54f95f062aca939bb613e2aaac49a559ba903e710f160d09c3675184b9aa1505

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

32290699f92f6e1629177ec9b0b8d6bf_JaffaCakes118.html
Size

19KB
MD5

32290699f92f6e1629177ec9b0b8d6bf
SHA1

bbb488fbfd6205ae3e162a82739978938687bf68
SHA256

54f95f062aca939bb613e2aaac49a559ba903e710f160d09c3675184b9aa1505
SHA512

8e163cc6833d96007386f6903016f4ed9b9c0e3978aed8c0e2eb646ad2c0735cf1c70d2fd3a7d2122356ad7e896cbf6c84ccb239e133c578c91653e762d69e66
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIx4ZzUnjBhfh82qDB8:SIMd0I5nO9HBsvfqxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D25ECE1-0F3A-11EF-B023-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421554803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2580	2188	iexplore.exe	28
PID 2188 wrote to memory of 2580	2188	iexplore.exe	28
PID 2188 wrote to memory of 2580	2188	iexplore.exe	28
PID 2188 wrote to memory of 2580	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32290699f92f6e1629177ec9b0b8d6bf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f76fc0526874bcebaa200c7678809366

SHA1
b689882581f5a5860dd76ddc3a76113dc7141b63

SHA256
c2c94af881d0c81ff64eb6e9b7fe955502303ffb792ab4067e04c8319055a8d5

SHA512
64382a693251b9200ffcfd0d933c17e081763f46a567255d4d2d6d586de331cfc9bf18316a505ca4d8598993260b570bf5027318756851102a9acd98725ba46f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14f455ce9ec9ba39b11ab8d3ca5484b7

SHA1
0475bbdd2b75da4b4e58e9753eb9970b80fabb3f

SHA256
fb892671cb6e0e624fbf92bbdd85158f6c63fa7692540294b42e48aefb6ab773

SHA512
ee9966a4f3f15c06b9c7f7a7d5dece0eb9b69820c3c488282be20c8723e20eff2332bdd5426264f8f06ce5dbae624e1807908855c63036dc4e71a49ce658c1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83f11e50ca1ecb06a51aef234a4aa3c2

SHA1
0a433077280c1d3e1308537f76d947c5fa598c21

SHA256
acba087d693e3390788a71f2cb393938e8050cacd13f9d2bdf1550a064cfb691

SHA512
c52f62eb306673e226db5d774ffc3eadb99fb34ed9b5fe730329a6e742b204bc0da9cb26c96e9094cb5e9bffdc939e3a5b656fdac3022dcc9ba64b8a2c938fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57b739755e5a74f13f0d48a411d516a

SHA1
37d0087472d379588ab9a0aeb0bb304528c88608

SHA256
5d1c03b873cfe1fd5843d90605b11c5175abd6fdeb7d3c3d6ff6cced17cafbe6

SHA512
0ba3e23ec307dc9cab3e9cbf777044bc78980e530b62c8eacf91e52c746cf6b8bb71bb3574d9bace1994f7d575b1714373347fd38217b821cb64782404341acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7760e14d94fd2f139613d3f7e71722c

SHA1
710bf88dd8ac4459917629245f4af7b5e3c29a56

SHA256
184bcc96ee4f984faacbfabfbd20805fed2ce01cafc911751135ced267b6b65a

SHA512
fd1279ef7539af2a52bee8944533b00724ee124fa6305a116aa383c6a693efb08d05482c76cebd7d22e3a042d8f1d5ca008c8a4ebba08a8f595e38877c0db8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5583c07a7bae3e21c13b68c34f30ce8

SHA1
59ed38921494ccff7c84ce44a7dc4f8eac4b75b1

SHA256
7c1d4e92719ca6ab2088ea10cd220e9fd703ea233aca7dea6e5c84d6d3d0ddf3

SHA512
8b0bacc18e831dc10336690b053ad88a1d5e3fda36d38d1bff179730d2a116800a808b16367dec7dbf3a91fe089a8d0e49ca53335f8494cf310b23199f6d6e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a0e8040e871d1fc651a8bcf4c2aacd

SHA1
f611bd07ed92e0a0ced66c611151c85c59ab5fcd

SHA256
d55d11eee0bfedddb8123b29cb23b3d345e3269a8fc2798a5aca34346cb4a38f

SHA512
d78235ff1568c5750a050179662e2b14ef1b5b13155a93b8fc43d76b178dd64506324c6fed21a14d9d059de52d4afae674fbf9762ae09e54fc314aa5d4727ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a727bdefc9b3f45975bdbf54dd66c32

SHA1
981a616befd340146b307323bf7f5ac99aa693b1

SHA256
121b7c6f9dea9067ccd93a0cc4e233beafbd29787f3f3225e69dc837ec690d82

SHA512
56af8886f28079c057347b19e358ddf749eee6cb8f68de4f237d8fa015c9ab1ef8ad4ee782aa4e729d5a7d605710c0ba736e719abb24ae79d2a78e5664914154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eed118d34ed0a90bbd3d2e77578551a

SHA1
18e553cce0acba79134064b6868c1b0921752c55

SHA256
897acb5d8e1edcd26fda3458c534f9a0daa47a01dd7ba02df22d6027ea941163

SHA512
9ef2f7f45cb2e65f16e45f977396a84b3dba5e5cf83914f33f011941648680a377cc67699c43667c21c25c9cbfb59f85c1cebf22941aba746d6c86a39112a25d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14BB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar150C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit