59049ad0b078020cb6bd65e3f3b72e929f1fda81369f7f15ae5256eb837bd1b0

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e230f35c84793fa70cad70e65314b36_JaffaCakes118.html
Size

11KB
MD5

3e230f35c84793fa70cad70e65314b36
SHA1

e58ada845ac2c4545f15d574455960226427bd78
SHA256

59049ad0b078020cb6bd65e3f3b72e929f1fda81369f7f15ae5256eb837bd1b0
SHA512

e407221275b6f3a808735c44f412b02712a17270225ee317d56081cf65da2b6d911ea06fac764a6c879b7d7df244e743e542ef9046622ab9e289f3324ea9e592
SSDEEP

192:2ValIsr0r57MKxFT8C/w1wvqa1MmuBuLbdU8d:salIcIQKxd/ggMmguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426965116"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AED66B1-406F-11EF-B190-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1044	2512	iexplore.exe	31
PID 2512 wrote to memory of 1044	2512	iexplore.exe	31
PID 2512 wrote to memory of 1044	2512	iexplore.exe	31
PID 2512 wrote to memory of 1044	2512	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e230f35c84793fa70cad70e65314b36_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fe8ec4d5140686da39c070ef07cd19f

SHA1
1250ba48b4b4008ce81e2ba8467508b4092c7404

SHA256
7eae0afb8a1395d5b98247e52acff37e121abd10ff0a3c1c2c3d4c914486e395

SHA512
b8fe21b6d9ecf834946cf607e92014964d4de4c7e6e6c887176aca0b448ad35559dc1ec13a7d1a7abbf9f2962e16ddc9822aa5dba52f24949c8876a4496fbba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4608fc564f03b577ea6c002352b06528

SHA1
f283c09bc61aa2ca9bc354c2dc946d8c1ef8d2a8

SHA256
08b0c1c9d885e0bfe111a6865dad3d36a4d9ab13c7d4e46d8bb65ea134014776

SHA512
5ec8fba30efcfee502560c534fa15c969a614023fd88cc262bdea462a94fbdb41e8f2e982b9c65f8ca3f1d4199804c30dc79b45349c669b56a62b8a25ab91b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12340cd3cacd89c90bd60bafb28714e3

SHA1
fc75f89de0bfad6cdf4f31baeae134492fe44a46

SHA256
a416108c17692e8b82f07f0d0361f55e8f2eb9156de24c7ab09497761ef87c0f

SHA512
5b40ec17969b7105f738753f6e8287c968f32fe2b23001a2c7fd7c7ea045e7cbf0b65710af7edf1ddce8b687f85b1c2a8ec1159eda357d0e1b7135ee1d67e458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecd4a490690cd55df67f8c88d9b6ca19

SHA1
cd7c3bfcb035c478d6d4303d7b953694af8b848a

SHA256
96fc0d596d7fac930cc619c132594a9c3fb72e59683a9d0d26767881f59036af

SHA512
88cea98f8a32134e4b14f407ef92dc230ca8686610d7cbf3a58bfc1fefff57d6b89635e22bacfeb3dc9cf94aab1b421380ef81b69a042023b97cf1d6e6ed0b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44bf2ce8809c3511d32602671b155673

SHA1
06db1d123e31d6893f102c84fdfbe391ae46ed21

SHA256
9e801b3dce71625ec1b180a06bd5d14009f3f9b80c480d66138adb4607c3d5f8

SHA512
2ad2f955d5e6f1fd04a15a3cafe5d7f9ff295ad8cc82dbffbf8a7fa7f0f765da77c1f159d20068f975eed778363e6daa566905fada4ae3a9625c259ba9888d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e878d448495fd64871dbdf6729ff1b6c

SHA1
ebd0f01c9888ff90ea0860c013e3c9e7c107c855

SHA256
f264d805970fa356924ed4ac76c3ec3155d5fce1e8a27c45aed824d1c5347abd

SHA512
cf2cb5f44c2ddefc7bf98cd3202f45b27224fbaba3ff0385022438210b259c087e0db94fcf2d6dd5679c71d5b7a1a9eea940f8641498b11f43646e79973d8f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbcefc93b05c8e2db9a04c47135a9f19

SHA1
d961cd982e06e50ab937ea14cbc194c2a52f5c37

SHA256
ea410f7e97ff7bd03240cc4be533c0b6fed5d137ca6748c5023b6e2f41a67463

SHA512
233a3d3d9c636768b6d0dbb4b5740719c3ec1ba8b52f8e1b437a9a48c8e888a1d06a4eac40e29bf0ac3c3f40cf9d8ca2216f7a4056f1449efaed023d113c35b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1defb6b5b0b977038601a2e841fe9fe3

SHA1
a1f80bc16701103774bb3ceba9ef8edb490b07e4

SHA256
d79d3db7a6c9c69fc8a1d42bcfdf54e549205179905f04bb879ce347605aec02

SHA512
5343b7845b198b9b4d8e469c9ab93036b7bd65568b602c9f11d09067cab9477187f14daef901b58f3d7229c38e15169bcf9b95f6b3652aca8686f4c9eef46e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ce4f3c2083fd2e55a744891a8485deb

SHA1
c14a701332e18e6cb352cf20850b9371fda12137

SHA256
59193780b67905d98de8f0c9f95d2fa351a96d4e730521e3554bc6b256ff6423

SHA512
f72c7aec9aed92c54e75460aa9bdd7ff30509bc14ae83b33001ce0a994144d267b6f1091bae2ad6c7a5fab188d7cffa158c9db978f97330b6a77e9c1c56d51ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB91.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC42.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit