2542dba0df75766c5c880863034d1ae2524a9d72d0833dbb0d45913c6b63bab0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html
Size

17KB
MD5

32bb2d6e2937abdbe4de69638d1c4bd1
SHA1

799cd8b92927feb0657ede109a7873d6287f9cb9
SHA256

2542dba0df75766c5c880863034d1ae2524a9d72d0833dbb0d45913c6b63bab0
SHA512

db53402bd2a6e50e03dbb4af97aa263c5c30cfa3b26a0e6fed2563875f069a37e8bf9b687491e73f8a7360e2c0044a3f1efa0861e4bc353ccc1d573223cab971
SSDEEP

384:SEuCs3/B0gw4mcukABSp9vfL7NqtnQFV9DdRDwHL6Cq+:SEuV3/B0gw4mcb7fHNK1c+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563807"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73E56831-0F4F-11EF-9E38-E60682B688C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2588	2244	iexplore.exe	28
PID 2244 wrote to memory of 2588	2244	iexplore.exe	28
PID 2244 wrote to memory of 2588	2244	iexplore.exe	28
PID 2244 wrote to memory of 2588	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32bb2d6e2937abdbe4de69638d1c4bd1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7029611b106d19b84cc585e02eaa224c

SHA1
12a86a729b1d26f8db934dff36f0e21821cdc6cd

SHA256
2163f083519198a742468ace5d20296b57c54a08af4abb8fd6b5ac1fabf11755

SHA512
ccaabc8185170f78e79d66753480b3b14d2583574ee236165fe65df299e5fc94fe342af2fa71dc473e17aadab4db380aefc31363fef802169d495b43cb0d76fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
294716cd32c7bc2e452529a86ce63d3a

SHA1
f0ce50c0db02b66cca223f0783bab65d1c70adfd

SHA256
997772c2c6a05d33ec13d004cc014d35211bcff0138d1a19b91ff0f32931f62d

SHA512
f9c4306f24308ef37ae13da373b9acf8cf7a455a8db6680cdf1326c1c0e16f58902b108929b4ff28fa48c20a6fbd5681de490e4295c535cdd67b6cc46d9d5fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25af8f45b60d9bc87d9bc01d5b2ac1da

SHA1
c36852f522c63b54807dee328ec48940d9632dde

SHA256
a4ba13fa0f1ec8d052cfe0d6bf636c48ec4ec97de336cb9bbe62509b069e8e64

SHA512
bec5347e8253da84f6bfd22d016ec44e848ae9130d35fa1a005bde7731c76ed2112bd8381296444455733dededa96fb98fc30ec46b2781194f08cf647c1ad134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8cb53e8aed39f0a7366aaf42231acd

SHA1
8da178a20bfe485325a877cc956c70f14f6183a8

SHA256
bd596acfd081371b0ca4c48a0ab392db611d5246ba7ba77b9bfcf664e19579cd

SHA512
2c8729dfc20ca2add20e2728a435f31bbbf50c8dc887c25981e440238c06661d581d9afaa0666b90c8f95a4d35218fa8d3075d3116759cbc18336624d264faff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
647bbe217936ba7a36632841e06a8aa9

SHA1
26805900918adf6a684724e93f17007f94b21902

SHA256
18ca8e3955c3dae1a70e8e0290fe32cea6698edd3686dbdce8bbec5fcc056821

SHA512
4b480b466ce8942de75391cc3f75f6d57f65142cc5558ecf9477098980b187477612657ad89669583e2363219a224d095904295fa7ae96cc7ebec31ae5d947aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d01d79e31507fc8f9e5b120971abe5f

SHA1
8abd809b82caca94a96d142efd0197f7873b9d83

SHA256
1995bd2c32dd2d6d90971000543dd9fd4bc55998b01740bff2a5693c3a7f3e94

SHA512
22d1de1d3833aa6eaffd2ecb9cf0bf92c26c3e27f20cc671a6d033063bbe0124d5788f3cbbf792be88de96adca702588927641ec27604ae9f1f7b2017d381b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0621fa4f70409849660fd6c276fe5f

SHA1
226b43d6d803c250c807ef7ddfbdbf6744ff0acc

SHA256
6093e2fa0268a448342e19b39627be9abd78e51932fd718fdb0d2b8822a17263

SHA512
e8215b01b5766e8ee17130c39146a00df753b8b98c266b33e18502d7dde0300d8ea58305c331aeb8eaa4fe957d9ffa237dfa69e9cec3b5a67622e31ae7f45234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b483f1dc19d8dc5bc4cb227a01f1b66

SHA1
01f87670fbe111e461d52bea265d6f1cd25bee98

SHA256
88f7716e6c0a77b36789a44d47ef080dded15b6c3bec1f8baa71d1c4c35482c5

SHA512
654cc357eabc783189b13358e6692fb7b31e4ef507b1aa4c0d7875a91c934c543d9933b1b3d2db7ce972f241097e9013ce310b03fb8d8007ff6876d5c2466c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1995fe528011a3834db27041b1e6b350

SHA1
b8eb4fd2807a0d7e7da4d06398baa49ae31424c6

SHA256
6ad3d1a483fbfaa74e2c5fe60ad9718ddc98e2eb354f2935ea9026814ea4696e

SHA512
bbb9de5820bc9f7ded4ef005b7702fd0fa8d2239aeba2fcc100d62600c71de4f788ee70343529669a1d8b5fc0f78d64e13db653bb61d4095b8d48168b7278406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d71d4831b5be282e99d574b0cd1cc2

SHA1
47fda4f083b8d6fad0a4f9051c51468640d6a641

SHA256
4667bff4e6dc51315bb08d7500e38402cd8f0a984c4dcee0a9481a405db71451

SHA512
2a600f4483a176e7eb93dc13a8960cc8b206280aac26685180514e8eabcb72d4db6b2e32a84f04172a1c3a2626587984de1fa7ea113489640460fef8ec061be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46d2c8839178f4e662c30b51503a49cb

SHA1
cee0723fc3619d5228794e9534d54e3bf08d0e9e

SHA256
0f876a6b6f8006fb687fb8c61d068a02afdf12dbe0d83e2b879b24c7c16554ee

SHA512
3878ac7c6e92dc526444cb1e5a501325a230efc5bacada28f71a49e0a7c41e4b20413a6cba639fb0b1d66677b85f62fe8c3e2532029ab7c30216616921e8ebef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2982234188dbee1d972731c8766512a3

SHA1
469e68bbbb68efdb639e5b2989b49bce467571ec

SHA256
ce6ceba8e0511bbaa90c6391465660064ce1f99f7df43a8b6bee23c2a9c0b320

SHA512
a8840bd30f1b2ba179598ddd6e177d5be48e49f0ed27c4b0f58139593d30da6a4fa865f8bb2665c79a80db6d33f64c108a2e010a906b46b9b86cf287d63d5c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar265C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit