42e30a61d084e90998bf5c89e2eb75f189cff33e6c8cd39f55113e231b865359

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d61b138c143235077acd249e55ae18_JaffaCakes118.html
Size

11KB
MD5

28d61b138c143235077acd249e55ae18
SHA1

4bb86e56877a4edae0c428c271cf57a3ee43f204
SHA256

42e30a61d084e90998bf5c89e2eb75f189cff33e6c8cd39f55113e231b865359
SHA512

efa685e9f8dd3022ffe75008ff288e0bbc9c2d5bd86948d1d44a717b648c2514acb736338ba801db8349d74ae657f6499bb359842579381b58e6e0c6cb498302
SSDEEP

192:2ValIsr0r57M4wxalT8Iw/w1wvqa18LOXuBuLbdU8d:salIcIQ4wxatw/gg8LOXguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B639E0A1-3BC1-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426450732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28d61b138c143235077acd249e55ae18_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d01f09e4bd506faac1ce2b2125af084b

SHA1
6b4fae4d9ebf0a0217d983975782984445d764a3

SHA256
0e9c198a96951f5c32d4cd9376c92609cdc699ceef08c964e7788f7ce61417c7

SHA512
ca61212daa6e3294f3720191a1610a782a9563d17d47fbcf0add84058fbd557e36015e5672f27f2574b372a62a4ae62c46abcaf27da09407f51cdc559f2b515e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b795964d8e3a3be56ae06b941db9955a

SHA1
f0a045d24b9fb799cd6dd0e1bff8b886ff4485b5

SHA256
e5f5a6ffe1f8a6827741c97467832e90a547e1ea67d1c6b33f6f825b70a27663

SHA512
e76deb62cbd4885a3f7d81f9bcc0a7d2a1e36a35cb9a3076ff916c8389685a55a8a297bef9ffff621f9ab9ef16fee62811c68b162cc537a2be45a7509e275703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f74b3e9220bb643a4f39a51fbbb4217

SHA1
578a144cc4107e14da33733f705a2fb621f95e33

SHA256
af519650fb5302e6d5db1e929b9d9d3820333445bee40f9623905dcc1faa8174

SHA512
907f58dffae18c9e36eeda401e0b32f9b84f42d2b9e5c6e12e2ea1a0e944eaa8e8159a352f31857a98a0b64f663418c28377c79b1f049734840c1835e3d35bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
484db55f438edc0c1b1752a61f815fa3

SHA1
aff8712cf7e3dbf6391b7192964127d465faec91

SHA256
cf62141a37c7371a66a0fbc5f2cb465926c7a7b81f801bcfdb586fdb0d2d3b47

SHA512
6501c276cc8c5b82e56dc3f3ded240665eeac75f3b9ea110d405ed69aa198d189cc1784917bc20e100bcaef92c95f25e3cebca5638195a44451375f1615e7fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59d5bf58568f6fbd1e67cb61a28fdc0

SHA1
b2d09a9f6287e4f0ac33d8a0e2295188a1023109

SHA256
8832e2c5623e19378ebe675692e49bb8ce6f2c7811cc33cc9dad3b2c877e70ec

SHA512
9518d2cb22d2cb796997aca1090ac006e5db984406cfeb366d64086343f87c38f5a3b6dbebeec3cabcaa04a3c62efe5eb2957fb6b10b04021a0fe8648a5d08a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fc235bfbdb6e778adf398134e281f4

SHA1
98a234ed8b9ff2ad9c2e074bc09de82e4e16417f

SHA256
4be74c957c9097a7f222823d9bae6a569ad92b65265ab157326ec2722bb33f7f

SHA512
2c5610c491de872a46b2b4eee6db9032a42589b17dbadfd4348e82db03700273b46b84010bf9cbc34f1dc489b06528d1d6e03f7f5e47a78afb9c1f331acc11d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26b54c5bfa09f1aa1b227f51a2c0df5f

SHA1
515e93dce9c5d9126aea5b91ad1cc351bc6ad42c

SHA256
7ee3868c41615a1a8c579dbde246473967f36de5d0e5d559d62642bda8fa2d7a

SHA512
6ddbddf0790a353876930d51867f285643dcc2b48a3cce3c0ea50902b241aed9e8880c6817670ac174611079586c2f67ca8430e6806ef5c30c6515a6f75db556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7144ed08a0c3401c4d099c4a0f6bc9c6

SHA1
69b33b5baa0361307d22fa904f207691234576cc

SHA256
6fb7a6647cde02dbe213f9219dc49169306ab5bd81c36c6622de9e301b58a680

SHA512
0c9f41e2d018a5bbd5b8228e5a119744568ea12d08063ab86f0e3c2652ffa413aff15a91469e2d7c54d156a4e7298f7fc3d0cc5a9d896fdd43d5f16ac8a6de7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af76afc150d83ef1f991855216855bd5

SHA1
e10277a63e637b57d944b8a9abbabd11036432a8

SHA256
16760f1e851b1e917a777d3e9c484c5471806645c5922dcd13a4c4379077e170

SHA512
37e15c264bb322ad25c0abd08eccdde19648d5fcedddc19a456a0feef7f8377040d048ddfb34ac784263580fac3ea450f57af7ed62de20e22a8488e101070af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab147A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar155E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit