c34afdb993305a8186b015cac308e0e3024ee50f71b3fa3154f22233d2266d77

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

719edebb74e081315f3029e3a29c8200_JaffaCakes118.html
Size

18KB
MD5

719edebb74e081315f3029e3a29c8200
SHA1

d4decfffc7dc4a2590249014c18ea4da8ff98258
SHA256

c34afdb993305a8186b015cac308e0e3024ee50f71b3fa3154f22233d2266d77
SHA512

82528006bc4e24e36257df10576ba13db52b1343b7409e8a591a38dfc4d508e90e52801b0b73a6b8e731404d2fdc35193b147563c1e5fa66a311d74b7451e86e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoA8c4HzUnjBhZz82qDB8:SIMd0I5nvHksvZoxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422794013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C066F3A1-1A7F-11EF-AD44-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2956	2400	iexplore.exe	28
PID 2400 wrote to memory of 2956	2400	iexplore.exe	28
PID 2400 wrote to memory of 2956	2400	iexplore.exe	28
PID 2400 wrote to memory of 2956	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\719edebb74e081315f3029e3a29c8200_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93ac0969b51ecdcabd981a476f43eed9

SHA1
2e4bc0df32bb9d2ef18c6bd1d225939428d892ef

SHA256
23aeceb634e400d700d591d27a3e07ae66d1571c89eae992ce6df13e44946b33

SHA512
7595408116edc1a372bf1716a4cd2189d2f040e0a660b66012ac58dbc2f940ec124647fb1461ab8834076994491ae1455e780aecb3379bd01184e7c93d17a773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3f00c7ef349cb983e32349060e1f99

SHA1
3b16be81e15b0d788f534f2f4a8758a044a8403e

SHA256
fc77fe7e4179050f26a571dc4c31301fa1728f1dcd6217f1936ba62d09354212

SHA512
3de0da6a2521f8e2e477f6cad5fc49c0f6fb6adfc488885f9185307c52d785630b358de21c8ea78d31becd62b0a7a0a40dde5e1ce28e79677b392dd63dbc0844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e602dce415802541ee7af3e2d0b094d9

SHA1
8369b3c84d161b5f088279fbd7947e599e324ed8

SHA256
73d1a4bf546ad9caa5c733654398058440e63709b5411d27633ecba590f667a5

SHA512
935186182583c2f897eb8da2555e8a948b44938c88fe325ac85c72c26744b72c460e6b7539f43c73de47a31a85cb9d9fb7d08ccb2fbb968ca682bd5d416f160d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
006c025872b7ad5724f0dc6d88582614

SHA1
614398062d2a10ab0a8b6e8d66ca09ca3e0b1403

SHA256
cff1cc9ed721d5f7aa0adda8ed6c8cef3186951c1f13e750393ff9cfec82cd5d

SHA512
f674151ed65a845995fba4ae11f1779a96833a83185aa3697a62ece28825f29cea58c545ad1c4d98f3394a9f521ad15f189eaa375f5f6ce27aa26d537230c7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
125e42e227c5bf0bd149d47c4d9fa0e6

SHA1
49eefa6cda1adccec8c4c656e55f86c6c9ee864d

SHA256
066a95b1a7e99ead230476ea7fa955810568a2f1f2e134feb267cfb00f20df51

SHA512
efb82961fca17bc8882324c7c3e290c0d321cbfff4299b9082cca89322046ed72c0cf01394f37c6dc1a1db75c3b54c9dfec2e2af4606fc746ba199196278cfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
150aa18450b9dab2f4d7b0d508e3fa10

SHA1
d3b37f96ac9098767cd138b1c45ffcbf819dba2c

SHA256
cb50087a490888d3f12d69bbfb099d37156a44c7d3826b17da45f1e7d9890281

SHA512
1ffdab68a65e679c2a77220f0fecfb6e7248c733d118792c8adc80b91b1b0ff43e5b7a8a02d7a963cf147d7592040a2333d18c0f6c531b61a1a5f5c546cedeeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba08b7c4ef27922360fd96453a1238b8

SHA1
c03c4a40b744654959d1efb7cd8b1bf3b7827223

SHA256
83d04216acf5ed6a52bf28ad59de18651e7857f3d1bc82b1740fc5ac73f59e1d

SHA512
9e264d44cadb741f28c1fdedbae200efda76f921be7bdec3b5c9298c3cf273b4fa3cef1213936bedb2efed246fc03408ea224aae3c2af7b5c99bc7f4027eaa99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18328493e97ec9363a8df2d54773023

SHA1
c3a84bd79c46eb9f828e9774cd15d392153ff1b4

SHA256
912ff20a92cbf78b68500965834a93e7514ab842a26ca4bfe59d6e8d881cb483

SHA512
504df292e9101ef890b9389a632f4a8e020282aafacd28e840b8172d36566862936fed3a452a5b1a63b7f6433481b09fff9d59d823989c442f6c84a16c6d36b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edef33be13c558fd545c124e92bae176

SHA1
a54f4aa773f0956bc1acaf4a006943cf30c75837

SHA256
c88d5954c66c3d413d7f08905c47aa79e19e72e5f14fd3e58df26f21f8c9fd70

SHA512
1062926ddea970ac74c5e7279b01dabd44d52478940adf6d5432928669b1ea9270705a888b7d15b36deff9c5d10e200b7f64d3ed7e6bf1d36932ba7735f38faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab258C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25ED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit