1548e61112117558d0ae2048f7d64cad5b08e363e945c8e079696c4704c5b1fe

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dbac5f6824537d7457f3895d5104a4e_JaffaCakes118.html
Size

18KB
MD5

2dbac5f6824537d7457f3895d5104a4e
SHA1

77f50d00f9d73b31d6e2b413a97ca5158947be21
SHA256

1548e61112117558d0ae2048f7d64cad5b08e363e945c8e079696c4704c5b1fe
SHA512

177e75f2960beed0bb87831f0b4727d7a34cb04b927910eda821c0d6cd824ad47e2de883822ec54288469c9a286bba59bf426879ef8035f84420d0b0a8859d9f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAGI4vzUnjBhZz82qDB8:SIMd0I5nvHYsvZoxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CD72851-0E94-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421483345"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2604	2740	iexplore.exe	28
PID 2740 wrote to memory of 2604	2740	iexplore.exe	28
PID 2740 wrote to memory of 2604	2740	iexplore.exe	28
PID 2740 wrote to memory of 2604	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dbac5f6824537d7457f3895d5104a4e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13f2f4e58e80da57bdd8d2a56a80b543

SHA1
39c38525a8bc5d8e853c544bfc65afd551a4d4b9

SHA256
c418168b967bce3a4304bbd1c0e99ae338f29f0085f29d91e7c7748e0947d3e1

SHA512
9859da2066ab6bed21fadc34ae58d00c5c21df7b77cad9830b38518ab46270ea6cf704637c3288d656cb52d5af3ba53bda50c4df7ba2b7f310c7f961ea3c9a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3a44c66d7d42c24446542c90f98076

SHA1
9b7731c611a48f7c8b962286add6a4428f1373fc

SHA256
2c4da99ab0fbc27d708a616349ebec95db97df7baddfa28387ba60820801dcbd

SHA512
817d20350b4ba2670bc9a3e9ae8b955070d2f26919ada08de054acb55a73c6cb98a9fc963d179bdf2ce89ed80b92cb85c0f820b7dcad9e93f3f95bd2abb1d25d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
746d55959bf92b982871f00ae4a5ad0e

SHA1
04d48ec6af63fa6a34c027530058a28cba1b5628

SHA256
6d5d555afb93bc5ed8dc9afeefdf35718701d2024756719d580945ea27783602

SHA512
256e65a02552219f70a836792c56741383d39799c4fc02cfcb5290e49afbfe91c60a66d8bf134d769aa9a1a77bd82f869713c409cb2b4e74f826d3cffccc1bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7137d5ce8acf33824367e95a97241b0

SHA1
a51d0f06612cf3cbc699a996426fb0615290a01b

SHA256
97f9f7b996f5e468f7742027ec753ac385feadc156ce4066ad3f2b11b344ace2

SHA512
76c3499b4e33799d7b4ee988531cd892257ffec04e91634b6ac334f5d7cb1023cc064f651dff20962e79416620374d3b785f591368b2be908f0e752c9ceb84e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67afc4599f62d4a769302c5d47950477

SHA1
30a82acec6fd4ad3d1411763350c7b71c81db042

SHA256
195447d3de063ef8f97dbb77e8f464e2d27f1dfa9eb213dbc68b3fb90710779e

SHA512
334b36eab8286a5c2e524abcd6809543b17cc9468ee9bef2d2485fa6942dc06cb2be70a27950cfbac6d17341dbb51f512900f4aaa7e1178b631e9d8e04d1ac4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
122a0361500a5b3bb0bcea21b49f995b

SHA1
6fb5b253d2b366d6db97b50b6135d76124aac67b

SHA256
6e4fc3b5d11635e13ca7cb44996d3528e604ac1c51c32c7c975b5dcc3979b8ef

SHA512
c2fc596894989c72a334ef781cb17d855853fc40f161970959e9d0c8bd32efe9d0d5850d6177578d76990567ffd34fcacdeab46be0f2626514333e0bb798d6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b1945226718ec8385e03801e8abc894

SHA1
8221863d92b616676160dce1c21d4637c98bd35f

SHA256
028bded774de9db65e4e16df97e7769c546b8408c2765d27a32b18b5ab5b38ae

SHA512
ecc90c5511f74d7102b20e9d9a5d0b699b7f055afcbf926dc5a26bbb0e98e671634a96322c648e95b1832c80be351e496ea043858c6eba610da514d57306cce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd179f61334e5b0970e0654df668730

SHA1
ee5d1429bbc79b9424f1fb4af02ed2d221aaac99

SHA256
ed561399b21f67f974ba6ce24a895e0cf89863a4e426654bcfee050bc3333c7e

SHA512
5fcc8d38b44f494f7bb4f50d95b949cb71e86d56374249cc3616bb1ee08d400a4aada773f800bb33b465e438ba891c545b02ff24ba0974ede58bc6177c39c8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcd930c9aaa7e7571e4abc8f2df6d5e0

SHA1
80ccfdf72e5eee781f9983022f24c094f603636f

SHA256
6c81bf4627280ea919f0268a5bcea7f20b263e587d5a4645395078aff983296b

SHA512
03c6659a62b3666ed55e08e4729acf97854826d7bf33c7f6d1e5a4350cc46c1b41f911b0619b0f13ba68935cdc201b031d98a5cedc4993b90c6d0c6e9be3fb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF10.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF61.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit