29bf47efb617996136c7da87c4d6fcc0c13ae8def8c3278814080c0d99b3fd2c

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2df0509576344f2c145d66d04c7e559d_JaffaCakes118.html
Size

19KB
MD5

2df0509576344f2c145d66d04c7e559d
SHA1

815f51d35f70d3afff21d31848ce14de212538a6
SHA256

29bf47efb617996136c7da87c4d6fcc0c13ae8def8c3278814080c0d99b3fd2c
SHA512

35d09a33b5e325f3489070047e565b415c8be09472ac1774976c9b4ccab618d502d05a1fd3e2a0abdefe1f3dcff71f5dc6cb5d1fdcd433bf75a8d58d6ae071d0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIt4tzUnjBh/R82qDB8:SIMd0I5nvHVsv/axDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421486726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB79ADB1-0E9B-11EF-9486-4AD8236FB259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1732	2208	iexplore.exe	28
PID 2208 wrote to memory of 1732	2208	iexplore.exe	28
PID 2208 wrote to memory of 1732	2208	iexplore.exe	28
PID 2208 wrote to memory of 1732	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2df0509576344f2c145d66d04c7e559d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b494f4443820d0e4b3f9f3fe9084835

SHA1
578410ce175fa9d8533232a107ca14eec641b8dd

SHA256
2522c0ecbe02dfd078c3ca627f4c4e7f1d38a0f913f2ffa7083c76c5c6753ccd

SHA512
850532873812fd8df2d3ecdffd4cee334327c79265e545da87864cf20063043c6bc1ef49d1b2d920b076f792f14c0addf674a44e59e7d5b8dbf25d9873a7bcb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee08362cec8867aa2fd82115fb9a70f

SHA1
45339895961e79d70e89a1ea0da51876299b1df0

SHA256
c8b4d22940e8c612ca191f79de438f645e2e70896055b71d6e925be17e9bd97d

SHA512
60da898dae3751dd269673bcc730ea6168aa2753e64694a6a3f5266217feb1ef6aa4bbd48f9e947065135c1a2eb17bd52fec54cf53701cda96b177bdaa355658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e1eada02b306829655317dd8d7d68a

SHA1
9d219c8ec724019668327d1570456ea9f2dda936

SHA256
7e970a15c43a1a7e42bb55f9824dce8aa3a78fa034c98bc2ee48f6f6e1062a26

SHA512
72a106672dada69d1445ead8ca5e03e2ab25930272981ecd5af48638ade3c8e24b9b6e85bf1e9057ee13e13d0d459b889b5b9517b8ce79f20f76d5b0b51980f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6792452e5a4d32d350b058d31578eb56

SHA1
f696d50ebcfbcea3a28bd3d12321d87d471c4bf7

SHA256
990661146dc9bd6cd0f707cbc5a184e31796db2f76808bf6b3f20750838811fd

SHA512
4fb8f169ce2597ebf7aea105fb2e59d0b4da047a22cb3f9987f71afdf07b1a38863587081b275cda4ec1e08af2b349674d32f7c74aa5e5c79c2c25d0b75d97df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a5b4a75c6fc13886dbbd6599e5bbb1

SHA1
572a347b330e98eef5551926a0f92e7d1a5c2c60

SHA256
fd75d091af3c7c730f700e13e3b4f96aca03b7ae4e5f348815d564bf26d3e030

SHA512
9457075abac034703721ad5a4912abcd8e80c78364f39482fdd4eabce4a44b17127cafb4dfd84dab30807d5f1f751d4561337beb0d23d457e4686b45c469e02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b4bcb0b7ae66b60a5aed07d9ed328ae

SHA1
7e0fd08ff33dcc8603d9665daf22df8d07260031

SHA256
dca77ab43bacb1463f2778901549050b61db21ecf8b831adbdb112f64a4f083b

SHA512
a9d427e5793d9ba2c08bf62ac9d119c96fd451becce0f2d99586a46180c37734952f0e07d454a47e1b65dfe9e15ce36c559fd3a0ea43eaebdf3d04e23d559e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
508c29235ce8dad3eef67982af6dcb03

SHA1
1348cba06ed26fb0d549fcde498448b09d8d8234

SHA256
347d9c157028cdab9becc4959af5af028a0fb2984ba0c496b5ed3d8949e062d7

SHA512
94faad6f378663b430bc576d32b8986c7eb60495ddd5bc9a9701272fec2a132e6258029426996947d2a2cc461cd9742b6409400b3fd53a1858204b2cdcb3dd07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D9E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E11.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit