3002a4dd662605d36af82c394c6792b76c274212edaeed2fe8fda58c31b2162b

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f0e7d766c8cfea251998dba4784c5fd_JaffaCakes118.html
Size

159KB
MD5

3f0e7d766c8cfea251998dba4784c5fd
SHA1

fda84fb8ee0dc457078777df03d002df786fc224
SHA256

3002a4dd662605d36af82c394c6792b76c274212edaeed2fe8fda58c31b2162b
SHA512

fd26611ff635a224fb62dedb95be670736104b2b152c96edc609320dfe6d6c609f52c54dc2f9cc32e023885d35dd24953b6c6f8a9052b3accb07c02c7d12deb1
SSDEEP

1536:X7HX64bdL0lyDNQFYLgPBQFqPQF3qQF2JQFPFQFtvQFd3aQ5cVa0q6050b3C+UJQ:XTdL0lyDEw81UBdw5owN24P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55B01D31-1114-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421758320"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3016	2868	iexplore.exe	28
PID 2868 wrote to memory of 3016	2868	iexplore.exe	28
PID 2868 wrote to memory of 3016	2868	iexplore.exe	28
PID 2868 wrote to memory of 3016	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f0e7d766c8cfea251998dba4784c5fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005163aa60573691b6c85d71daeaf968

SHA1
b3687559ab741e83e965b8fc54f03e3e87b8fe73

SHA256
cfe639c30da4bc6a028d7e16ffcb777cf99cb725985ff51d5fe09d89fe4d1c7a

SHA512
c7964f6d272db196a7dc42e16ed1e3ef10c44126674609c63439201bbdaed642edbe2c7608026ba1da2de9842fd6c42a54a2b34d5d28d10a186cb03fa2f134b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffbd60e2df4e792f4686e70b6ee91bc

SHA1
b2f1c7a796b84da387848f821356df9afa804435

SHA256
3e989c1e02c797aa8c5a3b48f78ab1f7c09997585c35ef87e849a8c734a2ff7d

SHA512
e9dd165f3a0d07c224c22345264cf0ef889f165b893f6a8da7826dfcbd8fd40f9c333cc2cc42d87f50f9f7669a4486cd60c9609b7da3900615d79425f69c3112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd995edede350fe95dc737475079f36a

SHA1
f3fb09d886c35758ac88c0adf311ab6f691c5499

SHA256
19fa6fb827e9ec93797fd52e8baac19f331196d1b8b6dd778116b830aa2dd173

SHA512
5d9218a04ba433fbcdd238aa20b0f340af5d6638184cc32814a7b056fa15670474b9a83484add1417f78aa209d40069d7560b2433c509c0a73c5b4b98855fd53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15aca00422f9dc322480fcee0ca340bf

SHA1
1d50813ae10e268a63f66c361fe4b6b1a3bc2346

SHA256
d9260e2ea051074060ea5e3bbb10ff70cbc8d3294a148814f58d2ad4e89aa46c

SHA512
0ab90bfd9a25b31a3268296fa78c88a6d5b0c7f40f0d920e69a698e401d99c9e2bb443e3bfd64a89c99a85c271e562cb39f0b51e9d704d3db7f36cf1001edd8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec965e625cb14956ca86d6dc5f170cc

SHA1
01593942a3c59f3484ec7623b270a6c23329082f

SHA256
d8736235e8c6aee7ffe217be4a02a7b4866235a0c3a9f821cfec9e66d009d1f6

SHA512
8f04280dbc35e334d6bd3170b863a3d2315d448eed937f0f49cf6a66cd9a02595138cb993bf35c6874f7b00036984f30603f6af3411cdade06627220d47c8683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0f06f916e60fab54fe1f8ea3a0fd80

SHA1
b6da26bc13930727e30ba08859a8a074e6568846

SHA256
23c16abeaf633cb25a13ba5d7f5c8677f195edcfe0a825c0bee730fb34858eb9

SHA512
ee69f0c3051dcb2b4150526ad1dd15dca52fbc2b1f04115b8e22f9ba4b87d17ae01c11a4d78d9883c07fb2bc8b6d59d4c34de5c9ce6d4625ab14292da7a8a96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c968b04ee0419aed2ba159cffea28a

SHA1
92855fb15ffc985b14f8e799f69aedeecd97c09d

SHA256
24f0c13d1d61bb2bff52881c356495193ae0cedb2e42dc57cf8fed9b875bf16f

SHA512
9f32c11df3c200a06bbd95d69b4124209e90ad3d771c14d35d39f421f81beeae70f0f3b451d56b7c0f58f4f52c067077c66ea413d8f53c4da60706a9cc5e5d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c55a09316e47cec02334380d99c761

SHA1
d664380d4d9b8a1ab37919e5f645ec8a55e582c2

SHA256
f344ac6a62c4c57219a65143087260c6f717b43b595de79fd91a0e35dc81746d

SHA512
751336d4d9ca266e826fde54ad59eb132e19b8bc46485f1bc73b78bce8e0731e5f5187cd3fc029e7a5d2ae9d4e3c53829c972fc949c20de51fd78aba22b925bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fada344297ec1212b2d0eba11ed9609

SHA1
e0ef8ace9926299a9219e7fec648d22fa107f034

SHA256
8f49ce609c0f1f5b7ed7ea9962dbe0ac0e1232e1e4615c79b784c1d008b7105c

SHA512
64ed6f4423d790e877a77c4e7be21169711c39c3c33dab691059985f03cc5aa9806c922136eb37b965937811fba943bff8c2f90e9190c7dde42173b0b4f879df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A10.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B51.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit