e79b95138e4c072e112b285571537889b2132386d305aa19242fd740e6f5f10a

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1a6fe64c74d0e51d1156edeb50b000_JaffaCakes118.html
Size

19KB
MD5

3a1a6fe64c74d0e51d1156edeb50b000
SHA1

1e18602088cc6e7caa12faea4f0fc2a494811461
SHA256

e79b95138e4c072e112b285571537889b2132386d305aa19242fd740e6f5f10a
SHA512

d05391bfbb9d7312263c989e5a1c8420c6c5ed658bf23fb68b9e6e4066ec247d3351318dfbecad0b9c2d7dc7fcd25cdf7a5c208a6e7d302b737ebc381145652b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIZ47zUnjBhVf82qDB8:SIMd0I5nvHtsvVkxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421678684"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC85B771-105A-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28
PID 1860 wrote to memory of 2140	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a1a6fe64c74d0e51d1156edeb50b000_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9981fa50859eb619407c0583925d6121

SHA1
40e0f2bf03469cddf2940dc175919bd062ac8584

SHA256
592511ea072845fce2db7a4b80a3b6aa4ae826fbab1b74dff25e559cdd3fe8de

SHA512
72b46845ad526dcace0c87b3880740799d6c584bacaaef7feda63a374f73db35889de8fca5c561b110f5d26fcc973c7a14866fbc860a8b485420cad267f1a940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaebddc500f266841313b9a996811a15

SHA1
ee9db62ffa4966d2be4e6e1c75dbc92751c041a7

SHA256
8e896b2af85b56fd3ad444be5ce916ec967ff3acdb52e5401230531a349a9904

SHA512
01d5845adc761ac167e81cad9139c2e024f52e0705bdaa8aab81fa8e31cca10f63f5874ae3017bd75142c5ef8998c317a4c51a084f06b92f7899166d6b93c89d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a5e87e163c62182152ce49c64b3eee

SHA1
01a41e6ffbefb7e8256a796c2210b9341c96ef0d

SHA256
510157f7203dd702473c033bac77bd64983a180bf7f1ef35d3c2e4eb52e04c0c

SHA512
1ba7662bc5a2736cb1bd233d42e138b889eb1dbc5c3f9614c2152c3e87e2600a71b8b8bf0c948951a3ffea56618c7189ff8ac4e54a715fed032236fd60504b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5141ac9974cfd35ade6a77fe3cbec6f8

SHA1
783a31364070b9aa00a0b828b6502b70c9a61cb0

SHA256
53085c3bd241e7d469d0546c015c435b85a5bd2bb82043e928f08b9b14a1f889

SHA512
4e9b91fd4376ef2c3b0c177caf9d1fc6cdd8d3ab9d1a0a89b9ac6b08456646f3d9248660015600c9291c2410055ba0888c86e5d9fbc6df08db72b71ac55d1ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b7caf784a1d03356e81a0a48444193d

SHA1
f8168f949a8b3d2a497da33fd3ea20c223d10adb

SHA256
58e29c5f11c5f07d459576c525de3676b38e388f91a226d8bfefefeca4c2f76a

SHA512
7503ae3b73620bd4f12584af6d5e5365ab250c381d957b626e33668c5b39c6fdf87f622717e7bf5cc9816a6dedfe51c1b67a568416e092d8d77cef23d898407e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6011222895835f3cf3c9cf2893fa408d

SHA1
9111a6d462adaeb533ded68829a69b18a8d35b11

SHA256
df9acdfe7db2e35139f1645356cff71a7a6d4c85f4f8e9677aa34ae360540810

SHA512
ef5141d6efd6da26c1be40587c50970cdd452747e259736b31086e334ff90583fb54707b0fadbdedcecfeec495e9e0228d9cfcfad8439874d40ac4fdc03da950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf44132c6b2e1c6b4e0fd524e9dac778

SHA1
b4bf855bce0e021eb598407f1ad8a4f0dbc1f505

SHA256
777fe4f14c642a6d35622346ab6b4c2302f065e7a31f253bb6440a099c836132

SHA512
3188f78ac4f4d0d4184264bfc6fa3453a169b8d4528794632a22d2de53ea4138725c27ef802b6284f4cfa49b33d0ed355d307ac7cf9034beac4576a864001ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7677cd5c3f48319074c6e240820bfeeb

SHA1
587462d9c669cf8f14aab339273d094a6e66619b

SHA256
8f993e62f8f3a8fb7bf2187caf943de600607ac4c9fa35f72495e18417e578b2

SHA512
b96befb7496a211e7d81fb3585e26b49219a27cd27710ac56b7836a96fde9d319e725bf860b0a7942e87351ffd2d7b85470aa0ca6fff12e0f0cbbef526b70a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e399a4aef64ab63996245fe0243c0c59

SHA1
c1d4966fea93b57dca538d2792d6634699d910b1

SHA256
72d6b0b7f966299806776b47fb2fdaa65d1835db613e21ee5908ca0466a0e29b

SHA512
7e1ef1a82299e3f42cea37bddf231b7f193bac4c3c8533b664118a9c86756e7cdd3b457dc7bb5f07601570960777dbc90cb0a8162146f246e010d34e85882696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95df25fca82e9b7017a1109711dd6f5a

SHA1
0f40b501f6085ff386e7688c188aaa7f35a5f853

SHA256
41f0a41bf15a4f5d8776bc3151d0cb4f741bee7161f4638a5d084fecee11ebaf

SHA512
8fc8f1bcce6305dacae1364dd4327f1a99d35203591174667a6746d23d0859916a6de86d819a36b1793a2eaad9e7333643c1982fa1d01b6472cebecf84a6064b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6daa48b8d59914bb3ae71b57393a5d3

SHA1
673672a200be08656420f0769cfe953059ecd68d

SHA256
c8aabb92cc99d5da48fbdb5c5c25c5fae4cb87c128386e4c5bbffe7bbf44c0e4

SHA512
5142c5bf72d52f5c5ebe982751c9c8647e6a5c6af675f402d354934e10247f24fa8f5ebf4131db4cf0fec75cf64ebcd0c32ad94d95ea54047aa99cb4fbec220e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit