9443500105f351dd2453c45ea99cdca3ee661dc194b509e4b8d05e496a3a38d2

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30c44b78d1ca3db69d56f7f728364ea2_JaffaCakes118.html
Size

18KB
MD5

30c44b78d1ca3db69d56f7f728364ea2
SHA1

7c929be10a022857b3995fc51654afff65c59002
SHA256

9443500105f351dd2453c45ea99cdca3ee661dc194b509e4b8d05e496a3a38d2
SHA512

e01899b691bc5a44b7b4d4fea830d8cc432a24af8fba4c64af6fc83f08f044aac84de131b8898dc841c1dae8dd2b89736f811d7d25e942e766e286c2468a0166
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIb45zUnjBhLd82qDB8:SIMd0I5nvH1svLGxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421532659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDBC0F41-0F06-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1392	2804	iexplore.exe	28
PID 2804 wrote to memory of 1392	2804	iexplore.exe	28
PID 2804 wrote to memory of 1392	2804	iexplore.exe	28
PID 2804 wrote to memory of 1392	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30c44b78d1ca3db69d56f7f728364ea2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1b05a86a0a00ada86d194ea79393fef

SHA1
978d731054bbc92af374147100b0bf0a799b8479

SHA256
acb9d44282c3277aaf10b3819ffa526937307a6ce224e5a33203571d2d8f3a5c

SHA512
23e1fca601a9c45339f2304718b2a3553f38d537430ee4e8dd8ff99d75f06467ee781ec01f04f9eba28e2a63cf24402756ca5450e728ab0cf59130291802a752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770596f43ecbfc582f65ed2caf369555

SHA1
f5f214c7dd286c773a3be6aac2801a5fa2a94281

SHA256
edd305fd8a1a5c83e0f8388bca29f7c48df419ae685a7b7c2103b48c56606046

SHA512
3dfd70a90406f78d061e1121ff0f3592dc7ef30528d832c0bc13aab46917e597fab2af0d43ed438ce020c42318de8633eb34bd46993f424f253e150aa31eec9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de9258b0f0df46499b7d3f7418ca6cdb

SHA1
0dc3803c26ecc529ffe5f6ac30f52945219569a2

SHA256
83496ec901f1e4130ade58ded9ea794c6266ac51a98763c89d3b9e4575c0c6ab

SHA512
e92bc9a995ae32c20ff308f054d94f36a6576c07609d179a224f49b8d52d4ef65081b71fb936d42cd9c76cd1dfdae31b4a1945b13a4be4e69539e3cc2dad455d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
422bc638e8115b745f1a13430b6af7c9

SHA1
a177daa4c89af901958bcf319e28a158673b8f79

SHA256
36c87834c11957c7e5ef2afc988ef3626bcd3a49acb3f138088704a9d0f33dbe

SHA512
bb47be1932109441c7f7b2759c454a1397e73a915f0cf71b97c93970892dbd33d4ed2af82c74dc23ab1a1d52af0fe8ff6002a288d835dd5a7257ac9b4070277d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654b0d3c553e4919f567d1831d0b6dc3

SHA1
1a975a5dcf96f59c3544bcdb0b8f4ff91ff75aa0

SHA256
c4633cc9353854d38ba5f21c3ea0485cd301cb7b1710587742ada9c2d261fc22

SHA512
cb28d681057c51a890d0f2c29b1bf83e701293d0f94a59e445f66a48e9b0e83524b87aa67167452045017480ce5aa79fa25aae3ba385727481ea0ffacf6f1a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e26d355b4b19e85f13e6c18372a0d25

SHA1
b9f530fd8364486fb20c12e50cae20e3dd23766b

SHA256
13f6123b095702d97c01621bcd417fe06065e7c8192ddd85270404230c652021

SHA512
0bfa9a1c964d8fff5cea075d176025a8feb7b6db20b636240079c254104444ea0a7e091c914dc834f34def80bfd22351e1e010e39cf57e5adf4f075374c1f1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defd07266d3d05dadd9f751190370ce2

SHA1
091d7508f178e719ff4a1c1e2557061255d40396

SHA256
80d849c601f000e5eb2229ceea06a0484049232af093321ced34cff230eba22c

SHA512
19b87420324915a2129560653859366e0140cf36252f19f2b96660404c57d0e8105099624f76d94809b988bac59453ef6a26d391c0a4da09955f05630f47a3f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da1ba4b333227e078871f61687905555

SHA1
61b545f63d00e0218b909a125b8e3ecb827e88d2

SHA256
14e10fc299f44c7125c2bac2a17507ff577c394001bbe5ce9d83277877a16901

SHA512
f41a42979e3e5d24bb84c83b7963c4f464c77c330832b86c07ad3ab34da44fc8b25e547c398b6c40fed023e315f1993e255796918d83244f61c0507a4d7275be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac502d7637500a41218a95fb2e83c1a6

SHA1
729e8d7bc2a2c37493803f027a46e5d9e45d1410

SHA256
9151c82b0a3cc4fa26091cfc1362d7eee8dbea38d787967c368a86da3e838634

SHA512
4b831f6ca384d338a20220c29d751acaeb2598c3cd3e151e8a013374c7fddb170200ffbea9d7ef867773af9bfd987b39ec417e5ea2dae7ac2ef163844feb694c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EC5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F56.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit