c8e29a454f1504c74d2b39f19c0c7cf0b4140b8e582143b1763d46950285d559

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34be61903e26cdedc5dea5db1a1d939f_JaffaCakes118.html
Size

101KB
MD5

34be61903e26cdedc5dea5db1a1d939f
SHA1

bd161aeca420a5de9d66d2def336f3d6c152a2f3
SHA256

c8e29a454f1504c74d2b39f19c0c7cf0b4140b8e582143b1763d46950285d559
SHA512

ac692a214005a3f82b5f7ab1549d530a356d2da95b27bc6e831a73e6c17256aed397870e15da3b257d368f7340fb74ece6a74247b38e41c1ab73a7134c83a24d
SSDEEP

3072:SZy0vinbbJww5Fef0Lw/+v7WhpysQ6JNEVHHxUcBdW52:SZ0jW52

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AC68651-3EB9-11EF-ACB8-4605CC5911A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426777023"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2812	2864	iexplore.exe	30
PID 2864 wrote to memory of 2812	2864	iexplore.exe	30
PID 2864 wrote to memory of 2812	2864	iexplore.exe	30
PID 2864 wrote to memory of 2812	2864	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34be61903e26cdedc5dea5db1a1d939f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
428e16e97102a9ac9b6f2aaf6cec895b

SHA1
4d018398478f32957ba98dfb92bbd150e321d2c5

SHA256
aaad9c0d1106786d8b7a1adf35fe1a24c20f433129efd1614553e688fed484ef

SHA512
ad5737635835b7c998b3c9f834e314c7a20a7350714ed3e0ac82da2a1045f38150b9ea23fb80c6a789b064b95d276872fed488707c6510ad0b313b1cea538153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2deb59410c64e0dfa82edf70da4de895

SHA1
13305052d20c1d85f78ad694c8ac547c2f3c15f8

SHA256
19aee161e4de35f87442b7c06616c8fa52dd83008b3bd05e57ced23c2afdf140

SHA512
5b59a2f7eee798745bedd14360836d73173e60dd8e9403e0da878ac3ea228f762c07fe5a1a39e67d634ac7acd0cb07db6a33c15f5f6ebe02f7ea8116a489895b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f92405305b9a1afc25ac3281a9fe43f2

SHA1
15b327258b4db6910a757a22da7729880b226b3e

SHA256
13cace4238a98e1edb9769206eee567ac47bee5b10ff8f104b0372a91cad52be

SHA512
16cbd9b1e2978ee81fabe5925c03b131fc1beda2530b2ade31bc208ab006ba5bc29daf5dda678f37deffb33c333a65e1704d67a3d386672897dac35f2a5dccc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
44179f980f44043eb234aeb005a9a05b

SHA1
371bc11c117db69851abdb054d5ce64615e95d5a

SHA256
b2b65ef7d8d6ea5a8d0596cd0aa57c8f746b6d8432a2e48b1fd05d0e08e86c82

SHA512
d08d0c0069cf7afa7e50c733dcd4d1a9d896abcded0416e22b1de6975539e2bb78c400ec62c7dbc6ca24d7712784d8f67ea28e11ac1920dbcd259efa559f2916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e046bb3fdb620b1241cab43ccb038605

SHA1
d22fe28eb7d70daffadf50e4f70380cb321bbd73

SHA256
0021ea7e4ca14ec42f2554b16746677deaf1320bf5bbf9bbeda9bc2a0fc7503c

SHA512
413c2b2daa32ec4804fb6ba236cf941ef29324ec0305df7eb642bc94327f818bda9c8801ed4461adb5079c63b3d352e3d4894dcf3187369f23f6013a02a41414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7a4e6c5340a5d68b5512784f85763a5

SHA1
c61ffac6149406824623e9fe9cf95930accfb97e

SHA256
17f945e9bc8c1a45d4dd69b5b703b91c656981b1396fa3ae4cce2eb4f5e61d2e

SHA512
026de4b389b76d693a4b099b0ca3560d2e6bb959c6687068915ed5af95e732b203d278497491c86b9851e78ef3cef2ed9546919b9f0561825e20812554c83189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
55004455624464669aeef8c4f28f5883

SHA1
61d423abca55a0d3a08b575ab9343c757a3f7506

SHA256
0beb8b1e8612a982e7193d69f8d8d9d0e503bbb55422b49ced74007995a800e1

SHA512
5c760128e932530214d0aff7a5ad9dadc076f37f2878055e238979784f88f3b7cbf0237a2be57eba09a1bbe27308488f5ccdfbc64f09379f733521fbb97539a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
06320d771f8c3db8d4ab4e44708a32d2

SHA1
bfebc1fc01b5c7b11edfec59e305973772904911

SHA256
b6aef3bc116e7486983db3c8bb0c51924defbd340969798b1ad224d85d732d95

SHA512
b7af14b45aea1509e106adec9dc364270f17634600547014d9c74bf40560c68ce38657e10bba20c09bb88200d9d5e3a2ae90e22f74d7a39d7038e15dbbb4f43b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4bd91645ee66bfd9d14be50672ab8537

SHA1
f0cddb02a525e8b22b7b20b95edbf3b7f1ff0365

SHA256
fc72b4c1f1b4bf8ed0f6c7832d3aaa2a583578e8af54c549fb673a00c7410afa

SHA512
e9ecfdb62d00ebd7e808f58bab235507480c388bd0604b3bd0e5dcb35a9eaba2411148d1f47f21b2dbc229ead59af4421c988c30b8e7747b1c53bf32e3ab3755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8086.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8136.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit