df8082971300028b65d1a7a7049b1fdc2c2604fc17760c523c5079d7106e61d5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html
Size

24KB
MD5

3bf2749d1d08582a605c3cfb21f63777
SHA1

642ea6f9757f9de0b4f7a9e0ce7ac59560d58b84
SHA256

df8082971300028b65d1a7a7049b1fdc2c2604fc17760c523c5079d7106e61d5
SHA512

bb696d520318747d26c2b0339a26ac0e70d44c233e898ec729b1a93e78025bdb93cea0a1919b51d3f94abd7accc911cf05c3581c9f7d47de6e4db3cf53343a52
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIa48zUnjBhQa82qDB8:SIMd0I5nvHvsvQZxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421707994"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A15C911-109F-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28
PID 3000 wrote to memory of 2080	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bf2749d1d08582a605c3cfb21f63777_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4750f5b5fda7f895e6e8a0f5ba5e097

SHA1
0e0480c643f6c96f912188218935884370ab2e33

SHA256
93802e9cfab6fddf7aece84507fe225595ca64958fb9904d19a9e187416f199b

SHA512
cd8af9532a13bcfd8378030cc78c3c20bbdb74b494be0239cb8c1268f01b5a4114cec923abf9654ded867adec145e3380369dd1ef93966da60a88c378b1e949d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aea5920122354193bd05fc2d1e8ae85

SHA1
cf522918da518d7d1eae06f9b25f068592958265

SHA256
a75fc25ccd0305e68cae76b279f686d3749382ea014bbadb71cc94f66955c538

SHA512
d71c878080bff5e2970b595423eb156bed6e47cf98ce40157a56bf84262dc4f788f914a3899ec0847a8ab807e88bd6c27ab8ebd5f0d9fd9c3a501dca04b4ddfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b55c051de4bb01be5aef305393b9637e

SHA1
5c64be84ea181b25b7de562c8d41257b13fe6ff0

SHA256
614534263f911cba0ccf8680843594b8827a4cb1cc7c5b7aa5fc45f82ec0aba9

SHA512
cdcfe9cbeb457a5098ca2572abb53119a285b3a8212bf30e57942b290b9c93437ecc7515e4be15d15a82bc05fc6fb999c9033dcbb30fd36b5e10ff7cc2ff1166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6751ec6f8d28914af6522d21c3fd96

SHA1
8e76f490535db1b73a4438932fab9c931d55b546

SHA256
212ffcd5b1c8972be1d0504a0216cbbca39c5cc742f03e87200f7c112d6bd220

SHA512
0032ccd212a74ba858dae47254bfeab84efb6d2cdf36662d2820be20479c41ffaaa6dabb9acea83302360ab6d0d3afc33879ceb1f5945c5b1a28f7cfe00ab2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61305cc46ad4499b69dd24c0aed1bd6

SHA1
2713130d8d7fd4b7873183f9137f65659793662a

SHA256
94c7d1524e0bdf56736000f6deac714ad299320c57c73c42a75fa10e83230d58

SHA512
bf870510f5c9a11f63f5da04780eecd2d2513a092063f6790b07582b6aca7f3f623534d269f64b6d81f5b849491214ae8e94a52b108dc18da4904cd959627c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b17e66e581cd823a10180cdbe330e8ef

SHA1
8e930e45965f06ed006353583a3202ea04aa9cc3

SHA256
673985afcc737d83815410777824c32750f1301fe4e7372c1978f48dc3ef7b03

SHA512
53f2541f25e48b28e4ebdee25e3a0da908a24be52b3adf986ab0f9f1f875b1ca10ff54e8c62d027fd35c6212a36fdc20182a03617d48b43aae12e812bf061421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
203522d951308f29c9654d7b5353b073

SHA1
aa6dc798f3ddec816ca7ff4016f95d20e091b108

SHA256
34641c37d6b7285c6da524a97af408ad24a1eaa04611a746a054ac8ec2dbb22d

SHA512
759531b28df60588544c9fd446afb9f0a22293cc1e0af3921be608275797ebecd5e0e62b3c19204b77e3f253510ab6b6797bfdb1bcbb5f2c8ef79a2a2ed8568c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e7b58f2e01af37c165c1c25ba32377

SHA1
5da5742b566325dd2f356227380f45992e7fdafe

SHA256
91b7ce230de0362221361fc1d0f3a8e788ca59409012ad857872764da4c20c33

SHA512
0b1573c50fd7dbc19a046d6c18797ce895d1b006ff36e3c81924ecb460b67beaccb1a471b89710942d455eb28e263949e178048d6dcdb93b2c880048f3a1b951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit