2af8ad47656ce30dd686299e3a3b4df5992fc6f0fbaf32a294e5d96a9d2a13ec

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
Size

241KB
MD5

3b3b26573ae736ae332159230cf81aed
SHA1

ae55ee818e4ac5748c3950cef1fce860ecfe2ffe
SHA256

2af8ad47656ce30dd686299e3a3b4df5992fc6f0fbaf32a294e5d96a9d2a13ec
SHA512

a4b2c7f729645b7e69bbf722b2c023b3304e988ffd5af1adc750e88c24788392108158950f39a295b4cef9fff8ca3dc67a9e651a123b3132b57de9adc9dd1365
SSDEEP

1536:hdYkmBB2wP+KGtNc6a1I3Z8V+Q6yPr6vTQRGXRKeEWDnuoSfWVM0VIcJMvNg7fsQ:hdYJPxYapMCSRSJkM4NhsZBKt6Keju

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C29B1BC1-1083-11EF-9486-4AD8236FB259} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421696223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2760	2208	iexplore.exe	28
PID 2208 wrote to memory of 2760	2208	iexplore.exe	28
PID 2208 wrote to memory of 2760	2208	iexplore.exe	28
PID 2208 wrote to memory of 2760	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa4fc16c085cf91607a0276388e7f4e

SHA1
9c111a150935963cf4e573e93651b42d3b91c017

SHA256
579173f4a0287baa2534ac0b9ce9c21b4c155a6f2327d74896ba0ec5988eeaf0

SHA512
05fc7fe4c18ad8d91ec715532ee24e46bc7d43fb34074c1babb01fd50efe38dbbf4613ac188fb92ba3e5bfee92c015ea6faea0dc2ac3d750dcfcef408afed592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c2074ca370719409979c85d680c436

SHA1
5d4e9032ae61c04c9dab6134371e64e9145e98d1

SHA256
f8566913e368d47f33b8fe601bc1acad5875c721315f92a012ea323fbc409bd4

SHA512
fcb7c99fc582c35c53b3cd26553b34ad2054ec4ad988045bf209158c6c3281bf18369f0bfcd6c1972098163f08e2c5705a8f25076c00e52b98c836e37c738a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16192193d623dd0004323f2e35546c4f

SHA1
5b36d5025ca0e06104e8346afcf2a4a345d8ab45

SHA256
42949ad35c51c4f5175fe29c5aea8af8123e90a51ed0a400f4998569f0a1e292

SHA512
c5c7e2aa09619315523fdd6297ab4cedfe3b58fc288ae828bda39167bdc492bfddf0fee8f5f4149dc7f2071ca6f7ecd1e5c303ac7e61cfc50bc19ad2ddf6dd3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06479b6926663a9331a35eaa3ee3d11b

SHA1
e16c79d2d582a386b6545f93b419c0480ea93c7c

SHA256
4552b5fc93d99505285604293a4740f08d0ff9ec173cd05a2378b1ede0066b5e

SHA512
97a46287498f4f94977ad5c333843ff9b9a9564aba43946d111ea02102ba1a779f8597ce5560c5c93deafd5c6bbf70b8425ec59d95577795135a74b74c8eb78d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6205e27eee77220c6da066b87a183743

SHA1
b588380c680b8c430548a98e730c48a7e6b13892

SHA256
25b42b2932407001f4697fe7a0cfda32928892026b582ade716fbd84a455caff

SHA512
b1cab3b62b1ee8fab74ae077b0168776344b428d4b8e23979f65db0b562ccdef7ae8b1ce8cc7f4a211ed64298303744b88fc3841cdf011081df033e901c32ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eee4ffbe8ba57f88c2a04dc9a0b5cd2

SHA1
71549b11f3c0b9ba7500d7461886caae774b3d1c

SHA256
4d890c429c93e2eb92b050d1ed03d58fd15c421a3cd52c7c9cab096ea75ab5c8

SHA512
cf7b33170073c31b056fd4f388ee485fc20b47aed2ec4e8ee0dbcc546e49f71f309e9ec0bc78287c59131d8469f9a00550a19405c9348172814d3d24e1d6f274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bcfa3a73113981788e38d49c88bcb0a

SHA1
36eedb95ae99582503b5e3bd112d41451eb0529e

SHA256
f5ac9da0743967a678373f1cb65e613895068b4354711c6bfc3179de4aa169d0

SHA512
9597cc0c12ce7b70cd8d5a9ae6f290b58d0bb9b46162098e300f3582a1004fee3f6673219df4750f092af86af10378092225c9ce38711ba24f19092607f70a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00780352ba29f40ea67113f651499adf

SHA1
987977a16d9e2715154e42fa46b99b109c118986

SHA256
783aa643e28faf05dd266cf901d295ec7f430e75fe242bd9c171c11548bda6a8

SHA512
9d854f3f0654fd1564dc2cac08d5fc7c1096e2c76b54ceb61dca6f3d9cfeabf585d063c28a7b1b48e895d35996465fb4d0db0982bd8b4e42383636cf1040d989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f81f344a74bf1d612e578690bbb10ff

SHA1
c291cb185d52ab030f3ab2f4be29795c113dbe86

SHA256
b5e56d558a788f0cc757ae8e65c45f8b3d16fa470c0f5351cb80a4dc3d472f0f

SHA512
30fb57dedf9c20dd8bdf8d9b2eb4aa0867fa6b047df679bca5fbb2106cc388724023ae27a563aa002361bb7791f8b281a707dcf6d2cd9befec877eff9a205440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b674a8a52f9af8b4301ca287047181c4

SHA1
f48a2d72624e8868f905acefa825c98df0a9b069

SHA256
010a7b28f79d45b5f42a9897db614c85e6e7a326ce39ff90d6eaef1d5ef88262

SHA512
cbdcdaf26c0c8bc15dfdc2a8bd9009c0b692552ef3f36211abed06bbc8315cd6f8b49dbfeabd6eb6d64d714f910d0aad18b1f05b6bd747d1a9989e308f479e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\b[5].htm

Filesize
178B

MD5
cd2e0e43980a00fb6a2742d3afd803b8

SHA1
81ffbd1712afe8cdf138b570c0fc9934742c33c1

SHA256
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

SHA512
0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2166.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2169.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit