ce57ecf0e257c20a62c4fd6f61b819ba2f096bd50f925dceaa44b78726ee01a7

Analysis

max time kernel
132s
max time network
135s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39902f765b22b359d75bbf215a876bdf_JaffaCakes118.html
Size

11KB
MD5

39902f765b22b359d75bbf215a876bdf
SHA1

9cd38d74446906007358a58fa8eff057037c50dc
SHA256

ce57ecf0e257c20a62c4fd6f61b819ba2f096bd50f925dceaa44b78726ee01a7
SHA512

b78b1aa5398b7e177f4cf515622a53b6bb11f68fe8e9e8987cd190fe4de0d0ce0ef932b9c174ddf5629636f1309931d0f95ec48670385123ece74dc2f8094b23
SSDEEP

192:2ValIsr0r57MQxDT8g/w1wvqVkt1SZauBuLbdU8d:salIcIQQxb/g8kaguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7185B341-3F94-11EF-B1CF-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426871097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2100	1740	iexplore.exe	30
PID 1740 wrote to memory of 2100	1740	iexplore.exe	30
PID 1740 wrote to memory of 2100	1740	iexplore.exe	30
PID 1740 wrote to memory of 2100	1740	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39902f765b22b359d75bbf215a876bdf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dfa1c1cba1aaa7c03c0e303ffeab330

SHA1
4be9bcab72563f2e1ded8b2ee9689f6f681356a3

SHA256
5dee1f88b6d9549e2c45b1c061261b1822579bc8ad937290f20e7f8271766d98

SHA512
9547ce3a5a9784eeb621e04be3e8c8dc2da4abfdd11289727b758e47aee3a3f312148b2761d97818a1793f492401aeff33f4283ab2e3d868da23830ad89bff94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2c6e8e3cde3997a0705d19c875c525f

SHA1
6689af4b20e17da09b96438eaf6a1d93c4b18dad

SHA256
b1c954a8b8a96f8f8e6ba3e3043a6e113d5ef066ed8542b4eb5cba5d6c4c5d28

SHA512
9490ac7e04a009aade4f13997ad50f0a4faf42a931ce4a5d7091f838e33bf2db1bf79a72f8ddb2547fdc00c996105cdcf0101c5ed2fd0be5a185fff528c53b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c223151f0c1fe64f58b9e7da9d989d2c

SHA1
c32adce09ba4eb4c92bc3b37f522fe1a4f14c56e

SHA256
10c21a54a4c28990ba168e2944cd51e9f89a43b59715bee063cafa81e0231c8f

SHA512
3d32c2652869a32d3d91e3f6fd47a272ffd69acfd8f417625c3386372acdc8af22620c130448e75a40fe9933e0fe9121a4bacf830288e1a7f1d0f833fde11f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e755f2c0aea03329dcd4299439998bb

SHA1
56bcd4689637ad774a6c5f41092b0b8cbb290f6b

SHA256
dc1870fc4836fb7a4b442dad1568535ab7c472a75454d43177bae8ce5b7294a2

SHA512
2886b35c0a49c4dc9ac4b2c8dcb61698f1077a402b8a84936581cbeca9d980a5581d56614843cc90c1a9a7822541276764c35da7fd51fa311c1d520f5b1b69f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbe97c33ec747be7aac3f51290aedfa2

SHA1
e10940f7c3b3dec102e9dcdc9f4495e3802bf0b3

SHA256
3d82a46cecbbe8374f4b9dccecb1f80d65812d731aea44dae44d4fc0aa668cee

SHA512
cc164890ff895056bec1a7fbd48fce6bda21fdd05d55982d03b36a0519e50fe800ad5ce466b9f96dcbb1f9d0635991a6041df68379f77df7cce60e5c34fd91b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1e29dfeebe05734ba68090db9defc5a

SHA1
050cfd8db59b77920da55f16896565b3fb4b3f14

SHA256
364ecef13ed3391221f67365f7d9287877241be275ee6690ebf01b861018bf76

SHA512
33c79373d572ac5219106b7fd06a59f72b6ba5709a3d4ddae8fbe3650c1541e558262ff2ec146c2bb75fe817704c25a7edfbc72bf000f6dc46467e8577645be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6997e64efb6c450cbda41b9d9f6f7b7c

SHA1
4d489ca975e2e135dc9e35514cb240d6a7fccf3e

SHA256
3b962e415c3c91c1cf6b4e0c318b867b546f02c2f7cac0bfb291af6f73045752

SHA512
1849da07c80d72a9a7018ff233183ffc49c6052e7784da12df5e09fde0e215b0beec84899c39f3607d3f922d55cc3936530defc496f16f8bb3d833fed4349906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35b95aa1b68bfc3094669aaea6679862

SHA1
efbb71d8db0626614db8d9a9b90ded2d1589ed9f

SHA256
7275e0efd11dd0b469dec6c0672a61092eeb8f1716ca4760c71e5d407537c872

SHA512
54845bf30e65e67c0013dc6c5887289aebbd2d1aa27ecb31c1758cb0e8fe9734847dccb1b769d1e89456138ee3768d10113653ebea148da26b061a31e7ec3775

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC47C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit