06a7a8b870409055d66b20659dd744678d57e6e280bdf5f26d5b5002bf46acda

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c52172a3d1f0fb1e773d0400aaaf259_JaffaCakes118.html
Size

50KB
MD5

2c52172a3d1f0fb1e773d0400aaaf259
SHA1

441b96d28ebd318100cb53f00112117918fd2b17
SHA256

06a7a8b870409055d66b20659dd744678d57e6e280bdf5f26d5b5002bf46acda
SHA512

956afe66c942c768dd0b58af486cd53631703f22482ff6c86a7127cebb3baa8c65e26c4e1cb2efb3493049b1a5fe1c83326b01257f11dfa3d7d1ccc1d9fa1b0f
SSDEEP

384:G8bdl2NS1jJmwwNPONSyx8JGJkJz6JOsJTJ4eJCJZJ8JUHJRJxJlJYJzWJeJsJRA:G8NwNTRI4MEpOCU1xqNU0/u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426630250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACF8B5E1-3D63-11EF-B1CF-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
600	iexplore.exe
600	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2496	600	iexplore.exe	30
PID 600 wrote to memory of 2496	600	iexplore.exe	30
PID 600 wrote to memory of 2496	600	iexplore.exe	30
PID 600 wrote to memory of 2496	600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c52172a3d1f0fb1e773d0400aaaf259_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55f328f71c16c43d1ff2b1e1e6ef3e6

SHA1
30cf4c2ad09de2d8b5a51a8a156fdca7ee7f2408

SHA256
efa7873382fb28ab9f7ed014ad7962a110159e01433b655c03d267cd65ca54d1

SHA512
97af67d60f1fe33c7707ee41169fd1b14afda5854b08c7410c43ab703d23e9decf2dbb7c1ae55a28c0db5fce19097c1d2f80edb5f302efbde896003e0c9edb5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
347845ee772882fbe8b220322901481b

SHA1
d862734e185e00abd6a019fe67fce2b8a51f7679

SHA256
c2f89a8df7e7950836c5f4dcdd3b00df04eea95ab877c462d36807e92cb1930d

SHA512
1b7f2a17071802607a89614d9e9e580ab37f4afcc833235d1c7d9a82e6dcf73d469d1176faa05b087b8972677c98e249d51c03c7521ac7543738678c9f845fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef374dbffb06f3abe1d9402184cf19d

SHA1
c306ca10c1d2af2cfd8e8749bee472992658cdcc

SHA256
325cc9c5e2367d88919de9b27b4c2c5004d7469c983af0c8535e41abc1fb1599

SHA512
82530f6b9bf4d4082887970bc6bf5abb6e58f44f08b96ef90673dd16a21da18fd1dd21ba2c6979f23419a700ab0db0b27e764bb69fab3fa0d385b56bdeff0044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed3a4747876c658b2da97048cde365b1

SHA1
61f142dd3bc9e3b157df20d4ebcff162b2a06537

SHA256
0b7af292eedc8369385b03e4fe447bb99f6e1a6ed3cc8b3af17343171447035e

SHA512
e2613c9e64fd97c576879d2a52ab2e306ce628d228f386308e019bad8dc326035172fc931adec3052a31826a46b70fd517a5682a7552e5fdf440ccdcec896f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06466a647161bbae0c79d439a803e68c

SHA1
31e854a6d09bdb15d9b84479f784bb164b5daee4

SHA256
fa31fc6182350ef6fa65fd02c72593a8a4b2a11a50394c4f97edc71034442016

SHA512
8943ca4b8cbe3a6cd4b671296c1ef4aee795b7ccc41c26624264959b0080a12f4f35f3bf98e13f9546e5ed28ae7678e295cb8b8392974d77c5a69592d720fd27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d8c6d58fd0b251980c7a652b83190b

SHA1
e05df8531084b66f323236a982a82fc52632f148

SHA256
a925f94bfe280e4f76231a5884a65b541be045db0af5811124050bcd8ab43fa6

SHA512
095cc49aba189d7ec2ea0a7fe55570d196b46352d15bda4d6a9475b9edbf39fb5d1ebe3b6d2404c5f7d982700249780519b106b6a2639e7cb19ae47d9710a2f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9768c3a1cdf52999573490645c9942c6

SHA1
b524364eb49058f1db0f792f783bb9c058874522

SHA256
1f21bd3e29e4a877c1bac1057423f0c04deb48f6581cc2a5dcf76d0c2858ea7a

SHA512
de100367301c9cb1e91bfc347ddbc91dda8311e6a12c48ad03d89739043a633996ab046f2d22ac215b293bc6f8a29613d8bfcdaca71df15f9439c525a001fa15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8134ed6706c15affe6f5b8e46fe0105

SHA1
92efc960c66b4669911ee75a9e7bff6129284c9e

SHA256
896f7372aca27d02fee5cdb9246bc557e1d944021865cb8825ae1608eada4234

SHA512
778c981493d9df1456723a25378c2616247ee7464f72dbcc734571074447d091eca2ecb843580f6ba35b8518b25131db2c87837b64f56b900cc5592f56197e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb693d84891c74e1afd774935531d4b

SHA1
ede9a5d9eff9425f23938ae6dada0f85a0da5153

SHA256
56cc2e01fdf5e2a87403c4a7a671804caa5da6e75d7eef66b9114c3bf4391823

SHA512
85633f80a37cff0be4aef1f7fce98f4e1c0ff265e9238d60f3cc1f9ba017daeb276cb1935e54f80f7641627697366e87f630ddc104594ebb912f6c0e621d9201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c3c6e687f2bee265470db4aba176fe

SHA1
42346897da45c92e382a7ff833e05655662cb102

SHA256
aac9bab5318d732a549a77a46566396357da9c54e24a21f7e72fd2fe09bd9db7

SHA512
57968dc85a6621b65c5c0458383640a601ce8d630a7e69c65cc5a9e994f6312798c678a81a9828ed50e1a5d3e03f0de036904dcdc0c320089fc8bb79d9249c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD33.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit