ab2d1fc5f463eda4545ef880195344d0eda5f2124564daba0b2ccb70d349e8cd

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32bdb115ea9bd1007954f29eea030420_JaffaCakes118.html
Size

127KB
MD5

32bdb115ea9bd1007954f29eea030420
SHA1

6415cd7c870211133ca4f43498329aa9e1e9b96a
SHA256

ab2d1fc5f463eda4545ef880195344d0eda5f2124564daba0b2ccb70d349e8cd
SHA512

5055b9a692c59e4cc6a50daf31c8bf67bb207e609451288029860a5660fccb038b671c4268282d9ddd9ab49748bc1f1f5bfd386dc91ee20808737331a284635d
SSDEEP

3072:Sh2Elioe+AEL8VANuIl0AxRRH0uShKBKvcwAKBKvcwzoKBKvcwgYAs:Sh2EqUScwAUScw0UScw5As

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2A13AD1-0F4F-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563939"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2504	2180	iexplore.exe	28
PID 2180 wrote to memory of 2504	2180	iexplore.exe	28
PID 2180 wrote to memory of 2504	2180	iexplore.exe	28
PID 2180 wrote to memory of 2504	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32bdb115ea9bd1007954f29eea030420_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
232ce2291b75ee35b8d28f23213a9af0

SHA1
829926ccdba3a7d4bc893e66e9f9c5fae3365a31

SHA256
881e2bd04899e9ef171bec7e054cb1cf23876aa811c8feec2133f67581496dd0

SHA512
2c22f82e025523849e158ae8a6db78639ff87ad19c18d457515939f1d9d831670e2a55b43244b0b450acf5ed8f0a454312711d6568060c88012d43c0fba78af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ff36a148cc1cf2db78504772530c5b

SHA1
310914ad7f4aaf57b4a1ebde15c0c96a0e1a78ea

SHA256
79caa3c954724b53f17b73c168d53bdd3df2f93c5cdb0c24fa638144bb954869

SHA512
46e94988d68c64e59b495de231794efe4bf2b40bd9d09c8d295c1de7765124e22d1c805f345821754b662ee25a8a934604956efca1bc1693303ffce7cd426d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7d7fe2f6e0fbe6bad590f9e34a14e8

SHA1
2ddf0908b28a56aadb24c68b26a6b5dfc17840e0

SHA256
1291072fdc4a3ba33c6d8514a3a22c0675b4e13453e1241a8744107b6fb6c2d9

SHA512
dbacce8cbd04d33bc715d58bede9e072bcf69ba83f5bd62afb41c7a8464a503946609cf628d9c7add04d93b8f343f45d6a881da29f248a921b8aaade035a8b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89b39f82dd46882941530d1b0c5b97d8

SHA1
bf5b4a5f25db328d11861a33e5bb9f325381f02d

SHA256
76104aee45179d6b0b563753b3ba18971c92f03b1fab5a13e8eda7b1d02c0382

SHA512
380675b5e3b1a1d7bdf5e111199c2d789c99980ad2f7eefaa96482487cc435e3bbc1c4bef305113246ee68932d6d3a5f775049563bf290bed1eff49dea1b2ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc2a9ed1f77d34c218451ab900ddfc0

SHA1
880e264f2ec1ecf46a0571ebfef929d841ae7e44

SHA256
4a5054bccc8a551cc5e72085140a2cb38a9cc7d68cb3b28b25bf19c4b867abcd

SHA512
b455faec1034de8897a981ff4daf1fc45aba7ea7aaf77f63abe224d72b246385d8905ea7bedcb02afd83ea06ccc8da1b6b7cb012a549f1f255b9ebf2805998f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b47c2ecbd4c98831f703181ef880a00e

SHA1
f016305633c96df0fb4985623cd3f94b426dc157

SHA256
a703553b514d591c691286d4ea3ee319f3955b01716d14d365b73d673bfd38de

SHA512
8e965cc9ac01e7f31cd54136cff892b2197eb74f356481da98aefa785b1d69141a25767b496d53adec67ee960613fe786685154881f482abae683b5f0833913c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
993d98158fc6fd6fcfff0b7ed11a9351

SHA1
bb946c9aa3745f26217a851cf129976a65055e9d

SHA256
701f6141be818d66e171790d52313943a3e54b42bae426cdce5b5a4551b77df4

SHA512
531ed3181c7484bfa08fcbc088f1823138039baa28fed68a3dcc79c4ec796512b74bd17f50117274ca103586ada9b2e53232333528b710466b88292b2a75caa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca70a762c74bcfae65c62a371e8f47fd

SHA1
7075d6d68824a4e7e5a5a7123f3c4a3d0ed075f7

SHA256
c4af37e5b48f8c9aeb26f5ee56c76174003baa677bda47622cce62c031ddcb70

SHA512
6b391d93abf70d025b4000264693d5156adf2f878777c49068f7ae3c88200f677ed348f56d12518bd64bdd08bdd3edaeab8d99619821a88e2a0fd801b3dfe76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6432a68dfef3c94a3be59357daa9e3

SHA1
c3e5eb3cedea2c4843603a601130d5b5011e0148

SHA256
b21a1a0d1772a46ce569589c54714212f4c21c3037ee35bfaee145773e5e038c

SHA512
a237ee8f1aa427a8377d1b1b9ed8335b219260a153d0257bac0cf07e20fb7c3476906c97c91d551e7ba291ffc2939fc72a0c3d3eb25d5d8614285ae59ddda013

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E96.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit