3748eed2d474d7ce730a989cfcc652c9c0f4efe52add32f50f510ce88f7a05b7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html
Size

32KB
MD5

635d2b9289c436e78ddf28bb6cf77c2b
SHA1

79d265861d47a968c397c97a7cc077ca6503e4d8
SHA256

3748eed2d474d7ce730a989cfcc652c9c0f4efe52add32f50f510ce88f7a05b7
SHA512

4968bf1202f18fe714320180fb4dd265513f3f14a243ff31beb2771a3b832d80277f3a4fb490c1c7c0fce6dea7eb07c474465c7e231ebf57f3075bd253c7f3ab
SSDEEP

768:lzwqFG9bCfCnCkparfGrYFDWbN8f7oO0/DtCNlnVom5hg4:VnFG9beahparfGrq+NPO0/DtCNF5hg4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422457879"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{205E6841-1771-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2148	2988	iexplore.exe	28
PID 2988 wrote to memory of 2148	2988	iexplore.exe	28
PID 2988 wrote to memory of 2148	2988	iexplore.exe	28
PID 2988 wrote to memory of 2148	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\635d2b9289c436e78ddf28bb6cf77c2b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a82d4d555671d74bcdc2f8bfdfd20f22

SHA1
d23b5afbaf41da0da166313e44d07191365d7086

SHA256
0aaea7fad4ca40de2661109c3f8861cd56f476b1ea0c983b8831d375e9bffd5f

SHA512
9300c76fb9a86dd2cb8f7c4adb1d76270a515e8387294afd2569922c64f9ecf0e3e2e3c7c3c25a58d7e4eb21497dc05fbfa7049cc9d845e4ae925f263855a799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85fa19d43d7ea48edf36516860da862d

SHA1
51e19449a48b73269c18d2acaa9a039e96089710

SHA256
49b5a221224b199d48cf4f319d65b281a8cccd86bce3daaa945891856598e01c

SHA512
13b979c7b6a8914384df89c58a2f64c77dc46de04c1586615a58343eeeac9720986a70c456947d8a3494d5ac7a163d71ed75e01f683b05283daf30729ad6bd42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07524dcdeaefc7e4f8664b55a69cc5a0

SHA1
b0343477dce30a8626ef44c215938b7fdca6f7de

SHA256
567725acf12843b6b91e75b3660df8d7a3208186b98a997c4ccb0c1a63a7c7a8

SHA512
9c8fc8b7881bb5894b467c0a01a25a5444052b8189070c4ab6912f806169a0df493b19a9cd2df86ab41eed86ec0748c55c943646f6d184a6575670740b782fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1801e173f8e4fa495107f2959bf803e7

SHA1
c8b3d7bfb863284b219c40f05f45612e66bc065b

SHA256
e51456a3f084d49aa79bb6d38596d7e7dff725458fc1d7bfc2d059e92ec213bd

SHA512
cfe4e76e0a768b1506405e7586218644837c28d919f7545035db0fa443580dd58623134feae8c5a2a200cfece087581672fee07fa796b46f3d38ce791071e6c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a411bda25788af3cb191017d877fc48

SHA1
2772135d6a0e8bdcf8a55e856cafd4d9a29c37e8

SHA256
1a21e29a512f876af4372726313059468e75fd80447e8be550a063f37070f38a

SHA512
399c9cf10f56ea85c12e1118eb818a999878feae32270cc19fd2388b88460ec1a8e41a70d2761c3dc9755b1efbc01e01ca27126ba0d77b34b8bbb8a2d05b3fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b42d271a0110bb0fc03b6b0c80f7e8cf

SHA1
02367d0301d5402a51bfe5a8aece5b24fb086ca8

SHA256
cd035d2715f582a6b98cd94071a67e077c36dd861d4822f458e53989f0c4aa7f

SHA512
664428c4a2dfcf8606cfc098801ca7a8610d6afa500bd60c1a6f828fe24617b7ed38e6b77dec899add99b30d9f6b87c23061ee7687afae60f881bf98fecc92dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88b971efd415c1ac78430fe36eb8b471

SHA1
1ac743e11f6a1e923d16fffb45cbfeae7a123d1f

SHA256
ac71dc0d071b9937dfb2b5a21caf59a16808ebf58481443f44a8fb428b4c9410

SHA512
c63a5ae1d554df18c4b7a0a4a2e1245b0191335ac98818d6f92be795ef493bf1ea2cb5db9112192ae651addf3d707e4da113ed6e77aad965d835995935ee946f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb032c6bee13aba9d8875e24c5786c1a

SHA1
f73edc3ba10c4550a226d3cdbf7105b83c5de745

SHA256
54aa7560b0c7d0251d7006334b92840b07f0c4cbe0e3b489c62c7322d032cf8b

SHA512
2e617bcdba19a055f631e255808d80326acfdb8c5179df2e10600e7003051b88971f4b34c6ed0657676fa196cde44d884a7473a362a54cb670307709e79c1374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3460e02e20ae77a4115e417f9833e8b

SHA1
b5ff8b5ff94dd1bceb06ebf5f3f1d87801e2e00e

SHA256
e6d31ed17762ef18747202456cf95c5ef93ca3dd171a0c5d9632aa1ac0c1b67c

SHA512
bdddb5a2355f29d744d3c2846982b36d73bac4104efb312b37a7b8751e92e4a7d7c468cdf3c6b5bd8140162bd48dc52ad8e7c41d6c4eb2a5e41fcec9c12fc377

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3276.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3401.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit