3e84c0f165e22424aaef75ddae37a347a38a12d501eb2b63aa48f6d909232fe4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

750a3edf968e14ebfbb7cebec57cdbaf_JaffaCakes118.html
Size

42KB
MD5

750a3edf968e14ebfbb7cebec57cdbaf
SHA1

0a22fb595c58bb393db81ccd354cb17f4c5509c1
SHA256

3e84c0f165e22424aaef75ddae37a347a38a12d501eb2b63aa48f6d909232fe4
SHA512

4309d1f0f8ef9021a87da16db9b69c59150ff678f27b0be88e673b8e75a0e2e800e37dbfd58f6036beb8ff51382e69e9c80c52d6aebb908a717364d1828fa163
SSDEEP

384:rQ/xhx1B/hqcuLj5fCvBOQqgUsDeMtKwDMfkbfnu+Jxb:5+dy2iAl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422877785"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC6D7E31-1B42-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2648	2908	iexplore.exe	28
PID 2908 wrote to memory of 2648	2908	iexplore.exe	28
PID 2908 wrote to memory of 2648	2908	iexplore.exe	28
PID 2908 wrote to memory of 2648	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\750a3edf968e14ebfbb7cebec57cdbaf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d143bdf7bf37cd21a1f49950cbb130

SHA1
c4d74a24c2fe0d65afe668866c87ef6f59b9ee6c

SHA256
1e0222428a941732f5fb856f8b74032b9a63bde46e1674cdcce113b0933c5b7b

SHA512
409d7bd93aad49e210b924526de79c792e78575706a1211b33cae64aa3719f0e75a5c418c833e5cc57495e6611c100f303be06ab644d9a83adc38fd0eea27b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af7805c98350598853d0ad4f67f8386

SHA1
ce69044e91ee5999810b8fe9f0b1d5d5f5e17d4c

SHA256
d59146e250c112aa5423fe4a0bdece4288f949d4923a015a2a7bb9d9e3606790

SHA512
165776068fea951a32a005c9715cfbcf1d91b22da8ccc7568ac2e9a3e158e1feeaf1544d4f396b4f9152c150aef7eacd05b1ce6e6c89a56af69ad7f4b40f48b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8850edf771edbc54c63cdda6e7271b66

SHA1
7515bed4d99ccce1c506a2e4de7eab17e4963ce1

SHA256
7eaf8d4d5d2ce24f827387b807e344a87a96a7f70b70d6a54532cf0e048ca04b

SHA512
01332468f58a44de9399ef5f6f11dd0bd1eeb077e0c4b6cb72ed42d720988c1f6a5f6d5389d6adb6fc4a6b80029904a8843d3e3b456694c7e044993f638637ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5027fd24ae4f040e5d60a69f4e49c46

SHA1
b2fec4ba1099f6e09e9c80aeab0d7889510ae84f

SHA256
3a93c5af6574ebe6c70e53476bc658e1659504b35db59eb6002d67cee3626de5

SHA512
993a728530b822a5031f9d2ddff0b65c9773773ee1928b3cfb916a58023f983516380d1bacb495f94f4e2cf3d3d917a2e6e6e34ae1b4a5f1ee3e7425df579158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a59acf8bc84f995021f310d5667919

SHA1
b64c18f57b762d36cc0d91b535135434ef91a3ca

SHA256
9a818d972e8555e3d83372b84444fc0e6181423376b8e353b82e97eed531eb7a

SHA512
8b45d532023835bf4487ab9a2a140ab891fa6a7ba77403412cf400a75451ff6fe1e7a29ff454548598dafad9d77e11872514a4852a94e59c50f36b7a37c7d85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9066aad6c0a4d0e25218068fd393f9ce

SHA1
5623e36d39518eff50ceb6c08330e63199292603

SHA256
a791877c584adc02e8a54b494755c214220b28a31676ca83ee18ed540c670411

SHA512
87f373a75c30b7d8abf73780be8523367aaec95c1ba1c21fa2597c33dbd2dc2c5371f53026f7f20c4fc8797d5c9f061198b01d6922905b06b3cfde653250f6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa0b6d54e91769afd9e99c6425ded63d

SHA1
d634a8473bcd990103fab2ac37e6d820ac5cc4b6

SHA256
679fcc9a42c208930f2e72661bf20aee52d67263143cfe460b48c4615a4ff7a6

SHA512
ad74704a57dc1b0f57b6bfa293895d8457ef74adb7f2a293c977f46801020519723c9a47eabdb1bcaac91bdef07e83ed1c9c132e55327775e64e68f103e00776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2ed8c80864157b45c631287bdb0327

SHA1
b4265725a4767b1a9c18c08b77c974593b7e831d

SHA256
38bb9c3788a6375cce183d3aa5564db70acf99eb57f62568d6d764b91f183734

SHA512
86b8452c0bc5b4b2f09b0b0156f07fc541629e50baa147c207ee24df5770ae152f3c5539ae8236ec6e109dbf3b58d73bd24274165f7a60e6e0ee972d27d3c7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb04dd4ca9ddc8dff8051224faaae2b

SHA1
b8cb3fe712048720f11951179f471d3c934c76e7

SHA256
6eca61fbc83621019f7572a9658b0dc311a1835e68bad1187c8fe22cda486210

SHA512
af13f126ee674e1b315da5c11c8ce5c4bea333716cc5cff923bd9e839488bbb65e1e82464ba2c7ae1e0f854eb237423ecbff720fbb1753625a5a6133ee404755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C8E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CEF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit