9787b3291d2fbfaa9abc6d2e979e8b5d0514bf9c364daf699f97fd11f451da73

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2282bed73001ef042f41fa9c539046e3_JaffaCakes118.html
Size

11KB
MD5

2282bed73001ef042f41fa9c539046e3
SHA1

4ff1ffebc3a1383058fd5c6fa29dc2f569521c2a
SHA256

9787b3291d2fbfaa9abc6d2e979e8b5d0514bf9c364daf699f97fd11f451da73
SHA512

1ea1f72e5fb8cb6f50bb9158a9b505d1cf04eae9b7d0abf40ca6360ed611c6cbd667142cfd449e6dd0ea7bcb766fe0d1069108c8002e14a194771e1221662b64
SSDEEP

192:2ValIsr0r57MYxPT8I/w1wvqa1JauBuLbdU8d:salIcIQYx//ggJaguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426175264"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{567B2581-3940-11EF-A381-7EE57A38E3C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2576	2788	iexplore.exe	28
PID 2788 wrote to memory of 2576	2788	iexplore.exe	28
PID 2788 wrote to memory of 2576	2788	iexplore.exe	28
PID 2788 wrote to memory of 2576	2788	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2282bed73001ef042f41fa9c539046e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fd8b050a0cbe54eae7418bcf77e8ee9

SHA1
a929100e8dbcb6e02a7f449c3ac7542c525ee7cb

SHA256
18a49c6392c4204d5bc68a93b20af109c91dbed31e3d3fd3482aba6beec8c865

SHA512
51d77382868e44a33178fd874142371461aa999725c004f32b7c9544ebb433c5fd6177f78eb800b2ed78073e7c82c2bfa4088ca01594fbc0c6f4d303754c3553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fe70c6c34bd23129c174e7fc46ef7a2

SHA1
65d6111b429333ab30512f4548aedc50fca7e72c

SHA256
f95f47e9a0c6f316e65fd2e07f736a09e52001e53c45d1f02e6fef55bd26dd51

SHA512
00d5c868fb5323f69fc477e527da49f5d3208f37338f32c10162274cede76357188685eed98d4271cef09f8fd8fc24fe680de73949e3c2a632e913950fc76c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b11a204877be6a892473831080913db

SHA1
75511cad10c6d8468cc8aee32541da76e29f2d03

SHA256
9e211fd98c94c1e7e1153eca52fa1c8939bd75eb6cae7cc4358a4eee7ea3960b

SHA512
5866a70695f5562f13414c3c7ec78d4514c78950e24f49352ca8575d33091770ab58adcbe71c73964667cd1ef1fb08e7b663fac2993a7b5de06935170e900b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
016107a2988981481537630a359a9440

SHA1
cbe1352d250fc63be8ec24b1e1bfbd6c7fbee3e2

SHA256
969211f87a30d7239f31c48223ac5c922861aa551a5a4a6831eb13cd9a0aa92b

SHA512
843a13a4a07c093edbb615688aa23a3656e839450ff239b1734ac0adeab628d116300a73cfcc8c289bc281cbf49e72d2ede14a9a15e709ccea1edbf69a1d1ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e2acf9fb6b1bccb96f2e3057a2d1bff

SHA1
6d6c4253525c433d593a10e25819bbd49d4ca0d0

SHA256
47f58e19fc795f9f2a7515907e03edc1ad0d29d04ab7dc2f22a2794a8c7c50b9

SHA512
96f7505fb1b507465f4d2bb891d9aa912602c79f4e62ab570ef58ec52870859b784859efd9b5a1fed5a739c4924f891fc809280bb7a3f6455ec037ddbf0cf688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
758c4de8617ec535485f4f56d347a40a

SHA1
b10f12483158a5a9396eefb226fc4011036db917

SHA256
5ae4447318702a82d49839dd403c34dd589a6d74e09c25ec3533db7f778b522d

SHA512
c5c800d704684c3181bfe8e125251e823484dc0055366f6c0ddb41366ae2d2cea08992a4de1407f8170be743e879520e490ef703df620f7f43256d3d9eb12f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
487a1631b8183a497a647671dad83186

SHA1
d4294d07922dc55d94bb567a5f2e48d7e67576a6

SHA256
3ed64156a5f3d89157a220927365142632442c7c719317bc162fb3870bef6164

SHA512
ce13fa758d0565a8e2c0f5c2822b5744983e74df9ddc3fa38591a9f04bfb8c5d3195e08ecc8d693a2598eae2c416a09aa56bacc54793334df8f4e88b7610f201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e16852786b4893ba7f473717bd88c77

SHA1
403f67cf60bd82ccb2cd96f4df44825ff2e50744

SHA256
716a9949588123efb1533b9a07d158d8e9ac1bfa8cc752c22958d31c1feb1fb5

SHA512
e5bbbf100359677351150aa90e4e6fdcfbd7c9939ff548a621ffbed3cbce74439675a90f358bdec9bc7a44232812294ec83589dc93d0e3a7489e41ac05406f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d65ea8b6c354e769cf016f6dac17c9b0

SHA1
9dc8e2ec31cebfdc93dbd644887563b6e869887b

SHA256
5dfbc73ee2e7a2a3923abc7847dc47d2f63646acebe0d90abea583204f02e8d5

SHA512
45e46fd155c3952f5100ee80f0a9330fe969b3dc37b6e3cb578ce48d3de22f98153b4b2311f1a498be0d13b70ff785412a1326d6ec89de38250763308c30f739

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25E9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2699.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit