e57c69b53a8e8ed75220df4f37860cd370278af4743f8980e7f5fca6adf8cf6d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8dda2f6a2d3703d4d8a908bc427de9_JaffaCakes118.html
Size

20KB
MD5

3e8dda2f6a2d3703d4d8a908bc427de9
SHA1

f58826829bbb6c407d65314f9814028a8b2e2d96
SHA256

e57c69b53a8e8ed75220df4f37860cd370278af4743f8980e7f5fca6adf8cf6d
SHA512

0c943e8de00209a15fb463bb18f6ee07f6d33a3c9b988ea6d15ab59e8ffda766189241e49ccb431f3d39d46e72ccabdfb3bbf8ce8dec5a442d675ba73b3f6326
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIO4GzUnjBhKs82qDB8:SIMd0I5nvH1svK/xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0177DCB1-1102-11EF-89B4-66A5A0AB388F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421750448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2184	2964	iexplore.exe	28
PID 2964 wrote to memory of 2184	2964	iexplore.exe	28
PID 2964 wrote to memory of 2184	2964	iexplore.exe	28
PID 2964 wrote to memory of 2184	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e8dda2f6a2d3703d4d8a908bc427de9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
405a81008c43a908f52d216fbefc73a1

SHA1
c0e265bc00aaf48158a060635881246583c436ad

SHA256
bfa2ec89e49ec490b7cdfd7cb14d723c72639378a5f32acec604a10a69df588e

SHA512
2808ecc34651f08607e727d4ea3d0b1261987f198ff7ee3e9afb57dc3ac8025f4cd68db75139e06064b4cc7de748d1ef93e147a89c0689da1b970781ca61ab1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84110e622fd924aa28cd0ad20c2552ba

SHA1
7a18418c49c61e239c819519a6ed67b8c3fd2039

SHA256
41e4ce853f1cd805b70520e8c52969a26e8c6ddba9eb57ba39b4278e9f51d7d0

SHA512
ed1b11fd848b22664f4210cbc09317388bfd8b55776e2f08d113f5624f24a103e05952f4e49aeb76f00526d17b253f9ed32e8cfbea9cee0609dd231372e7e52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4588403e24a03d110e9d7a5a0f109c2c

SHA1
94dbc757e302f059854e5a22ebc887b3a6213a18

SHA256
fec526e2228ff12e5d73949009610c696ee40c46d3f1f1f18b54be14038d27e6

SHA512
8e55f628749bd702c1bb7d8e5c5edbe3c297165f3347e1a66ddc0babe92dc1816efa8d2b3c02c5acb3967b25f057c8e3c39adc0d896a814274396bf6102db4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9895c74d02e5100b68c573c04b788a8a

SHA1
c25141a756b1b51856a85c5d40c3c20b6bc709be

SHA256
c20a026866755ab2aa885a982bcfa27f15e034c79b5081307971f70d82249f8c

SHA512
6fe96cbfab4af743df76467f28345bcba62ff4bb8569aaafee7afc024cd9f195fb544c529398c14c1619f25df27b8c2078fb5aa520ea2e7d59a103e90117410b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4685630bf172d0e93336d643de78fe16

SHA1
627ffbc3661ced2eb5973a4442bbb57e2304e1b7

SHA256
94ff118981ea3c40e8e7ae8cb73f17d0a204acb798b751b5d1abe2553d6d4a02

SHA512
9b753085ea574d3c1ce31e69af7c51fd09dbf168305f224938ace393a5657accce30be26909273902eb6344685c3bd0a08180e745177fda3eee6eed747c05ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e2a6cc0b692d8e8772aa2f12657bdf

SHA1
821af0c6c77b862ac0300e755b4bd82965a72280

SHA256
bd24c7ff0ba5366b2f2771f17546f0efb0ed66708bb79ad4104fcef8573fd72f

SHA512
b1dbbcd5e2737f5aa05e7c81a6798812cbaa1e471ea4b40414d9ce99eee1264c0d879a77e78355dfd5c411a4bae6641d5e3b8abc103dcb57977ed34a2bc78d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53698e00362db5966e207c0524c2960

SHA1
07c1f955fd1b5c7e84901ee15c5ae2975f6f6ab2

SHA256
cba279e5978ab7d80243b04811e9528b937dd13bb52bf27ae2256718465107c7

SHA512
b367b20b557ae7775082c82709b3e14467d6f56d98f6a4f620a1c5ef435d4133c6393461f23369d1681ba67128762106a45b0dc7c83df4c161d2814ea07475a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
726d48973009312ee5e1763bc79b4933

SHA1
59f64b379096912609e9a9648cf9602dc609d0c4

SHA256
675a551ae1830bee4efd49a2782f4dce674a060ac6bf4fe99eb54476291efa28

SHA512
0b55fd725c1adea9704de7b0909d367734835fe63ba625675418078c8aec0bbd8e1ab05cc8329bed9153c2c0809910bb70091bb49727e8108d67e8b2a8ac4172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d375e4b028ebe4cb8e8c2968e7d23c42

SHA1
e1e14eedfb11e9d2e8dfea6b1b2ac9c81d1491a2

SHA256
dbe6fdaac16669975a1979ff8f5857fd9196b00a6d07325531b3b11e5ed8b1e2

SHA512
e9a0b9e1f7bb56951af3374b80b7c259a260d39482b7f04a987201978618323bf5605691db9b67d4f516668acc659258ab78ad6ad2554fcd87b8774aa9c801f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2242.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22A3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit