ebca6e20c54b7559950f6d525d9219cf9699a7da540e38a5cdfedb157d7fc7d3

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30bd3cec0a11deb1a18747710c362b82_JaffaCakes118.html
Size

20KB
MD5

30bd3cec0a11deb1a18747710c362b82
SHA1

cf02dc0c3cbaabb773cbd5e7d7291027f1281f93
SHA256

ebca6e20c54b7559950f6d525d9219cf9699a7da540e38a5cdfedb157d7fc7d3
SHA512

8a443587fed42bc27d5330a3de80ea53fe21ee9e6d6dea7afe00a67569bc0311068272ba56d981fdb439e2532c4da29158e8aded9a495c8ac3b2e6a996c9dec2
SSDEEP

384:wLadfQepvt4wJ8MHI/w98HR+wyklOTrlO7IlOELRNXlOpPlOyOejvl5:wLadfDvtP8lw98x+jXGs4zhvl5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421532216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6468891-0F05-11EF-AE77-52E4DF8A7807} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2792	1760	iexplore.exe	28
PID 1760 wrote to memory of 2792	1760	iexplore.exe	28
PID 1760 wrote to memory of 2792	1760	iexplore.exe	28
PID 1760 wrote to memory of 2792	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30bd3cec0a11deb1a18747710c362b82_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b13ad1a247f79b4a838cf94f9942e1df

SHA1
49589b7d3dec803c9e8a3f4705d5a02cb7d1807c

SHA256
0cd6a5fd57c50e30bd23c4d0a404fed859fa5c6efcc5cacf309851bf45d6d1fd

SHA512
d02ad9d5bd682ec8d8064ea4d2745b0702872164819d88b48bb855bda67ac0aa8038754fc4e028e4ffa768df675dd97ae26cce8b5f4dddd31aea94195be63090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743847c1e41bf9c574c4df92b3ac661b

SHA1
1080fd0d5797386e2ae3bd7547828d4687669c7c

SHA256
74b4d4f4695c4dba21f02af351f9bbcbcb69714513dd6c20ba63f7f41a354c60

SHA512
1c425cb6fb60c6ba3e7f8db4f758019dce2fbdac035c8630e216c0433764cdeb0529d3576f79e392f2b324f50e93ced6bf0f20e5071dbc499e5b861ece44b521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb059240040127b620aa240c815da813

SHA1
6ade0c4f30067c822466a0719f6f5a3d864fdce8

SHA256
0be14effbc2f1acf7e46e346f50bf576d26ce11b1a7177d978f04fe916c90001

SHA512
9c3ae0a83cf14ac02f9533ea11457869010668d0c31deaed3d609b631651ad634488ba364078a6c3b0ad3e5fb52f34f9bfef43e92266e6d627aa1a1421c1132f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce0b2f2ed58dd4fd756e2c979f60b69

SHA1
08da95bdb73e1af6247595d04e4ccb26b1746b52

SHA256
525353432a03dead68fa425f1604d5002adabf1900bd7c54136824533f31945f

SHA512
982be2c4dcf6dd057ca1a6af1956cfc38a46283ddbdf548a686871586aff257adfdbd4cdd03edc34bf0590a9a20fe467837058e6e6ab67350aa2c8a8501cc63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebfe0afe48b035dc517196051946b1e4

SHA1
81d3c840e083fadff978a892633ba38bd1e4dfa1

SHA256
97ea78c7c175f1647a0c5742f975cc31383538bc8e098d95f61509075ca3d076

SHA512
ce1aab246d605b05a049c785fdd661458af0a520ff512f399c55ae9110847cddbf1ae56c97bff2e3a9273fd0e54d6902fb486f886ded897867faf133a926d197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1394cfec8204802fed44229b758fca64

SHA1
e00e28401cd710ffb0cea720c93bc3c9d998b1c3

SHA256
fd4f47896a902ef59ece3d014fa23fa0c722552415c01a64cea77dbd385e0f05

SHA512
ed4b98a170d61cca42bd9768f968a5e7f7dd765d8c2b46ae30a6c77623dfc5f106c28b6a0a6b78f222382409495dbcc8b10a556da4cc3e6b2e87250690413652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da3509e6b5543e2193d3e66056437db

SHA1
9ae5805c032bbd6e6e7ce3c7f6e2554f856dff12

SHA256
6306f1ea18484b3f2c3ec344b83d87b6acd8d2489b8e2a0e0b10b40c1f5176d3

SHA512
63fdda0c6f9db11b771207429a17332a769f7a3f6d36a11b4a045bff132f7e28fda3599b15a966a3b607e4670f76ece9a50952ef13cbe7d0dc4d0033b638e670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e55065f9473c54ebdf6b8203fc8feb6

SHA1
ea761dee777bb8f36186e9d7d90d18bdc61416df

SHA256
130bfe397f998b2f87fc1e1df4e3be4f39b5a9cd917b82823d2744b0088e4e55

SHA512
03b1314e295b612be5d572700b03bfd402278942b9941abc82d8cb7d40edef80d9e5c36d41495f8c757e71750ccaaa3ef9719c609a44e2803f1d30de0695be19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de07c21a14404c18d37100ce7ff60d2

SHA1
78dbbbc95547d3e737a3b3070f1d2e33fb819f2c

SHA256
09cc5f93c40371671d25a7dbc1cb888b014e029ff7fbe9c2a61e1e26ad1eb92c

SHA512
d65d696a824742593b47a7005cdb06a6d6ad175c70d9794cc9f92fdce289a422d2cf36bb1aba2d5e8daa1ff45cabdad936c2ed8294c008c6af9f249c0b2aef93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F05.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F77.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit