31f45abacda12207b085a2b48d8db595fcaaf63fb88324ad2592f8a54760fa60

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75c10de2a50cd9407e7d3f728dcc1fe3_JaffaCakes118.html
Size

35KB
MD5

75c10de2a50cd9407e7d3f728dcc1fe3
SHA1

c95c49178a5ecbc17f1af85288e23e1df19dafed
SHA256

31f45abacda12207b085a2b48d8db595fcaaf63fb88324ad2592f8a54760fa60
SHA512

a2825dfa16acfb8cd87ce82603e643e0366012b1608c85f91492cc60021cf0aa6c2a1097c10a67a1a0ce46c928f082f1d7c4a4337a586f7bba8eafb788f8184f
SSDEEP

192:uWbsPb5ndqLbnQjxn5Q/tnQieANn0nQOkEnt7PnQTbnBnQEXCJAxskY3xP9YIDqN:qQ/jUJr7CzRtip18z2A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422894820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{757F7791-1B6A-11EF-A538-5630532AF2EE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2412	2148	iexplore.exe	28
PID 2148 wrote to memory of 2412	2148	iexplore.exe	28
PID 2148 wrote to memory of 2412	2148	iexplore.exe	28
PID 2148 wrote to memory of 2412	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75c10de2a50cd9407e7d3f728dcc1fe3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee3983e0b8927b5ed64611440b873d5

SHA1
148f98d671e7b892034d78869bbd281aad0bd5db

SHA256
79d9266472dfea2d9a7a12d9fd4cd65773b90caa68d730cc1ac97c9b7b1006e7

SHA512
a731b399eca6eb6ae5d50013977c251a98edc4b4c3ca3af18c0d47a809aa9fcf6c10b32e3b925f0228dbdf001ccc114097b7a1135703c393755c2fbb363a124e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1279b5254ce395d9b48481328dcddf8b

SHA1
f4bd0d6f58e3ff08c7ae7196a51753e5fcd1f11c

SHA256
2bc91d364ff5cccfc2700179051ce52a86a00c252aba4a3277dc703c5ed6619e

SHA512
5310afdecec0fd72e25080bb6473add0e6a3b135fe8ac9d96696e4f656df3864d93b313dc0000a8e8e8ce5301eaf3a550a98564a590b733779b77c61492b2c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
917ba3d30cd00498b968c7c724594a46

SHA1
7949d417badfc10d7e32c3c154798c29203c8c15

SHA256
2435890cc1ddb35624b364e6b9a5da556b0db4cfe7bebff51c5dbcaf08835ff8

SHA512
802df963bb3c35fb403a82bcded27ad724fd9125ed0199c69a96281209f53f3112ee0407d69fa7de7234fd9b638ada50c54c629aba15004c7ab6dc3176402714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff3495982e79a9225724ba498a8a11bb

SHA1
e2fc1253c2cce66cb39cc8203658fda439be6eec

SHA256
0fdf30bcbc964c0074c701708834bd47c5571b33457bfa54bbf712151e0bd903

SHA512
26a45649705e1248e968eca4c0dda21cc8f04e6fcb1382cb99da6f83907f25355f72ecc2d8b902892031a6fb201a0e370ab20dfa544921cb9fb7601d3e65864e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35088c18aa83c0d3fa04ef0abe45d93c

SHA1
f865f50a3d09df80ca0679855a3f1eb752120954

SHA256
bad23c78d4a9548726ddb4df40a3f76c47935cc51492d6ae6fc61ab74df17e98

SHA512
5c0d6574508fc027449f0bf5bdfba1ffdcf7a2f10911bad95b92bf3f4061baf86719492030f2e42736fd2b808158b865e4cd4af3f5abe81e1562fe9aa98ab626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1959d283bce0259282d8e61c79fe887

SHA1
9375dd0cc67af059aeddc895574c5f6446956c89

SHA256
283e3378eabb0e70750c345904bd9d4c3dccc5d8fb1ce34c434317f83dbdf6e4

SHA512
abf34fb7397682755ccf56f1b8352f3a11264b5b85a4ee9a16905780040ba9f4915ce83e6916c8d41c4411bb016b1a11ef5479b8e4821ac87b409ed02d893d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6073a3dd58b106a83f879ff076062bc

SHA1
a7af84305925c3b7a0a14814e63139d288f0d4dd

SHA256
8ed0fd1cd21a353d5e80011db16a0d1659c65c6893ed20745152874baf28f48d

SHA512
a25640b7de7d6d485f67668354c2748c1fd522c895367dadf1cba30d46a5662465bc5b6fcf99f3cb7d06e61b0984259cf83be3a90845dc3c8e4fe2b4ed86f0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fb97f74913a77969b15ed89e30e2450

SHA1
afbb9878cd7ed4b0a0157983216a0b253c107f7d

SHA256
1f72852139f306a5cf2d2c90438ad4d8b6e652a5a93247605924dff8ddfc7c66

SHA512
2eccd297ffd1953cee6a5257ed8b71a61f4bedb3f22f894489a038891824415186a8fac32700ec9eec34837e8be37af8f140d09f20dc1a64cc00ebf4ed1cd647

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDAC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit