e4ad

SHA512
7d654fa86eb8f291c9ab70f2521bd61e2b46e8359c85f24adbe8a77822f4ba21faedac23449ddb9b832430eb8db4bf3fab61298807d5e7144b842be533041817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed0160f5f3438669713dd782cdc6d5ad

SHA1
60b5541cb23ba670c7d8e4e78d2ce9bf550a2b42

SHA256
92bbdfa59a97b2c0e069aeba37783b35d42d4da3d3e5ca31d97349c76351cc74

SHA512
6297bc066ce43d0129503fb2773f01278db154b7d860868ef8404c84628f2f5faefdf4b8ecb58ed65cc54f4e12688a9ad23bcd7d83abece54a1fd3772d77a3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
362bf146e8d9529db039287ecd66e24a

SHA1
e0a5c50bd17e2994dd6fed4c9c22c08cbb664ff4

SHA256
1a5a00ddf74275b8931cf2c28e4df3316b878372b8bd381ed8f25f912d46c4f7

SHA512
e122cd4c23ba17c3350b6aac853d5e675f4c5a73c8747ba37706702f24ddca1a7baf35998eaf40405801f56096e2aa1f928205b90d4dc34698fc1fa9603e22af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
81ad4d7cb8aeef8e784425bb92b938b5

SHA1
d486ace810b61eb88a93b30809f9560d434dfcb7

SHA256
08bac4a227346b5e719da7d76f3d914b282154262c2229376411c7f57c20725b

SHA512
381afcaf359bd60dc70301fc13485f2d8c0a780007c63f1746482ef8aebdf2a95b231268d1bc9fc83845d7c547a37df29aa796fb912f73dcc52394c76725d134

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE36.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit