c134f36092af503fe964d8b23f02fb33806afbb9c2c4fc0c8b7b19fc8f3fad8a

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
Size

12KB
MD5

3189ccaccd3b2520c234aea3991debf4
SHA1

15880f2b92ca16320c35300cf98455bff5643e19
SHA256

c134f36092af503fe964d8b23f02fb33806afbb9c2c4fc0c8b7b19fc8f3fad8a
SHA512

ee0fbeef993f7a79a21ff908305bada44a35edf3ed399944a674b81a58a37476cdb2a105f9487be7470ae9944afac21919185a2b835c62647a3fed74c7fe2044
SSDEEP

192:2V+lIsr0KXyJnVCBN54J8k/w1wvqyX+BX9ZXtnX7XuXUXnXw011AuBuLbdU8d:s+lIcEVcj4j/gcuBtZdnrek3A01AguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03231281-3E2C-11EF-838F-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426716290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2440	2596	iexplore.exe	30
PID 2596 wrote to memory of 2440	2596	iexplore.exe	30
PID 2596 wrote to memory of 2440	2596	iexplore.exe	30
PID 2596 wrote to memory of 2440	2596	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35a51d67c5c5fcf1680945cc184c8ad

SHA1
2aba66e95b1859f3fc82206a628e76aa247b6bf3

SHA256
ff3c091a4fdd9667f5c74b7d8d37d6f5e8c9a10287513ee30c2ddf0c882ea1bb

SHA512
e4dd31c40889e92497e995e36d3a77049647644df3c9c59ec3c5331260127cf62d4332609f0951b661b2b279a9f3dbb86dd4bd80b527dffe0eae09c36e7def52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e2983f36a61e40eb08d8dfae62bd8a9

SHA1
5b95069aa25430c9a467f470076fc4114be9bfef

SHA256
ce2ca71a3fc55567c434285e104b7fc4c8a90bd6d28014f694866e536981b619

SHA512
d185102f04d0eeee7ddb708d5ae01990a50dbc11cf7ea528ef7564f1d6d0218ded388aca025de518fb12038c0546aa762169a1311c6fe34a88f9aa73896d56dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2de8c9dd11b5aa912b4623d1d303af5c

SHA1
7eb5dc3dbe5ca3f16b1a67bfabfc0bd50ae82077

SHA256
20cb11c6f9339226164a35fd9310de9fc503d1fc43f43d88f97af662f252a646

SHA512
71894ec4dce67b5801868a2b1b0a76ee23f469416534af2a3779876602c8e477b627902148313263d589e2511a1fb420d3b9e0d5060f9bdfec34a81947d7e1e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea8ced0f60600e43302047d91a3a0e7

SHA1
8ea2d2c5f6f3795a2979ee22e9e639f68b487a0c

SHA256
5f6213e32148e0c17221c9db66067b282ad1359746a1b96d3d3d32a8c88a5a07

SHA512
24460c89dd5215f2b6c0c432967bc9fe022734926d50e9a1639cc042d92954f178e86ac12b852e6c832e9228314b406898e2a11a63aafd398e5f376a6fd2fedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66f1c0953be3e2cad65c0e103331b481

SHA1
4c528bf37ec4b95383c6e12c00e9edb398370524

SHA256
2260864651deaa73b2a8121c001ba1004baf45be4578de8bca5dfdbc547585d5

SHA512
aecb1db7d07901cf2908139a213f0c8a38902223831283e4c47705016a499c791e53d498d60267048d7b35f626afee9006655d107757bdf59a5376881a8b72ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a37ef6710dd0b5df016cd636fca16780

SHA1
8c3e5203fa1f373095a3fbbe68c14dd5b17606f3

SHA256
945b7ef904f01564fdccd01157dc0e032bc84227cea4842af9cdcac60837111d

SHA512
a00ae259e7c9ce2a3b6a40ae40e6094069c506074349b09a0e9bff7048dbd81314bc66394e31f3945811a32f6778fa5cd31a1fa66b55160de99c01c9f9b9a091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9c082bf1e9777a24ef1f8309c7f68e

SHA1
62424c4ff58d8b99f0f7f2a1c925178d84e572e3

SHA256
2a3a2398be979d30faf7a29a3add1730f88480f5e5a69cfd000655281b838c9f

SHA512
16e6e7ccd7907069e1175f277448af11f1467e38c2ac55392fe43016f231eae8ab3f9e7f032d0722ba82a8c6fb1e0dcbbc6dfb0d6d1246daaae95bb3881aefd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b5c76109aa6f8ac5adc04b70d3cba1

SHA1
459dd9aaa6ed6bbaaf92ebebb49208bc6dcc5deb

SHA256
0429aea9102e451f9161a696c2f38a6e2f3bbf28d08e7082df9504384ddda504

SHA512
7d5128dc8acdda12e91a9bde17eb44372f96c79553426595c6b625366bf87c379bde160d163ee30234b72e680bacaa99d40d7641e174efdab7fcc8210e6371b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3226d8cb1a7861638bbb071466b1d65f

SHA1
802f72ec212b21ff3d0f5ca2230215677e099fdd

SHA256
60374fc672cffb67354b204a1ceddfeb94c809f9056d49c386ba30b01ee20d66

SHA512
bac9ac9e90a7ebee5baefdcf7daf95fdde3ad982c71fccf07e0241de31361e2a8eb66329839cc9f406d7cb1fb09f0f88d9e0e25266e0c26ba4c5c4fe67f646e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab713C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7219.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit