ec1902e869b3b5a1316b5d042892007ad4c92dabb2da09ffe331e58af798be62

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

924c979e35665e4e0b4f2bde78452c5b_JaffaCakes118.html
Size

40KB
MD5

924c979e35665e4e0b4f2bde78452c5b
SHA1

e42f71d7ff7a1a75043a4c552e4421e554ffab77
SHA256

ec1902e869b3b5a1316b5d042892007ad4c92dabb2da09ffe331e58af798be62
SHA512

be7f1aaea15d2944b0c9b9485a7c79f7fee1f3e1a9a7d10a5ee2bd105adde690495196470a87b7cad409995c054143df5ba98d571a86508a0a79bbe35c3debbd
SSDEEP

384:Jb0evAJ3C5t3IUkvKH5v5jk3qgSpMh5jeNzODL7XG3GJG8D7b55euYeSG8GgGVGL:FvAJ2IUL5v5j6qgSpoIOnT5q84lfd2p4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8275F771-21BF-11EF-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423591056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2520	2876	iexplore.exe	28
PID 2876 wrote to memory of 2520	2876	iexplore.exe	28
PID 2876 wrote to memory of 2520	2876	iexplore.exe	28
PID 2876 wrote to memory of 2520	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\924c979e35665e4e0b4f2bde78452c5b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
625d516c504b98056f04eddc1db2047f

SHA1
a94a5f2a0da167935c40233f3654801da95f831d

SHA256
8339a73e053f7f78cf7df7886c289a14a91ba01b25563ace83a482f13cd260b4

SHA512
5ccfc90025c7cb0f28475859329f9e2ad8d33f7d5db13ee5fe45f15e649af677637cfb52025c9f7f38ab29a6f49be7f6ceed7ac1ffa3aeefec491d0a9354181c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79702b81733640553516f49a6fef0014

SHA1
02a340967aa293f41e6cc5f714656b27c52d2e2c

SHA256
bdfe7ef986a6fa2c03f126ed86b3ae4c38a56e2788d7c1ef6c3b965ad87f61ef

SHA512
edd1518e99c0df35b8c79e3f2e1858e49998bdc39e3a9a5e602faa96fed77c16b2c9ba02b879e21c93221ffa01845a06b33a361e90375344963382c6c9d9120f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a4b2882782bc8cda795083c70fe7335

SHA1
b39a69170e0b613150042d776e9db354440f9c37

SHA256
7b397ec2f996e8027c27a9e62162f4637347358a762499acd94127287e4d0a09

SHA512
db9a552a40dd4b7f217c1b35c6245f5af5ebafec78f63c194987d4c594d5b69491cf586c1d76002a5417aa8c0c0dd276abb08c15ddfdfdf74b84ddfccf7b83ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac1f31b73e7f6823685460c26d79509

SHA1
e5bd7271cc766eac0f36987479244dfb616895ad

SHA256
0df2f885145ebf0cf6920d947c10f7f8ebbabaf8723ec8220035033a43035c0e

SHA512
5a45776de6819875186f65380d19ece9b62cc16b2426f1ab562cd93f72789ce371aec0468a38bd2703af66da42ddb8986e2577a247b34a0e3c37bf061e12ca90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9667ef1f056f58a609d433521602525

SHA1
98a54dfb11c201aba35f54ec13e479e018052dea

SHA256
251c60cc79d3a2210cc8675e19d827130e0d4c26bccd94089274e665b950c4d7

SHA512
982ad1cad93a4d1c7ee6970e97ddeaa41a1362f2c5e10d6747c8111a4929a13fefef12729351a0bc5b82b9844cd372bd757cb6d0729ebb9951bf9c874ed9044c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e05a80d59de1714178866b4494123e06

SHA1
13904a1db1bf4ccac2023e19a362e4c7a10533b2

SHA256
9e355d4cc544b8ba40cb0b71f2ab92f3557c736e7c37d295169ddb2bbd335118

SHA512
77d505167dc805b683a4d778ee3ea279f20dd6ecef3b0ee2aede5d948f857352c62011a9950d58f23eb4c54f481d42702340e0777ea33ed3631b9b84427c00a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0383b20e6f1db052199b1ebf924ce3a

SHA1
c2aa060b455d909234a942dc2b562c5ff06b3305

SHA256
18031e594943bf1acfd21ed781c04cb0dfb4dcaf79f5da666b1ff70b7abf13e2

SHA512
2cc52d288e46be74f3dbedb563c8ddb008ff205fe0c42bdad919875ddb5a09c88775c666039119982c898e8547404e7bafe44bddcdc915f683681abdcdda8c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a51363b1918024ef5a4b83a53c0755f

SHA1
d21023c28aeb3e94b022820ee41bdc190e5ac24d

SHA256
fa9a6cc4a62a4ccffebcbb3ae2f3fa090ed59d6c94cebd8516bf145b37ed46ec

SHA512
e2558bc95288423e7f4ccd9441ae7442acb18e576912827cf91749965248af469e58c909aca39cf309f7e4544cc84d1e1d93739957c5997ecb64a7016aea9f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9695a9135a538d669c91e8facb614a12

SHA1
9d54b451eb4c6889a8c4e3c8b47617fd8f6598ac

SHA256
bfa47fbda0928e15560de09ffe6435ab36bb884c9ac09ae5780213400a4e3a56

SHA512
925e1eeedca993951284707b01b5147fe1353ee9ee461cf3d69c6fe822223472da22cef22ac76338b0c8ce6cb87d8025c2957ec34a20c7df1cb125178b16c4cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD83.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE55.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit