4057936af8fe5cf59172e9f0e58b2904ace89ef621ba9897c604c8058d48aa14

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2305b928b986c687278ebd5bb8d6aaad_JaffaCakes118.html
Size

11KB
MD5

2305b928b986c687278ebd5bb8d6aaad
SHA1

390580d85958d3d0f9cbec51749b9a5eb7f73be7
SHA256

4057936af8fe5cf59172e9f0e58b2904ace89ef621ba9897c604c8058d48aa14
SHA512

995a5bdff99db1b2cd201ec4adc3fc410317a748a9843730f520f9d7b8e9071848c3c172d29b0b81ac63d94a008d1c74ed41f07006577a96a5fd47222cc79f1e
SSDEEP

192:2V+lIsr03Hk8k/w1wvqLkZyB6BnPyIWlU01Psw8uBuLbdU8d:s+lIcuHM/guyB6BnPyIWlU0Psw8guLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426185629"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{791C5561-3958-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1616	iexplore.exe
1616	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2748	1616	iexplore.exe	28
PID 1616 wrote to memory of 2748	1616	iexplore.exe	28
PID 1616 wrote to memory of 2748	1616	iexplore.exe	28
PID 1616 wrote to memory of 2748	1616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2305b928b986c687278ebd5bb8d6aaad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b285098bdc0fe45094afadcf539f22bc

SHA1
489074362a1587b700db952d6d49e03a5a3c7bb3

SHA256
fb3dd80f99295209679629f30eb332a2446d7beb92e8b17170d4d012f45dad83

SHA512
2d049b0142c1d43a2baee7cdfbd042381a8dbbf43a8daf1386840697f3c2e033e121136b5bce847c0704086ef98fdbc4bb33bec739ad243806bfd189775a8b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c36a2f5432280381df408ffbc9a1d2c

SHA1
c8f810266cd0fd7e6198d269f3ca34f35c43e092

SHA256
126ede2217b90e4bbc8171617f3481dd94fbebcc3e635b11311346988b1933ea

SHA512
fa273640db5b38e647064c3bd219c5f6976436567fdc8bf3cb65b58135eda6ceae30eae7df143ef9291db414f394423ba15bd137ef186bb85e25857d0568c337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76dfb8dec4a7e3681d9159cb2707ac24

SHA1
caebdd7ebdad5c1e53ef7f47a635d7f188932f1b

SHA256
d6b7c301fad09d54a0f14db5375dfdea44f3fbc3ee59fe39f6b605dd8a012140

SHA512
8844a2a70131727a2ea17fe445a92ff869f156518236e024f9b0793c660f7fd291e766518c96c27eb3dacaf4239dd67b85a917b85e3a0b911488a43fe4beeed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
396aa67f9344e52a8c6f010b795cd8d8

SHA1
ee023641b79f57de0219c7df744c442640ce65c9

SHA256
6e48db1a38ede89e92ae9eeea068a6254ea0d587c7347bb68e300fed11a9a0de

SHA512
5a1c3365c71b9c2a109f507e7211bd1ad394ca4238b3b1a7acc05c3a330377b5f55a1985b534be5b46ff9ff05ec062a83e07311e2876c3f77d5829d030f5845b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
612331e8a66f34ecfef2d8ab2eacc289

SHA1
7b6816c99f91d80dd7133933d753fdeebdd9ebe7

SHA256
916566f1d4e15a7bb2f3d673b35b8e1e092e2475e73138f66fc21d59d82b717c

SHA512
eaa685e3fd85331165da1a1adb1e5c2404b55dfe484328ecb98aa76949c3f0871054bf394c520c8b8c67da350b6f4fb21e0f3341d457fcd54c01cf805423047f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe20d095ca70f216502b7237ee60cd5e

SHA1
b28b45fd80fcd9ae2136e0e236bc46434d4fed28

SHA256
5a5b8d8fdfff986273a38eaddfb4ce45339bc36b7c669ec732de3571f1976cc8

SHA512
00ce547a568f5324042ca1e9054f7511087792c65aa7a446a7bfcd59aa5e2e9f2f2a5f0aeb5628a9e931dfa976be536eaf66c5b3814af4c5be4a7f8d19f2ca79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d512c59684a0f86435f4aa911bc5581d

SHA1
bf85e45151d6217aafa80ab5016356fb03714814

SHA256
8a62f38773f430b4a2aff1e1a35d4371c8d4d0b215f6a9a4861fd9d3779b0cdf

SHA512
5c85333078c150feb6a3932dd23e249c41a4fc69cd26af62342a0c1cf81637a109b1c5a38e6ca3a3adff35773c70c5b802cc7bbb9397d611c976016fd457b0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9da71bf2bf5f48b49740fa7f55c630d1

SHA1
7ffc272ea9461f54cde73c134dc82047a5caf9a8

SHA256
f6ad2bc4860a4565fa4a8d66669105672a0005e7fdea04d521043b0818e5f142

SHA512
d7422bac5acf8d8384141879237b73071f4d7dae922e85c44256289888541814b47030820e7fc585d61af4d828d08fbb35c8a4056cefff79b479d573b5ccd075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
102d99bca893a7e92dfd92ef25bc1f89

SHA1
9038467952daf5d13654709597a9b1aa07ee569f

SHA256
d318ef326eb7900bd8e34e9974953482e972456101b0523587f303c64d6a1441

SHA512
7eb7926e8b0574f6753ff6f9889e2d5303ac7db4c116259601ae393f2e0a8164adddb1a35fc22221505c621ddd17741a6e80535d8adc19d01fe1d14b4042df51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab174A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17C9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit