b56853c37656740c662fce53a5b228f287006af70c2cb939ea1f9b56394a9f36

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30afeaeadefc92d8f6015581c1345101_JaffaCakes118.html
Size

37KB
MD5

30afeaeadefc92d8f6015581c1345101
SHA1

65dfb23cb1298270c35c65c8f4a9575082a2ec58
SHA256

b56853c37656740c662fce53a5b228f287006af70c2cb939ea1f9b56394a9f36
SHA512

bab02b561f69481a32e815f3b22ba1a0dd15c2c7c3b890d6a059493a7cf92890cbf28a8da0b11ac3ed47c01615a6dc5aadd651704b425536b236b3f5c0bd2231
SSDEEP

768:F/bVFRFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a9i6t81DdRA4vEOjq6h8q:xRFQW81D4RA+vEOjz6raA7Iaog81DdRv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DD004E1-0F04-11EF-A9A6-4658C477BD5D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421531476"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2604	1728	iexplore.exe	28
PID 1728 wrote to memory of 2604	1728	iexplore.exe	28
PID 1728 wrote to memory of 2604	1728	iexplore.exe	28
PID 1728 wrote to memory of 2604	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30afeaeadefc92d8f6015581c1345101_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd6aacd4e4d5269c716ed939bf228bd

SHA1
ccd628d52acd46bfc357b9aa7ad606e323908522

SHA256
0ff4101787a6243a4f43ee09cb20ba43945f45b718d3743175cd81f18b8b273e

SHA512
ce2f85cfafe38a1c106d4d79dc2d8db4e69f5e2bdd6bc3c3fbe76a43e22d11d914293f1bc0243b678f545a6f2b7af54bec8dab132008e2bf894b0e38718f8fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e44e69e75fe4c9eb58645e275dbe3b99

SHA1
babc154f9cabb515eaeb3bac4ed20721f112b86f

SHA256
df8558fbc1e4c809d5052bee50d21778ed84f46306a015ae220f9781e4ea37b0

SHA512
8ad84c6f561a0d181feb4ba54b6a845a08b24b9d42182d93d0af84c1e589376fd6d3a5f21f930a0343d4e82c6ce4d3a1e55e6c614c9b18b5eb2e08867049c304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5060ab38663868a941dbde126517d22a

SHA1
f0dadefd8a4041bf0d9329273b3375da6ef0da5d

SHA256
21a2fe7cf3788c171c4ba96b4b228fd43a1c48b41c06691f40b325a79436026b

SHA512
3b97854c463c96d79619aaf977a174e161c54e4508fdd6f3ba3ba4690323423144ccf36e3f735fe3d5539c22da1e48e7fca8fc4158d73d01e1b6ce0d09d02740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0b4e4a356e25319f42c9a19c1fa994f

SHA1
8df771ade00bb58442f03c47a90685eaef30fb6d

SHA256
ad8138d1437ce262bd7a1ace4c70b69055889fd76b06d7d7a632ad527dc9d2c3

SHA512
f1aa78ab1f3f435dff55201f10319585fbd0db43f9194cf6d00776adad60d9adfd4618406394b3b733b4257b8665c2373bf1d7eb6dc3c4b2ff50119abcec601c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79816686f446727ab08be01dd733dbc8

SHA1
5524f6f004270623f7c4eaf46e49c98f58749d42

SHA256
74859228a18b506d9dc5f5a847b6906e9e09e7650b356c3b1c4daef8d1c45c62

SHA512
818d76f61a01247c36b9e1493355d224a45b08929a1f38781d6152dd0c22f5a629fdf46f9447f1146cad950bce9d0c69562ee4a8b3490368f85b53183e09f692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d27e827e0afcecbf8c7271e9d93b3d3c

SHA1
d15b72201759f96ee3a24ff04b8811dc40a3e7e6

SHA256
81da47869e2229c13c9d85541ce9cb0677992e6a6cb01da18e66378039d520f5

SHA512
cff8de2b9ff5028226ab32aa671432e2be804c9131486e60b3044e1be16ec363383f2a44f4f366feb2cc02c8eb49c8c99fcb603ec9b5a9fc855ddbfca12ae3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9c32d1fce0dfeb2d48875b4902ae791

SHA1
ad2128e969c3c26905d0f6aaf3869e2479ac391f

SHA256
0c55ad526febf588f01773a6f823fd38a275a599442718898d962c2dffb2ac58

SHA512
fdf0eac1bc5289cb77f9b20ef8a95099bb94c6f64850cda061672fbbf5bf05d113a32e396fa6432b11c266a9f97655a9e1f06e3d18375e8de3b0cc43aa14e019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
673e90175caf67bc4c811ce4001424ac

SHA1
c34ccaf315ff44bcc8aede8ea9968dccdbc30780

SHA256
d4de82652bef627c61f1022c760e148f0446c8b87c493edf70c1fc954597467a

SHA512
d9536495b0527f1800d4f6e2c594d379902b62c7dd52b6cb3650fc85eb31a5ba63272ac5d0be84bab0aac46e637757a08a7518260d3cae0f96c800f41448e7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52bcc56895e06b9ddaf9c449c2ffd326

SHA1
a290a09dac49886a5355dc50734a8c0b3ac5e7e3

SHA256
eb426098a280b3a574234f73a68bccc9c880132cb6fbb8847493e369d447ab17

SHA512
a8651df5d971ba38bc756cbe4dd4b4edc871bf2d334fc5400a22572718aa1868d22154ccd0e044cbafaab96dbb03bee1728248871c6cf49794fe56834ab65619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7a49f32d643bb9c048464f8963f19d

SHA1
bab7258760f096f5f93ac2f7f4bdb8cdd8aa6395

SHA256
f5ca53080af43089990fc288c9d98c2c09a83d16c5bcad10881afb1479cbf7bd

SHA512
757d9774dab2344ae0e60350aced5f7413a604f218b7e3dfdbc3fc0b8e53a652d5fb20c059d10184ff06fc57dc8e2862c14d78501cf61b12c758168e3ee099c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab209B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar209D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit