f2a0d4289716c84f43ee10d09925035cd2034659f2af82cdff2a5e0a8cddb80c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a478528a24506e680069b84d82b61e3_JaffaCakes118.html
Size

47KB
MD5

3a478528a24506e680069b84d82b61e3
SHA1

0671ab89ab4a967213354793964a602a0e61dd34
SHA256

f2a0d4289716c84f43ee10d09925035cd2034659f2af82cdff2a5e0a8cddb80c
SHA512

63de3653e470b568d9f7125732686661fe5450d97ae5280d13172b4c6b3847540bb714ba79f2be5b8347bc9b9816a16b200ac98ca6b6a576275e06ece3e1aeb5
SSDEEP

768:Rk1I3goF92QJQx6mS815TfNdw6tN1U0koqWXyigcNINvZOfl:Rk1I3goF92QoTTlXP1U0koqWXyigcNIY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{527B6791-1061-11EF-AA6D-D62CE60191A1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421681432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3044	3016	iexplore.exe	28
PID 3016 wrote to memory of 3044	3016	iexplore.exe	28
PID 3016 wrote to memory of 3044	3016	iexplore.exe	28
PID 3016 wrote to memory of 3044	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a478528a24506e680069b84d82b61e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b2b21c9134ec76435db5e63e451b41

SHA1
88b62c780f4fc79513a48f035fa9d8771ebcf38a

SHA256
17b11b99746a4f635cabda972d0c8f34788e16a9aeae6148711e1537f6bd963f

SHA512
6064a172e8cb49a4991cdecc3e4e60585963ccff7ebf23f0974b7514b26258a5914d9f05097f01d726178ec72edb8a877056d2c70cbc9cf38b16120b0c409455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f45e7b103413d50db852cd7836d41d8

SHA1
acea82070e5812491f7a2c57987650897c90be74

SHA256
01c7daf2f849764ece835d99bcd083b969bd2300054d7a345f6ec70ceacb131b

SHA512
7cd5f1719734ba76146ad4d8d008103fc1502e146afed71590735aafae9c55aa490a6d233d38323cc21e5607c9ff0f64861bfbb906a16c4756a168a4ab5cb7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26cfcb779b5536da7d03ba9ba1543027

SHA1
90a923731ef81386ccc0b13756e4a3a46d2f73c7

SHA256
e1145ec3d193ca9018470874fbfca01b03beb1e19ed6753e8791f86580f66497

SHA512
fb267554f2b4572978d6e8e6cca8758e574eb3d0f37e71b3277a6c5707140b6dbdf1b5c3b302372d5de6a4632ed16d79d44638992175015056b4430d8f6ebaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03cbb24589177c552e657dbdb2d33cc6

SHA1
e4ddf18b9adba4f2b519c7ab27e7a27f8fe0bdd3

SHA256
108350ef827e1c6b3f1fffe46107e96b0020d7271dbe221f467fc736df99af28

SHA512
d4588df661e6b1c52da9fc4fd975de2b8d044abf79ea896d485ffc52843aff3031e919bbf3767ae30b9e2aee3e964dd3c53f7eeb414a7b8a42b19522d8a40efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546da12b2a51628d151d7c7e6787ce63

SHA1
6a706b52925dfdc2ee4bd4578ce36b55dfbf774e

SHA256
e6c6cd100a9b936622fe7d4e4b1609d70c616e6958650f57692204418cf6fe3f

SHA512
29dd0bbeda2219593947d5940da008a2f8094df31cfd779f8a571ede1226a94c9861473c45de07a2dd2c105de2e16d501831545bd49cfc8c623ec07eed90c996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e46fbcf9aef4ae0b9178ae099cfa6079

SHA1
7de75549000cddd1951e722f04bdf3257cad029d

SHA256
34be4de06bc7e38aa2445a13d9a9dc0efcbd5d4efe3a47911423959c5e5bf8a8

SHA512
b229935cadfc5e2ec7fb256dc5a37b14691180b83dcd237bf226990ffdb40af079812d6ac68b6a2bbbb3b0e23ddb879a406fef052346b129a6898fda5b364be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc1111173b3ef750df8b7f4d96e189d

SHA1
0ce225e230235eccb4c28e27fb915af510867fef

SHA256
dff6d1a3d583457f44bfaeed2250636a84de053aef4f691728152bbe14bbe1ce

SHA512
57a892e8206236b2f2b14810f4d2723f4804c49c3bd368e57716a90795148e59c9691a18302607df086d8f67dac7e7d621dd9d604db30e630e43b762e568fe47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8c839ea05f4287f05b9da4080bda888

SHA1
9b20865301867c3d8ecda7d34c6166b1a497bc84

SHA256
2f335a02eb4930bbb536759244955879c3e0a0100976bab23251413d69a97c60

SHA512
84b771586706c28f6c99100c356d38a4139791c8f3b3a3d8d1dd656b9d0b050008fea49043159000285fa91c3c29faadac5f2eb6725bc4d575e84af14c0f895c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
141a6e021700083aa2f1c4dda51739c4

SHA1
2bfd7b1eab49e436daafdb37c473fe35d9689894

SHA256
354e0fd0abe4eb992f9ce74a4156dc74aec93985ef092d8d57ec2f6d5fd255bf

SHA512
551dce7206e19cc3d976f3cf9ceb2b40399f5c465667c36d5a93c3e43860231338faaacfa2911ac1ce02c4a7af3d46cbe0e291c0061d9d214e82aaf36151744b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5acb98270151ada19c4952734b3b5b44

SHA1
626c2a561d7394eef2e23a77cdec901051b780ac

SHA256
0d728d4c1e16aa338aea080ed9e6660e821f4b28d520488c6b005cee6b68ea15

SHA512
13cb9493cd71f9d43ceb0b376c503c9b3b036754ef315a3886d7d04ef2d2fe224eff0b42c51e2ee536fbb2dde73b737e35c0b705ddb782b2f8d891b0c254a838

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B76.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BA7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit