1ef50449d823d3a79d6e775f6d61f1d23b5cf35374168e40b0f79c51b561bc6b

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c08bb2fdf59c2d9d433bd636c7deedf_JaffaCakes118.html
Size

18KB
MD5

3c08bb2fdf59c2d9d433bd636c7deedf
SHA1

b40df2987eafc3bff0a58346645c0a12f8fb0c5b
SHA256

1ef50449d823d3a79d6e775f6d61f1d23b5cf35374168e40b0f79c51b561bc6b
SHA512

097a7b87bf73b51762af43fb0d65c40f80973ed7fdbc6b567af4e6fafb73ab61c57b7c87144248a1e5a67d0eadd67aff03a8ed2c1da405df138afc68adb4e47b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIRxVhxj4WfPv3RUN+0zUnjBhucGu82qDB8:SIMd0I5nvHNsvjuxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2213BD01-10A2-11EF-B02E-F637117826CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421709269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1300	3052	iexplore.exe	28
PID 3052 wrote to memory of 1300	3052	iexplore.exe	28
PID 3052 wrote to memory of 1300	3052	iexplore.exe	28
PID 3052 wrote to memory of 1300	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c08bb2fdf59c2d9d433bd636c7deedf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697ff89f1ace96dd90ab37ae1d056a09

SHA1
b6cc062e4b5e21c3f36bbb4436804aa81d532c68

SHA256
cc669b1a73ea2131ff86f8c356a1b17b3c849250a80276d80fa1f6421bc7ed28

SHA512
2d5a31426a22969ca56952f48d977d66de99b2c8dae943325d6151724fb9bdf6a98f198373039e625b3375e384fc8734bc5b3d625539b8eb19c420fa5995ed31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e091d57dc8c954d7abfa98c111de5c5a

SHA1
d39c439b18c235c4b9730e7b2ce5a3227494594d

SHA256
a679c633e8536ba94239fe438bbe483b3d78fdcd19b5e9a77e6a0b5fbe467e7e

SHA512
6697d288618fbf6a067374eb55ac47db2cde57a3c6129f4963e96f8c4eb5a5481fd8e8091a550e9fec0ecf073790233ee72e18e0d762f2fbeb61287eeef2a2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa2a2202f490e60298b785a7bfb2ea5

SHA1
1d4d6cc28d6bda91e52eb77faa3fede59b4bfbe1

SHA256
9f5f2155d5432b34fdcde9dc1d0a20a0ce1ecd0a8b4311e91ed23eb0cced1a5d

SHA512
c4584a57a7b74d955400cfad400912a6681f85278e4188c54e9c9e92600bde14d36e1a52b6bd78516817cd55c1d977f457a5c44f6bd8c29f56bb2b8f028988cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51fb9812a84c1bb7d2f36944a5412fcd

SHA1
c6f32e7a8e94edfa6aa9eb0ea2fe7d7499dbbd16

SHA256
7675bf3e4bad1cedb543d551d575393a1ca0ae30ae68457783898d8cec362cbb

SHA512
93b0e70f7df9afd2534c15fad63a3068f8023d454b0fa4d23bcc5ac8ca374d727f4b3953211b7c5d997675ad248bd5cdab0965616146c809ade5b384e0cbd537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b8057925fbb8ceaa060a74e56dabf5

SHA1
f2b13212a0fbf58b32490d3631f2a21656ccc946

SHA256
9404d9de426817f467203b5ae91bd0b38b87a11b8917bf2fdfadfd46a2f1b2bc

SHA512
404a7fa80fa3bd4e1cf92328c2cb6f30c9bae272a375e1e3bab1cad2a3741be09321b05f27fecd7dcf28765f6a1576e6b5cc86ddcd8e996abb67b85bd51e9314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba6c6ff8a793ffde4010d0da88b420a

SHA1
930595d005b88e26f3e79fe86e2d5f6830db8804

SHA256
a555da067ef3236e452922770b54b504d8e3a73610abcf35e438eac54b84e748

SHA512
78cdad1ddd40795fbdeaa67f990013a9c2fcabdcd960b414b954c296f440ec9988f1949f50c97bc1741d9dabdc103d30641a148d87ba01be641049f2f5c969c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b7239670f1b026dad4fafff745782e

SHA1
6c3efadc77d837fb2a044031e1a62b7d10dc76cc

SHA256
9b244cbf062cbcae127e0de73fd62522d6995074444213326eb9e63019daf28d

SHA512
e8eec3b97e6fce4ce259fd597379f7499363c127074363be948c8e91c1115d43e33f0d2cb9c5bf25fdedfa5df6a84df6cb25fe34bbc883c4739c6f3ceb7c2c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62fc2ee8ffb4ab89595324e36a48cf5b

SHA1
ca4b37b42e1c3c2be3387078542375a40af95960

SHA256
2d6fe4d9a53e8558429864f4a9d39d7b39ed83d1ccdf603f00e12a1fe3a08c21

SHA512
a08c936baac3713ed59c8be47a8892c7dc8cba847db64e968a7e070294d868bdf20d4d5161016d98dc594809294822b8ac288be5c83f19ef3045bc3a6f4b3d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4043cc62e3711a04e272f87416861294

SHA1
609c5ef1be46bdadc243bc745e7ef41a353d244a

SHA256
5887357e94b81c3269625c24f02cb5afb4991b6de12fdd71599fbbfe6f151253

SHA512
34c388c1f071adb36c0882d40c186d0596bbb27f23a5e5b56a8826b83d5eb6a336e59d640a10e4b6f4f08e24f8e628781ef93d28f31372407b1f3ffa670f99eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10A6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10F7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit