1253cc70aa121853c609dc415d0d6ff4818d11d688de85e71c16d7bbb3ee838d

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30186b4ba3f2edc28b73e1dd3e2d7c90_JaffaCakes118.html
Size

120KB
MD5

30186b4ba3f2edc28b73e1dd3e2d7c90
SHA1

ecceb05432b14978e27553265e8041b2ce546060
SHA256

1253cc70aa121853c609dc415d0d6ff4818d11d688de85e71c16d7bbb3ee838d
SHA512

d7e1a0fdec98561670bf0dca739a989c2b791313a466bb5131ffecb69c384453de119abbff4163af2ad51212b5b87f905b81ab64b748c744733de15bc7495fa1
SSDEEP

1536:SOJLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCY:SKLyfkMY+BES09JXAnyrZalI+Yu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DB36EA1-0EED-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421521733"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1296	1548	iexplore.exe	28
PID 1548 wrote to memory of 1296	1548	iexplore.exe	28
PID 1548 wrote to memory of 1296	1548	iexplore.exe	28
PID 1548 wrote to memory of 1296	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30186b4ba3f2edc28b73e1dd3e2d7c90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b50d00bb983a6f72d1cdb56d4240d6e

SHA1
436ff56bc3f8a63e4534d84cce98546a76b25075

SHA256
e79b3c5b812c559c91423a6d8cb1eb1c86d07ef3497cd5511ad7423fd93b0dc5

SHA512
b2516dec405bd07231ca428e0ef9c1a9de282a2cb86113e69e7d0403e3889b8bebbff154502393da82b54445ea0693440d0dfc4ea4a78127ff0e572422d093dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c1262111cb784d70b1285e29d43713

SHA1
60510322841fe9d0d12bc89c41e4c80c441628bf

SHA256
cbad7bca3ce0b6a39dfd9c0a99cb54b695a1af70873e16ecbd5c17cfad6aaacd

SHA512
c96817e09579f0704f8170c766b5cda60e329fc2ff4685ad366c2581cfec7adf5bba83fc77fead750f8ddce3c4555c0ae70b93f134d9fac8660800de57f62990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7be9c0df77324f7e5f210d5d96ee02b9

SHA1
3f86ec370dc98e49c1df0e74ac86a1da01f343a3

SHA256
ac9418dce404bac552513771c18d39a9bc610ddc499b99780537b0bbaf0bee5f

SHA512
8f211fe01b089d291cdf9fb64d115d0c0e5d2c01c45bf49988990f9c217187917f9c89f1b4b4476b77397d84a1bd131108efa624a1618ba68520e697c02a78cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22713cd374a5c56e8e571d4b815f289a

SHA1
51cd44ba6f9bdcef0dfcf3b59a40dbb3ae695f3e

SHA256
f587337d08b59beb91899dd56c2a108f072f418d2083d41fedffbb7be5849f83

SHA512
87ee8cfc91acab6a83582903f0d9b6740da2f19ff8a53719be6b12b8cbab9ecc482f8a6fe5d33c9954007e3dedb5e54564acb78ae0e67820e49835423e843a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b47a44e47579646843e2b0e03bc6754

SHA1
e7895e0573fd6043a04f9715ff47918d0724703f

SHA256
cca2a37661c0bab5a16afbccf8a2221a1cf72dc0ba4e496f73294e9378067cc2

SHA512
73f365423ca04dfe05e67b2f7eb2476bf47aa9ec7f4701cd8d0dcb23594231096f5670129d7d3bd15eb428723bbaa8cd10824861b5f59b357e2216be7b62e760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20797aa8ce7c9ccbd80b592ddbb9e740

SHA1
c2179e318d926cf4c31bb1c41376233e889569a7

SHA256
761cf8910a2007fd3f079de1d71ecb151ca98d83e54dd6a6ac93120208033c2b

SHA512
eb4d8e4a02a9e537c01efc1945e9761cbd0f1af2159afe2eba7e314df95ecce674b8e74f1befe6ca87ed7c077c75f6fefcaa09d3f6f1b2d031f09736cd89afb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e769834402b954ddc0d6f650e8d6a8f

SHA1
6c7e1357f3866ec377f153f1ec47ea111eff6fd4

SHA256
88062939cf1b64bbf68d8186d29480acce7ec1f03f28e0516df45c5f7bfd2ede

SHA512
63726c4714291d2c1995df9432ee6a8a4bb0645c66c204788ac0809ab4d1633a4a8bfebc9ee29b379c1ede249bb1d414c90b790cad05f842432824ec2bab6dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abe85e0b04d81ac6526395fd7c2ba339

SHA1
4dde5f160d4601b70daa1052f25596eeb6763242

SHA256
2885db10eb1583f2bae194d0b152b695f07e2390f7ae5e824bc933a6fcf61470

SHA512
180a0f8b378e40e0cc647a35b175ca376fc93b2d623ce36ffeed1557029b710b40cdf38ec5c156851ce51dd75ff738a8223f1e9ae603bb438695bd673f6c6c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c68a779843e35f08212e64d0ca597f7

SHA1
a2142236fb93a34ab093cab4bb77159bb7517f27

SHA256
9a4be6da378da3a4d5bbfbb02c03b1723ea1171a4b1faeba983c7057b386178c

SHA512
8b7d5697dfec765ef52f98bf3c96dbc49f37636a6dcaea96f21102be9d5a6b6638380af51b60815950df89e49d412f4f76b76bc41d6d260a779919ea539d739d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7BB6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CB8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit