e7b48a22fc3ec6418650e3b86dbbb7c25910ee3468edaefeea1d5b86745ac89c

Analysis

max time kernel
135s
max time network
152s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38896432d370e6617d64d3733110ef98_JaffaCakes118.html
Size

34KB
MD5

38896432d370e6617d64d3733110ef98
SHA1

a5daad5e714a3a73b9e5e1cef90c49512f5cc1d0
SHA256

e7b48a22fc3ec6418650e3b86dbbb7c25910ee3468edaefeea1d5b86745ac89c
SHA512

87ac3c3022d1bdb2ac8ac796ae2e90a4eff0aa79ede657c93898ed51735c1e5037a9d9af37e5e999df5806cfe8a7ef665bfbe5b6d4e1cf941c07ea3a7728355b
SSDEEP

384:iJSw5kpyEZy55/IkIkMkvkkkgk9kAkEk6khkWkJk+kGkbkH9sc+hvQbgmGaUYF+t:iJSw5kwEZyTSSBsFZHlEN2vu1/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA2147A1-3F66-11EF-BEBA-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426851459"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2324	2996	iexplore.exe	30
PID 2996 wrote to memory of 2324	2996	iexplore.exe	30
PID 2996 wrote to memory of 2324	2996	iexplore.exe	30
PID 2996 wrote to memory of 2324	2996	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38896432d370e6617d64d3733110ef98_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9b9a6983cc1b825ab3db715550a372

SHA1
aafd262bdbee6837a3008bacaed839571a9e014b

SHA256
d2eeeecb1531e9e6b316e1a5888452ad07c7ac27bfc69dc9a4c28222ebeebebe

SHA512
709ed24b02f1b63a7c74e1e54e822eaee0933204401a947b55e7ce6231ed1f13f21a12bad7bedf9db81954ec5146d76e9d8a1d337e0fe5e19b9719127a4bb9c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe11256b1a4cc9fdfc8ee2fe073ad72

SHA1
b7929cd470698167f128e9d22f78db6f1246bbbd

SHA256
7748984a93780764d21d21ff6fe149358eff6e763624ae30fed8a2e9b7009ffb

SHA512
36a1ff72a7cf9eb3422badab255d47f63f1011a5a916f46d97b1cc3369d8e2388c5904038cfd4904f844c02f0ebd4c9eb7a356b7f6132a165bcd17c05032f15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e234dd4387c31475752df97b0453a0

SHA1
027f2842a653700d6ef2d132ca5a19598f45af9d

SHA256
f5064391699d46054a8d804028e682014cf6f5a58fb0abe9fd2e2934ecc196bf

SHA512
fd3ec502b69fca8b7bde1eb6fba0d5a4302f814886cd7920dfa2141de2b506a042731607ff18970733c6bdec16d91db04e330e857cc98aaec6ec7ba954b5a7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d94be131f9df17f7e3375b4bf9ed27

SHA1
f22e65367c011df09e424262f30bad2841be38ed

SHA256
6bc84ae6b80cb1c236194c75a37b8e61f0ad6a72173e73e3ae36c4299e1c38a0

SHA512
9800e135c8bc456a56e345955876ea36e8e9da49229692ff6a0a3e91056001f3014ce255c46e80d292a225d1f85f8a0d27314eaaf46261317283d4a8fde9ba7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc0ab2b91c5b09ffbbe48c8ce21a3b0

SHA1
0def1227519d03002f3bd0179a2c3bc25cbe6f7f

SHA256
86a39f10bb925d3d772adea54cc616bab4fdf88fc3738b4abcf36fea90ef7562

SHA512
c586c2281d7e682d662785de048a46587f74ba4223077c9ead59d877c0594ce1472f00c9062b77b7ad39aa6023229c173992b02357689833d6005e2ef804ba9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50e225c5d2def31c284accf43d4cfd7

SHA1
2ff18811e6a28ec8a24a5b3e844dd4a4e6a13cd9

SHA256
610a5b0b2454a5348ebd8f0b2706134be7fd80fb6e1798e52713c813e5b96ffe

SHA512
202eae8852229adb02678ec3d0c5f82abfc0f97f7821ad2018a4dc7d22b1ffbf2cb06624faa07f52572bdabaf9e864a92db4d57cd354886f9827612eafdc1613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26ef50beffe261471c703b0c7cd3c2aa

SHA1
a4f9227018927105e515289d413c707b5999facd

SHA256
64e47623ab7992f3d313b5c047c94a3bc8f57027870eaeff5194226e6586a542

SHA512
d0ffc5ba3661a9101fb12e24cf5a0174ac8b504d7a85bf4c366363b97c8716c4221e7a0dd9d24872b1e6ae711b2e93309cb34c859078d675b956d9c3c09e433f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a327d50b2631a1713a865df97b0df062

SHA1
381498f47f107483d550c3b5c0f9a885a2016512

SHA256
29261f7492a9e24fbabeecfc883383dcbc2ab7689795c448a3c824db59cebbb9

SHA512
4b2c8d671439e5054893ed53808a0130271d2fe12bba0af57bbb8f1d7f6921626a6b017ed1106d4e7c6fd1713fd5e7e894bbca826e1df35c1e05206e3edf553a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB26F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit