a000858b3ce969584f6959322eb65de17efde377f07c7bdd05c31e7e9215c23d

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e5754410ab8c12c1d218dec56d3f3c8_JaffaCakes118.html
Size

816B
MD5

2e5754410ab8c12c1d218dec56d3f3c8
SHA1

b8a5b5eb32fade37dd57ebd911748126d1e7c491
SHA256

a000858b3ce969584f6959322eb65de17efde377f07c7bdd05c31e7e9215c23d
SHA512

549eac68dfa3ff77808f27bf5a03963085a0f3d77d730325788d7fc0df9614d7a1189cde7e67a6fbdb849fa41cf61b06a64df14285c4b5ae8bbbdb39b1ba6a76

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421493417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{903314F1-0EAB-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1008	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1008	iexplore.exe
1008	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e5754410ab8c12c1d218dec56d3f3c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8c4fb30ebbb38ca770661e066fe8b9

SHA1
474c773743f6d4989a415c51d05e288ca1fa7d1f

SHA256
4287dffc7f41586d823cedf4168b6ffc66d351d63a50e6eaba85199719d8f1ea

SHA512
6210e88a4544d3d74da67cac87c517bea783aab8d25ca66f301889f9c9d007dc6dcc842d40279e8e5769d22845c634364da08c7ed5ff84fccf8410cc46935f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ad2be9c0bffc18743c6874fe741c6e2

SHA1
e5b465ab9bb87f216d82090ad4b25d3282fc5776

SHA256
97330dd2a5e32845bcae2773b73f5029b78daf2c9c7da6758df7a411a482f720

SHA512
d4a11b70c93196f65097e6f94367df7d11d72ef63e0ab96844732b0711845268f0290a0f7862d63268a17f4c6a865a113bb9464aa38b54ef5dcdfc4e797f38ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7444b2c11a565a9421762ac9382e2b7

SHA1
60274848e8da318dd25ad86c25d1fcf65f43c34e

SHA256
f8f18538290432dba3e22c7c047a398f20676eec86087e69452808e35b0136e1

SHA512
e59e4547c6aa5a6d8136a8da97231fa4994e812be84e2b08ad1a3dbafa1319ae866b2b23c58a78d1a21fd7dcfbd7ff1d53e0aba4deefca29a3af80e19b14a4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b33a665018200636b5641d1a27c75ead

SHA1
7f7ce58e3ff8725c45587fc0cdaf000fce4f898a

SHA256
c2cc48b0f301a4f3efad5caa47ebe04f6285a2d9a5b3db72e561f3447284dba5

SHA512
9235a72e4c7d19596eb35667277a3f5b1a0b1e21cf9fc5bffeba578e6a72c84bb7cdc97a9b58f2c0d6710fb5193bf70bf004c36e2ac88df89fe71748034ff2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
126ba0dcda9b1588a744be1497a5179e

SHA1
b59b13e2d6970f91cc0bef5d03cf92d807e87749

SHA256
981c5d101a67a40aa371b49b87f394228a60271726d5063ffa77efc8e0e18986

SHA512
0ef40beafaf7b06d01d7158f5fee58912a0835a4cfec0d9301d3a5cb139fbeaa95397cb7fabd5e640c88be2497aebc5ecd254d2d12ea05af44b9b714249dd9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a62ee8c6e48ac70f9e45d7b6b937ef

SHA1
8726913f397a90d984640f03d9dff7c3af05d744

SHA256
2d45e84422bebfbcea5e028f76fd4033f152e072bebf6c650753439cc997c07d

SHA512
1b2a4af7dc5c7d1fb5b026416917b0558e8e414f8e61978510706be64ed4dbb3dbc4fc63a08f814d0e9abd7c1b74d74069778634fe190fce8b3bef44d657da03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18bbb8862f2a627a73b80f84ec486628

SHA1
1c9f14bcb870db3cd8197c285043df9e67744cc8

SHA256
e3d064619702dea4d2af58588ee3b1d2edf43f8e2ee3f4d6c38326a09615fe5f

SHA512
3cda17455025d810f811a0f0c0c0641c066e7e1e2e74644aaa1a7c6caf2297d375c32ae7169535b68c9b39c2caa38760ae600219fd9acf22cc0626ec74eecb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9291a73b784e640521ab2f5272fe7515

SHA1
50ee02eb0760e2527fcb7036698fc7c797ac2b30

SHA256
ccc8bc3059c850a7d9a43b5e368823fc11fcc9fc8290d11ee488dbc987a45afc

SHA512
f8302338c7e63a22fc7e71a38f4a5822492d7d5cf47dd8d0be773d022778d2f3ce27695b75d6dac03096a8272a6183135a758822911b378ce648fa57ca3b1ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2cd252b5108b3591ea866325c9746f

SHA1
06592d415f607eaa9f1e2a98a6efec6744e6bf4e

SHA256
7304c8f6a40e05202406f47cd647bd7603dc0f851e10516a4873a08a4f203749

SHA512
1d6f31a964a92a0b04a6be503d342c8142c4fed2a7bb791c7737b51f3ec8000c89afb8b92a790c1fe916b0098ac3cb5d7046dda7bde8b7cb7e5a22f88fee53f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab485.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit