e2442f81b7055cc28a2a118026d009380c6e92a11f5266805bdafab7d25af403

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35968bd07564235722419876eb305ca9_JaffaCakes118.html
Size

18KB
MD5

35968bd07564235722419876eb305ca9
SHA1

5e30cec60966e21e52ec15e716c6cea1f30eafe9
SHA256

e2442f81b7055cc28a2a118026d009380c6e92a11f5266805bdafab7d25af403
SHA512

9c041e5fcaaf9f6be39fd319d81ea73024d684cc515a06568d69c701d77ba0dc78b73aeb644ec2a0e06539654d942086ac06d676a98a149db646919069f2cb20
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIc4qzUnjBhmY82qDB8:SIMd0I5nO9HzsvmrxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421608166"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC85A391-0FB6-11EF-9B71-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2928	2428	iexplore.exe	28
PID 2428 wrote to memory of 2928	2428	iexplore.exe	28
PID 2428 wrote to memory of 2928	2428	iexplore.exe	28
PID 2428 wrote to memory of 2928	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35968bd07564235722419876eb305ca9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943b4ff2ca11282dac4f6e685e9cc0c3

SHA1
cacb896ce7abcdadaf8b61c71008c5611b86e459

SHA256
fb461d0c8320ea845ab3319706291e57e5e92ac5c4b9602b63915e1480bfca65

SHA512
b304118166fb4f6e41039402ae42734c79020d64beba6f6f586e42256c14afd45a5f1afbb4fb8389faf02c902faba3480f10527098a8be0ee5edf9b963067b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab982f9eb55c82e78b04c125d8440b33

SHA1
866a70825f77d74309c24794950475a78dce6855

SHA256
b6f4cb1bccca57da0f05d48e4f928da16d30c13571611ee926554cac4d7d0625

SHA512
9617ec52837f0949386b4b28bb5ca1eea36b323cb6c54d85bcbd373887b62fc79be7fb2b9fe561e9fa19911044b0b128dafcf6dce946932fb34807fd05734ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a2b0c797a07ae97b49cc02f51d73e1c

SHA1
8f1091380e2b01dd6aa1c21bef27bce4fa572bac

SHA256
6c5a394a3b60a246148a51d26eb13fb04c8014e85da87da601961d5a59503bb9

SHA512
624cb5f0bd0a2302b0303fc028ee3d6adcd337c2b90391cb36a00b64dfaccbc848f02abe2222dadace11880535238952dc3c103cb1d8b593b8c787a213a72f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5f03936fb2a3c22f15a818fa3436fa

SHA1
35130b5fa0d619e2bf55a268e6a31066d139d4b5

SHA256
f0ec5446c8dd6287efd6a027e596bfdc6f0e50a7583b51ef173bf1d1e923a9fc

SHA512
f6cf1b68d58c351e9a3910e1778ee6ef6cc3817d28eebbda0d9f85113428ea262eb10795bbfd7627df64e1e14be32d511b76d9ac480eaf99adf9fb0b41c1f2fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e4aa96ef07f476983bbeabb03719dfa

SHA1
49b8c34917fccce950b218badc3a8e9dcf7a30bb

SHA256
5b9ea20ce0043b29a8a406a4d6720edeb27312f56c6ce08b24bbb48128317f3a

SHA512
472de3bec63d05676e96dd0310321959b20220d2c93ce5c6b147a9761d5f984b0a41c9a9e0439cc0f3b7b5080e86e2c3a083e344f916b4fb621fc32059774aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4cbf9e21ad53f8f17fd534e5ff093da

SHA1
6830b0c1771ffa271cb07b65fea25ab4e8b1b0da

SHA256
fa7c4bd83894cbbb3bfcfd612eecafad69a2ce2266fc6b1cf03be5de22501584

SHA512
c05fb0f80238df05d794b64529cd175e32e6d9d23dec5ca74dd7f21252ab37d0cc23dbcf806ac3343e43847d1df3e0799a99997ff18e04b5840f6d53c06cb650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac7dfff4602df9e363caea75d07915e

SHA1
a4618ee1e466a37337d014dae51a49be854bfae0

SHA256
96ed1f2528aa45be6312ce38f0db8e412abfdaf6eabb6da5be416cfc53d994ae

SHA512
51f875685da94c8eb729b5be956636bec152d893e02a93ff249bcde144a0161e33e3aee6d62f69cd5dcb24413544c6dc85725e453409fd12c7ab125832f34035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acd35699dc7f861b5e893f683b44a83

SHA1
534fae7fc8382e06ba34ce3cf97669e7455dde39

SHA256
0e9fb2d774cc36a9764c04fabc7a4d2f72e33b74b5ab09d22210d6b980a78be1

SHA512
833684b2675178df59f6b79984469657cdb12d4810c15b62c006836c673873e8a60ff52831e9d9f0fb17a09fa9db6cca2c1131451613a0e0c7aee94148353a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B30.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B81.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit