e79a7cf04c818b3b93d0fa4cd9ddf46164a738ff3ac8601d7acef452312a0fce

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e3d78e6cda27fcb44d0812cee5e8e10_JaffaCakes118.html
Size

23KB
MD5

2e3d78e6cda27fcb44d0812cee5e8e10
SHA1

ab194a93f7d034155152e0e3102738d765096e1c
SHA256

e79a7cf04c818b3b93d0fa4cd9ddf46164a738ff3ac8601d7acef452312a0fce
SHA512

a2fc32c7812ae3036cf54fd336513ff480c85369683570ec864b78f73407d68e1975ead09a06076162857a3202c0d15ed19cbf111d78b0ce7b9b4c16d6257cda
SSDEEP

384:higBNLTPTW/TTpCF4ytXTjqNuvNeOeHcEv+9WQjG9BMDYqaz0qwMk5nPTemO8hfL:higBNLTroTToF4ytXTjqUvIOscEv+8Qp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421491817"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D71CE891-0EA7-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2556	3028	iexplore.exe	28
PID 3028 wrote to memory of 2556	3028	iexplore.exe	28
PID 3028 wrote to memory of 2556	3028	iexplore.exe	28
PID 3028 wrote to memory of 2556	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e3d78e6cda27fcb44d0812cee5e8e10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d22a9df630192629953b9e90977f44

SHA1
07c5fc17aabd09e48c580b072b6f713f3c9162b4

SHA256
9701b8a16cf64def43a961902a1bc4ee90200f9d90518c6dc04e04dcbcedbfba

SHA512
4f4d6d934a63666002114d11ac97fecb773da76de399feebedcbdd7a206b710f16fb8988a94a62cc5c003df100ac373765a82f77b13b3b9bc5ad338d086de942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3953a506250e03d512ff1ad8fdaacf87

SHA1
2e7958522122476584d69408756bad36607045d7

SHA256
139749e746bfaa87d397a5e2c6af8b4218094fdaf42b1cca6173e640f407216c

SHA512
206ef5b469b058a582d772def3ec0b24a76cd28fa1ef46d9f5653d12c5e2a8eb8ad43fd5a33cd967750bc11e2411a1cb61a679b0d32e6c3e848d2a5d262f50f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3582c6ffc03c8270cbbcd081fa0b51c4

SHA1
ebe045cc27b8eeabb4e923a15086abf8d215474b

SHA256
2cd41cb6b1c0d8868d87421219efbfbb396e6b1bede676c2d5141b775a34af46

SHA512
4c349769b9cc16a5c662f9fbb73b875eb6eb596e086627d37478d6240c2b40319ac9b7feb177d122827c80309600c3cb0ac40700e1435a2bc865e2eb750ccd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb310581528396f388c569e62430af45

SHA1
0acad79c80872a4e8b2753c127fbe9b63fce78c0

SHA256
b3ef97c565a71c49a5a5b4e11d48a27000babd34a7b86e90d8f932f358fbe1a6

SHA512
f7cb841843d497df5a11a1f9ec59155fac45dae43db22f0e37cf719d633aa30994cd212553146ea97a7e9f08d3e78b9a49c2ae383dfb26465e21c76981c22c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0269114db2dc9e9d24f84bdad1807f42

SHA1
c1cabc414906047b7f6b9c67c6605c96f9311d6e

SHA256
cade10e70e9b2176d77add278b028ac53097595d12d61a2e6239970b8917863c

SHA512
c2680a640f6c3f2d2afb66b5678cae9d3478f932a02fefb2a4751f577d828c101c897a07ce8c650c16e29c9f8330cf947f0eae285bde0060e5220531c043c407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d398360ab9f1cb91ed9e95fd4cf3a071

SHA1
51183a157b18c9ab77eb2658ea7ae28226098cc0

SHA256
574aa83bf364f582a7a31f20e491b80afcfef0c1ac9c03aca921f9bfa5dd0c9f

SHA512
718b270e3c381a4e7286295da057586db5e874b25c435d81dc3eec28dc930967df3e92d7f53a8fcef70d3b2f01921ebf609fe871c2ff09e208ddc067023e97b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b4a296f9b5d4b24b6b692f753db57e0

SHA1
a5e765ef2f27531444dfbb54b7ab5c859c6133dc

SHA256
2aff4737e892f7f4b8627d47e439f859bbc0b3ffbbc15acafd622801f9ed4be5

SHA512
f70f37aa0470fb7c57e62c8e3a08f879c2190756188b1ae74da27b3eebe9e26b879422c65afea541e488258ca70dbb2f8612a66893612e6ab65483ed9ee62599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
079a6531273b5da1167a078121e3fdcd

SHA1
90d6532e8c664369568924a39822dc27bb38763f

SHA256
4af70db9cc04e6221b2cea3bb4b13ca60d8322c11a041153fdcfab1b4ce21a1c

SHA512
71d2cf10bbc1c5e1bf63b3fd7a1806e6fab375f5f031a70d86d0909447840edccd5ec4faac5b4405221f6876feebdaff0a730c8da9aceea29c9a2f963209c347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81dbcde828a1bc87f548917117199461

SHA1
4e1190ff8b37d27e0b65b48ae5bd25cfdaf0b05b

SHA256
1a7e93220462b0dc15e55c656aab64423687a7e27bb60101b968f9e634f5a90c

SHA512
2c9f947ec6e8b135e8460db4185d9a6338796594510c3f2ef2a010199b4d54bc2437b6d46025f1970e9075cba4fb651cefdc8f2ca42eeb090ec4cabb4b2cd599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba1576985807e515d45163bc990408f

SHA1
9e5b80ebb8c9834e37419058f2b36f3d571bcf73

SHA256
e0354c8f81761d1662fbe155afa2991be6d034e8673c54c069d7743dbb06d4cc

SHA512
9e08ec3e5db756828219f23d17ca186aab664e224c96745bd94482a8c9a3ec583273343fb5918e899ab2a02b27b372200bbe395b25bc1fdaab1336a24250b999

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar128C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit