c18724725c6f2e5682221c2f18e78b5fdedb0ce6e879f2f1fcec18de46f1d7af

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30bcbcb4c90499cf536b5b506675eec3_JaffaCakes118.html
Size

36KB
MD5

30bcbcb4c90499cf536b5b506675eec3
SHA1

2a869ee0b8f22ea7812105609c384682271e66d7
SHA256

c18724725c6f2e5682221c2f18e78b5fdedb0ce6e879f2f1fcec18de46f1d7af
SHA512

bbc07833c17b3e499e29bb71e4199315439933a6a348497f409f7e82ae86e99b5dcf2f79bebee716e45179961f9601e3f2d9119a9475a3545ea4438851143e2c
SSDEEP

768:A4FQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34aUi6781DdRA4vEOjq6h8aRlR3:7FQW81D4RA+vEOjz6raA7IaTC81DdRAW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421532198"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB7B1341-0F05-11EF-86BF-CE57F181EBEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2064	2792	iexplore.exe	28
PID 2792 wrote to memory of 2064	2792	iexplore.exe	28
PID 2792 wrote to memory of 2064	2792	iexplore.exe	28
PID 2792 wrote to memory of 2064	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30bcbcb4c90499cf536b5b506675eec3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08fd2b55fac1c5502171d52c5ad02cb8

SHA1
b90a0ec97deb359b498bceec788f8bef4267561b

SHA256
8096c842fadabf882346e657e2baa6e7304c2b4db4282a5cf0906a3620197869

SHA512
3bcaff0395ccd02d0216e3248e6f3d2c4f00b0c190f729607aa22f6cbc65d824f6694f4783b8432da2ba902d4b60bb200ce1c3ecc88d943c79fd2b298e857f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc30b1b26108f156087411b02f0558c5

SHA1
76a5a5daac99afd6818adfc5e7ab77399efa8f50

SHA256
a85131a32b9a996a8f97d425429489ae4d8223b6b948eebb5a29fee33ebd0327

SHA512
1338c2ce9f27fbd2d258576e2bc892d9277c2e28c3263251d613a57617ad695c85e65e6c98a72c08e6cc12fd05191e08cc7b2670f0672009b31f07069d34e9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
550e031e67417f3e121b4f0cc4321819

SHA1
5c8517dcd8a9bdc20559daf552bb7ad3f6325869

SHA256
8e5360d56e7ae5bec66245cb9f185cc37ca9c745e46275eff9efc27e651cae7f

SHA512
c46478dc3567c08a34627c7280c1fa204452c3ebcf1fd9002f4e6e56620764990d61b9835a645f4065c70943fd2c1c66ad65c8591e1dea2ac496775ce61c699a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c565735af3e744f2591925eb2396ac94

SHA1
321de1e3c24f98d9096a43e65a3a97c83e2a690f

SHA256
c676fb4e939c2c7b37e4ad86cdc537c51cf9b78352f11c59e01e9e949e849724

SHA512
f2a086b2ded8a8f9318e6ae60a26f2835504a64e0c0474db1fb9965b5de882b3a58959cd40032cbaa72c891f894d375e109a08abff670bbdb3886a687d7eb6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2683e1ea8e32e93adad0d97ea24fc190

SHA1
8699921763d659e1691b68b7cb07b945801b2ce5

SHA256
2be96037a8405c0b0b911bdc9746ef61b0b72518e1f1b033aaf18edeca885ace

SHA512
f00510bb71c119f96430ff2aee45216d9cb25e3e642e1304f30253f85fcbf80516bdb173e336d25f2fdbea7db49d4da17646d7387c1b86d47d5dadba5f020020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960f240739611199b8c893bacb9f800e

SHA1
e0aaf7832c15ee03b5bc1f10435aaedb2d0d4ac8

SHA256
230593ad151d02cd34b24eb9f3ce572b8c17402195453452bd75f6acf6124acc

SHA512
d2c38da8d12be34781b289558006426fb679083ce1bc1914b91d637db0f40f2ade265bc2bbb342c8ea5b28ca092b461f7e0a8cb3068c02c21a6d58f88bd0de12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f76c317f11e50a5130e393e2ec4deebf

SHA1
f9773e232a26eb2246db3e61d135776b6c03fc70

SHA256
f986a4f5b3d4eb275e042cafdb27878bb039881aa53d995fdc63f6fab1ab254b

SHA512
691ab78b4db7fe6d8afdd72b7ca778f6a076aecf7cc633e6d7ee575a6f34fe3ee1a122f5d5972ee400da46cc8c01aa8fda7dfb0ddbb9ead722d923976b3ffef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82f873891de20766e174100fe9cfe637

SHA1
6a3ede35694d4eb35278a90a18c596b4f3cb4b1d

SHA256
8ec40e0759aad219b9052f28a8d51e613acbf8f919ab6e3fe7ab7d1383befdf3

SHA512
b7133ccf9bd487e05bacadd19152585b99a95cd124f9f172c3912548ec244c7b2c07806d1fafb07c9bb4c3f33d59feccee743975d7e56142792474ec68532e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3140575fe3527d733e643028241a9b5d

SHA1
40b81600bc7b7dcebf28241af03cc8af8cc994fa

SHA256
169f03304fc4a700e0db1785eb17753e54b23a778a4cd72e6d240dc529899b60

SHA512
4ef3457a4500e07353ae111e48aaf4b7442fb7c3bb2a38f84e14b77186a91a4ba29381d663941befcd977740d08cc3c94389f1d48ef82fcbd5ce639ee7015213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23b158cb2e592da1bb8364b6a1279a07

SHA1
036b18e3fd48b919a650ff9fbe80c61dd34ce625

SHA256
7ba2da94111ef56b1bdc6a7933ef77f38e816057e3ca13bb30817ceaac3a7efa

SHA512
d202e345ae38e31b8fb006a34ca71ef6635ce907d3dab3ecdff37a30338e4416635ada9dc00b686110b30121c344aa82776172d489b2ef553fa3baf93dd9a5c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab255C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar255F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit