4417163406f3bbd008c2b3584be03cd270fb120b78ffc55a366fb5850df6ecbf

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e5f3d4f6b9932c909978695e371aad0_JaffaCakes118.html
Size

69KB
MD5

3e5f3d4f6b9932c909978695e371aad0
SHA1

9ff6a8dd2afd4940259cfb1950730a0edb9b1781
SHA256

4417163406f3bbd008c2b3584be03cd270fb120b78ffc55a366fb5850df6ecbf
SHA512

0e03974e42fa1781b59a37c186dd8b39f8b10c3d49e3a0304bc5ffdf328b1de69d40d5ad85815a30e8b3915b8670554fae482700b9395239e79595c15ae0844f
SSDEEP

1536:8ThiUJwGx8BUwg8zgah5Xgx8wDctqvLINRxbBdGW2PFbevCnZ0CseN8msj:8ThiUJwGx8BUwg8zUcpBdGWEjnZ04jsj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426970151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14090041-407B-11EF-BF62-DA960850E1DF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2128	1996	iexplore.exe	30
PID 1996 wrote to memory of 2128	1996	iexplore.exe	30
PID 1996 wrote to memory of 2128	1996	iexplore.exe	30
PID 1996 wrote to memory of 2128	1996	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e5f3d4f6b9932c909978695e371aad0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64676f87ec81f614c59accb941bccf03

SHA1
453a1c783a0506e29b0191928808503e18b44944

SHA256
fb7507a7a7f98822203d64fe2edc48676c2af112e0e2836ec88485d93af70ec2

SHA512
f293cc89cb1ef6fd5f7a39b33235b5676c4d0fd401292d68c55954a2e6c62287ba8d89d979d04e4734ab9e83eb2a745b6d46ade707512b0b99a982c11a976cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7c14bff2977965dc6a095c916dd078

SHA1
5ebe25d8cdc0bbc0739355eb4458d918a1c29d79

SHA256
55a87a7ddb7a84f9e3a66d794e1237dfb6c8835eaa310052e3f9068556064d4b

SHA512
98f106853d016aa3e3f56609bcdf2e701d4740df870ed8405c0f44e8cdec5b51c2ad921784a38926ffdc46922dfbcc92d8c1078270220b246b6be7535b9f1bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
852d4f9728986ada8415de34f8baa3db

SHA1
a54767503c049a793b488fc93c0a2345f999ac48

SHA256
cb404891975f714c5c204c2f1e103feda2699bdfe1ec956193337eebc73cbfd5

SHA512
77c6930cae5ad61f92a4754fc293ab47a66c3550964beeff72dea4e8329ae5fd6dd0d5c9c5c48166cbb8f7b570c29b926c2e09c36ea3cf0c7f6df980b96d5368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48c9b48907c2549c16a8cac31acb4088

SHA1
04ffb04c5572a6e2feab205588df2772cafdf086

SHA256
1835f6d8570edbdaa9c646592a4ddefa66b784837788efc414b7aedf555da159

SHA512
77a896e81223c01164e650c0ce8c429e52329ae830895337cf5065feab80a737eef0a5c7167dc04dcd7aa6c970c3c0f991cac399829de1b9caa19f7024bb2051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f411e31d5444dc940e821a8044ed4974

SHA1
2bdf5cf63d3fe832edf261ad98653052681246f7

SHA256
2a69e667d0761a56c20318648049ed5d08fd6bdaf5ccc902ed59c99dbf6c4d4f

SHA512
dd0f1ef3f134b96e605fc763595c7631506912cd863f3ce02c10ace98cb14c37b367a72e3ccc10e6bcc29528bad8cb87be195a90df2b35a4ce112bf082490580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deeb0563f8df43ddf3d06e8fbe0a8ace

SHA1
e1596e17571c1a749f7a2ff42cab812917f6af53

SHA256
0fafe4eb20ec14225fd661ecd681d6a936873d5fa6b89021cf5584bb324b739b

SHA512
f17eabff46018436865b805b4c9e5d797bad0ccb04f93486528aa759af8d508e5900430df57fd6b89ce331dc2d46a6d6e9242e6200b757f3d1006196b038fdb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3495912ca264cd85fd518d349900b5d1

SHA1
f69b4d266cdec2dff7bbc2eca588cd9b7d707461

SHA256
aa9625b8cc16f59bc07075803d29fbafb135d69247ed8864cba04526d0747b2a

SHA512
756895f3c7f4e52d69b30afd63263bdf9b727775f6efc8e93b27dee3e420cc48c8df458c8bdab6b17defccc03776c8dd9cc5c94ea57ca1facc20b33be4435ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8c191dcc4fa923d9cbfc02e08b9256a

SHA1
4b98b3bb5733d074afeb5422016a8c73be1bf50e

SHA256
516374ace9766c6ea044f898ae008e106efbfeadc661694b058ccaf4e1b10515

SHA512
7327e02b9a9ccddcdf63420e073e14c83055e16be64784137c3c04a8436561614171d8a21567682ec3a55e7034dc54bf06ad97df04451d7a07af2724ee35c8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63995ad424ee100f0a6784c9b8d42016

SHA1
0ab8c3068c6377b083285cf6773da81d25ce2c99

SHA256
b6e112cb75e76b0ab0a23965ccfaa3ff5fd009a2067e4210493f3b8fae759a64

SHA512
3b2c655326292742615a764382992dde99be0d7083dc176f167aebc17338b38aa18f7b52f3e10c0c4d650b7ba4240aa2d2d087f8158b5b19b8c59e70a3060e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC45A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC50A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit