2e27fcf89eff41a53eaf69b200b6d7fe5d8e43ef5ae409a5d52a9a0088fa371d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77224c5aa36fc06fd6f337db2b827540_JaffaCakes118.html
Size

31KB
MD5

77224c5aa36fc06fd6f337db2b827540
SHA1

27bedf5f99fe9a8828e49a4b3520a71591958fc1
SHA256

2e27fcf89eff41a53eaf69b200b6d7fe5d8e43ef5ae409a5d52a9a0088fa371d
SHA512

bbf5b9518afd8f452be6e818cebfca2e98bcfc78957289a2c6ed0ac25663ad60d666e747d5110f07e324682146fb03b9fb1870f463dc373fce8435849b7806d5
SSDEEP

192:RYvoZ3Yb5n4nQjLntQ/cnQieqninQOkrntadnQTbnInQ2WA4v9HM6nFnQ5anYnQM:yvoJ2Q/beA4l2cA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422927238"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0B522C1-1BB5-11EF-A5E3-DA219DA76A91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2984	2008	iexplore.exe	28
PID 2008 wrote to memory of 2984	2008	iexplore.exe	28
PID 2008 wrote to memory of 2984	2008	iexplore.exe	28
PID 2008 wrote to memory of 2984	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77224c5aa36fc06fd6f337db2b827540_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba5e71dd5540db892d6296e263851e6

SHA1
e79d5e8e6cb40ea9b67331cf6a2c0f5835101f9a

SHA256
6a691985cb0c29a70ea024ef3a9ccb330e6160aeb9a1503d1d0c2fe7c5e6b1cf

SHA512
fa5452d2ba8ec2a74bd6ce745b6bf70b750072fa736933379e3aa2fc81986649a4648a3941160da05157bca8093002a2c778b4d810e4e472b0aa1966ae654df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e22851edde7106c06507e2155764437a

SHA1
0cd10d6bcaef8ca95ab885a7b5a1d1a3144d9195

SHA256
8be5133c428418be62a42fb66ceb2fce21652244704fa961a10d29d42b059dea

SHA512
d920975d494d222e94caffb48d29afdf922ac73bb9ac4db4ba83a6abddd4f40051b032f5e28e29e8a11f8b15f4cddfe710e5885aa417016ae1306f9c43634a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
398f0c6041dc1aae9f6470b649627561

SHA1
d97a2d4829e1b1391638950c890f49d65cef0773

SHA256
6a598b5796c8f7f1b0d1835fb481c27f8027d5d8dd1470456ef771a2c260a376

SHA512
7c6ead652c7bc75fa2f61f6534a4137f23c2b8c8d32cb91e0e6e257021349a1cb3386ec0876ed1c91e0da012b85b458bd96fc4640670fd5e01944dc7ed725248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ee7390842479c2b18c2bb77677150a

SHA1
f2d966748528ab5164bbc7055fd59af870c2b5c8

SHA256
92186f13d58629665d3c1ead60f88ac171e39dadd28ca080951537139ae8e579

SHA512
bccec5f882d86ac3255614bc614860fdd077bb12393e0cd10ad46f2ac751862a5e6c3e0afd2d0dc97965be4e076e9e84c41d1a08f139903c7630f9d0cd185276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
317de446588f7d1740122d6064f422d8

SHA1
b93233cddfaeef1d3327484f2b0e6f06bff49831

SHA256
fa88b8f5e7ba8ef422f0a6b059ed985f1004281cb6d98b3011e28b7eeaa1fe1a

SHA512
5f0fdc6764b4e3990accedfd3fb56b72174d817c8f2700159fe408dcfcd651c34a8c978fe7f6b5e2d605ff7ad000fad85d8c081bfcefa4b7727634602ed2a5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
349de764263fd34467190e3a4d671980

SHA1
2f76de45aae67b74628ae06576720b7b06dbedfa

SHA256
b96979ecb3fb4ae53d68f2c29aa662060ddfdfc3c22c16dfbfb02bcf4f50df65

SHA512
6d0ec4109e79688ecf4588c4709a40ad06d8dda5f98246ef4d807f88d632b9b825652330551f0b196a31a3df1096aacbac9d7aa37f85b60dfe92533534e2b83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df1187032457f12151a2006815ac453b

SHA1
50d92cf266ef62975d3d8c4151e369de8a25d0d2

SHA256
3db6ace3daf18b9afd04ddcb5cca05fa94a02aea058dc5e0055aa051777bf90c

SHA512
3b9260d0e1ce1d8334c5c8c7777542402e5c6f1585cea83894fd1a7edd91702c88cd06017744adaa681cef3267bbac247af9726d1c695e1e2e90b75a9a19ea50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e9c9f3e91f0db8cda519b640821080

SHA1
6ca4baf0664c8545640fec33341381b8c6a8bb36

SHA256
8b0e49d3d6fc4e2b666162bdf785bd930ee6fe3d744d61129100f7bddedc4dba

SHA512
c5b5c05e88e004f48f3eccdb89acaf05dda9ae85a96ff6940d3e465890f75faf63d5b5b11739ce4585ae4c9bc1d1669e3ce651ed734841f549ac483ebe7b7b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
302b56b8382e3d6856d3a5ad93fae690

SHA1
be87c8a205319281b9dccc8ddaea24098cabe8be

SHA256
81d21b24983649de1e8c98033c1431dfee91badfc072da57a8247190c5efbc8e

SHA512
3a8f8805d830416cb24265806db747624a828025f7935d680789c09006bb2687d6cb8c3e2aa38bfdaa29160b47f21b8da55311048751e4d6335f49490a897efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE36.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE87.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit