31ea22a59ba3e5823a3622291a8cf3e621249e43a6e0f02fc0cd204b6ccef6b0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3957a39deba18a1e49982b1cdfdb1de4_JaffaCakes118.html
Size

18KB
MD5

3957a39deba18a1e49982b1cdfdb1de4
SHA1

aed1e5140bc29b564c43a879291be13088207b46
SHA256

31ea22a59ba3e5823a3622291a8cf3e621249e43a6e0f02fc0cd204b6ccef6b0
SHA512

ae85d797a2bccd5d4659064ade15d1f2250e98173b9d8b7b88ab0f97b03f252696dba967fddf49491ac436598ec7b03f6db9a1a935e8dd2ba2f660d0352d7124
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIR41zUnjBhzl82qDB8:SIMd0I5nvHJsvz+xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421666960"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FE6B601-103F-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2812	3000	iexplore.exe	28
PID 3000 wrote to memory of 2812	3000	iexplore.exe	28
PID 3000 wrote to memory of 2812	3000	iexplore.exe	28
PID 3000 wrote to memory of 2812	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3957a39deba18a1e49982b1cdfdb1de4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e168bc2517e6713d02bc5b9ae716955b

SHA1
4c1650b13a3e86c99de2aaf5bb161d34a1f48a3e

SHA256
5e05bf600b7bf13b64fd13dd7f28074c19719f84212c3bcb9fbc0a98c95ccc7d

SHA512
7796af1020c336514e6adf9230587fe07d3fc7295db67ce6f6350bee0b3cd5a2fe3c44f89bd6b8a971ae1e73d243f0ebae3c6fe726e4445c4555cc13564be31c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ffc70e4feb4b85473a301c0979f44bb

SHA1
cd139b2b1fd36e6dc5ed6f1edb658d199581068b

SHA256
3a1b0a06b1086ba8f67460dcbfe968045e361fc57bc2e9556503e7b17e9d1001

SHA512
6bb246975d7d84e17cf9d484f9c3e3f656e562b0025d1ea03c120e058d4cfc751e7f12dc77b828f9ecd4b5dba17d99681e19f086e2f673fcc24ed6b368d34419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1057b8041678ec86a02dc95b728a3950

SHA1
091870f30e60fecfa6dfa022d7b8ec1ffff40710

SHA256
aaf0cb5ca0fda40f061a1adb4e12512bbfc0e7cd1be360fc92f3d29f2e343c49

SHA512
b39dc16b11168767b60e65120218f1d5fd07770c971e867f0ed1532f99f4ac0a789f9de4271d105c747ff6db296fb344ebd24c9c02533649f3d20cdbdeaee4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8c1278a2d4826e77075996492dc4b0f

SHA1
4e5a38b40d0876bc86998de15cfc5a0e882c8820

SHA256
b5df5d9849f6ed4fcf5c3526d81097acfbd19b8dfc47c35b7d434a351bcd4afe

SHA512
325719a3ecc12858b4920b6653c5f7ddc6a990ad7533748553670130646e7667d20da4c73baa279f45d87c43b7f0c3e964c6fc548655ddfd849406ca7c923999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09a1938f80c7dece81e5b1ca39504b4f

SHA1
f5082447ae2082d78d96a824774305a856886e7d

SHA256
0aa9bfdaa07c394d1d1b9a7e4e20a9d76112117b972a1cd6b5a167bdc733931f

SHA512
300fe4a12d26d9e919083c4246270408cc3e59725512b25420ae6060598c2ca568912458802682b8a7c1b70a9c3f97ca42ee4cd021ae649b18baf6e9847589cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d93d60f214e3dd3bde314568a60bb61

SHA1
c692e5abbac08565b9acc6429125faefc72953de

SHA256
f9a9bd898a916d5055011b6da0163aa4bb05809aa23c853f4b4e22e34ed833bc

SHA512
8b0d7f85f54b6058639c037e4de16ae6452e0de96cbb8482e7193d4e530cf57432daca665ba422faf2a1dd6f29034c9ae62e96c6b755f90860a52a2f1a50d1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
277d1527783643a1329841852e63b6af

SHA1
3d858ea40961e5c6ea5ba4f1e7780e5bbaf4d491

SHA256
ac59b5da43396305508f3cba9694fc097c66ef61d8be079d8d1b78dccf63ece9

SHA512
8989c1ed38183173e641450bd536ac1bf42281402e9ecfee162b5a6001dc818f18bc4ff258804a243daf083b7d9210ff54f656e98d6dde074d746bbad1c54676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
710a77fbb2482420fd687d9aa1afb900

SHA1
0856ed4dbd07c48217d74c43a1a86a83411a858f

SHA256
499623f8e86723ec80baa33d5537cbe1ed54e79ea8a0a8b6e77ce761855ccf9e

SHA512
136c860c33c3bc1f9c1f760d9df7a7b8ab5e272c0018cfc464c39db3f51ad0da3a71a871d5dd2ca85f8c44cc3bb2be5f194b1c5284100947fad0c2c21a17dc48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9509801d67b3c4b50a2dcaa1603fc1e7

SHA1
7cc8881e0580ac0fe881416e03a643c90b08d699

SHA256
6e82a32ebe5579850a8c1ee730e1d3d8697a92df7661a1a8477932032708b50b

SHA512
c2ba9a652c257ad08b985e116dfe2d2ee14148ad4fcc0b7408eb1b7f29cb14380c1c4d50e85ea7dcc015e8715aeda7e8dd928936a278279f02d498f37ca5d1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12A8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1309.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit