49af45c4facdf1309543e5556ed582bdd612602ab223bc00177e3d296373d032

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15529bcbe9080f9eac1bb4abd0e1c531_JaffaCakes118.html
Size

78KB
MD5

15529bcbe9080f9eac1bb4abd0e1c531
SHA1

a0ebeeab4a05050d49bc5e976baf3b7be475a366
SHA256

49af45c4facdf1309543e5556ed582bdd612602ab223bc00177e3d296373d032
SHA512

90adf4b0145f8487392befed388285e702f93de383b4933cbfe7274b0fd05261b45ff4c45a9602114267b9c0eede211668047d9bbb2c0702fa129a5a8fb05e86
SSDEEP

768:CZh7ye2sH/MXgyjCKocQwfuS/7GlIuKzNyGsaMWxS+unfmO:CZhybifB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425638737"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22FD8441-345F-11EF-A1F0-7EE57A38E3C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2996	3000	iexplore.exe	28
PID 3000 wrote to memory of 2996	3000	iexplore.exe	28
PID 3000 wrote to memory of 2996	3000	iexplore.exe	28
PID 3000 wrote to memory of 2996	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15529bcbe9080f9eac1bb4abd0e1c531_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79af8e713de8610119fb506abac8e19

SHA1
d324df7ac27c65f85c2c5f785a727eee47cf9057

SHA256
5812286ed07cce5ae78fa5c49b2b7f1dde718ccc113591fd31b62d466751b005

SHA512
cafab0facf4a6e51803df28cc03e809f59d8af759dbefaa52a73bc6c7b810c510b5bac77b0d8eedda9f6262bc72f4c45aa6d14cfa01f178d75bf032f2d22da56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d5375f46b69998f7dba07abe47c63f2

SHA1
efa132df0a76c93f14c682a77664f225fed72305

SHA256
a94acb724479dc9f553296144831184c9ecbb95d72e43d290844d2b6f62ab71c

SHA512
123b1377e6192149ee3f4eaa0318068b92bbd1dbe58060b10ea50a1a61d73bd08928462e4032bf5710b387655831087e5455c80781accdd316148c1fd7212049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d01811a534e8a01e4e1a568da1485df1

SHA1
e7de98e99942b1ba0a3653a022d2832bb2934a96

SHA256
8c8a80898dead420fe87a5023859943fffb1e9457b8fd7788fd0fdfc22b425c0

SHA512
0d6c130e661dec26e4500d3ff1913d39329062480c2f8205150a79a8b6cffd7af5e613a7ed90e7bb19f261d7198a9ba01d9ca4f909dbc26a9d8726943bc72676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c09da8887a08976047cbeec2a5dc2c7

SHA1
4632aa5ea7930d65c741bb9c70693e63d9b5ad45

SHA256
c45d18c92de33c6a6b3218e5b4f57486a6ac11c6fec2f8b2fa99af68f0e15c96

SHA512
1415d1924bb62920f7fddba25b27724ee43ead8ff90bbdaa865b738c7e4893fb036f5c2c5950ef14545e7f611adcc4eb60cd43ee647426aad7e180348cef02d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d9e2e67fd7f902d1b2842ec1c233d6

SHA1
49945d68f454538622761c18bd6186f25369083d

SHA256
779a2a6717ae36054b599aa8d1aaa387c2370c7c8e90ab3b469b1c069117c704

SHA512
6de9153daf625db2ce8454e1caa321083036a23da32249645e94f3ced877833621e817845a932166eb721da27a79045ea0cca38e0b43c5f5cc9cccce46761e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81ac830a86aca3275ec4f1263dde4f7

SHA1
dd2fe9375d7bd98773a0b815785bd2f5092050b3

SHA256
0e92805edc5ca3d4666c66dc933c9f3c5e0ff54cac9269cfb12fde81ab237d2d

SHA512
7d709272fdab13b8639779be5d31d11e8b33a1b6b3c408ebd944dd8a18bd38fd72bb37a0192077d8b20554b975cf6ead5636b29190c7492f82f778e12a7751d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a838c829d9ba239b922c44d99b458273

SHA1
3c45948d58dfd6449d4113c27bb76b4e6a0f136c

SHA256
8ddfbe8e0065a7aa81a4342980ccd5abde51573ec28fbf1d73d4dd037e0fa1f8

SHA512
737ddcba1685c275bd7d4f0667a9c3fe0a8f1ff86f7bf05a068b72fe854c061bb9727abbf11dff8daaea46cbfb0e5326f3417b82f413dbe7937354defd71eaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
627700a4665db4eac7d6ecc6203b63de

SHA1
d9390852b879d47daeac8b6374d7412f0325d18c

SHA256
65267223401c1a0b2f91b306e0ffd2bd72f65395fdf1a184c3592575471aacc4

SHA512
c44ee3ec2e987a2a6e7ead0cc45edaf9b11b1b381d970a2f99752620dc69b2ef924853983e83c43696cb97ce3eaba68dbd8a95b10231ef0df80a04b0191962f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bde369752676fe30a9ecd4ddc69cefd

SHA1
1d8a475eae10056d82ac0ae1bff84b1e9fd64152

SHA256
fc692bb90131f4e1170585e7640debcdbe369378f599432f091dfeadacbfef17

SHA512
f49e6db32f0904e850dee80b1b9924c3b0aa668f63660b4ee78275ebede41fd050c749617b204e038de6718e6b1c06e980ef7e214b343370db16e9402eec43f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07cdb737768f8961472b478daa1af305

SHA1
98b57956e4ebb540730b7f901fc7ddcef0e9fa2c

SHA256
0ef2464610e9e5b7fbf5ac28bc7358db9e5bf8a49d58026e3ee4c4db1f9cde57

SHA512
15f30e7197d66cafddc3fa3e5e6abf6d7ed7e830dc265651404a216c2c0c29834a2095e8c5139354b33ef97eb1ac2c4b3da8d4dcd44af710f359af5f834eef50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E44.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E95.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit