0d7df6b20bffb8583b0486da785757575db26a7c9c59051b0612224df8fece3f

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42a85a24c44097844083ebd8898616ae_JaffaCakes118.html
Size

66KB
MD5

42a85a24c44097844083ebd8898616ae
SHA1

046083aa33380f99984e5d9ae979df453737f388
SHA256

0d7df6b20bffb8583b0486da785757575db26a7c9c59051b0612224df8fece3f
SHA512

d45a8d2c0c517dcc19272db1a8768acdea62af87dec91844857c3386793e41bc0269b1b5ea25674ac3e23fb7bda4086e22160870bf5a63c0467a871e5a043654
SSDEEP

1536:3Abkcl0tM+z7HBAzaedZg61bp5FkpwQpySc4A+Nc0ez:3AbkcluM+zLS2GJp5FKwQpyStA+Nc0ez

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86DD47D1-413D-11EF-B49E-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427053665"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2744	2684	iexplore.exe	30
PID 2684 wrote to memory of 2744	2684	iexplore.exe	30
PID 2684 wrote to memory of 2744	2684	iexplore.exe	30
PID 2684 wrote to memory of 2744	2684	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42a85a24c44097844083ebd8898616ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
431cd0ab59d7ea1569e9ead36f2d84bf

SHA1
fd4c9016e367566b75a2418a2046e634352bf83c

SHA256
cac252620203271382cc2952a8dd04d1bb78cb5130c2b36ab988ed14fd018dac

SHA512
3e0c517a291ea6e7074277a870aad2398caa694aa4dce05e70c22846bf18092f40afa4bb8132a238505a7898afc5f949d40886dd96749acb64af4ac156f903d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0beaed90271e99129f94c3fed0b888fe

SHA1
fdf4a3316d0262b4f32d265a086e66e8e2095014

SHA256
04d8eb3b0b914783c4798370f630ef0888808786be5304b29bb4605bb586dc6c

SHA512
8fc4c3f45f294514e53b143b97eea1f926c95a06b65644802c6b03c0cb88730e5bdc0d88be679fd992f9690416c6fef16376e2b2d6062a5eeb41f30c9fe38c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
802ec0b257b3dc436e20e7472f5d7f33

SHA1
d584006e8e60b8694eb8c54e47170892b71541af

SHA256
8564b0c2beb6373ddf4bcc52e8bb110024b81f0a5b806bc352b9b89626739530

SHA512
68d0818f23903a9e176208cf196684774274cd09be7df021b37176c0490dab970fc1a9131459c9111a789807982d14d2a44549bf172b2329214715571d939ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb92f1101919337d816079b14edc5b98

SHA1
e8b3e336e31e88502aefa1f9cf6349a1c6859273

SHA256
6614521f40893f4a608e8cab08e549edf7505abc2427baa751b52ece37300027

SHA512
650a2ff175d38a57156871d65601e1ddb92ad1df5f1c006d2a28811f2fcd6348f2bc239db5245891af418bb0b67a6e03b4132c0fb8a55f2d8fe463d2bcd9c18b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe1c680b149632f4022ada8e1298bfa

SHA1
3de98424b70438fca811361393e114c27ba9d548

SHA256
b0759137a09d356bad764d5af7f62b6bbca6e173535e91bdb06918ce802b50cf

SHA512
b4c7851064e6d304d80240496e858386c8561b6312db87aa5b40227d34a15c45cdb298472819f893d8089ffb179c5d8d0b353313cc26d1d0885cf0abdeb5146e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e89ef5f2215c876e905cc2853a265b

SHA1
3cf4dc3d8e19b9ecfa29e63c4aaba0b309f56e1b

SHA256
90ad36d1d03ea7ae052ffbbf2ac1cf8fb40cf45a33e1cb4a4b2ed485234891b9

SHA512
d2a78b83a5fe6c25a65feafebc500a2504eea5540a946d72c2e237f489ae461edc4c8777ea515d17fb2ab5d2a447ff57df53480e10fbf7f347858c649b63d407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f6a9701d1bc0a22625e6c37cf278fac

SHA1
7069cb142607c4304878e9b1c80011bc86111ed5

SHA256
fe4ff347372909f0211cb3b11b5350c8118142f1d3ff133a76eb8168979a02dc

SHA512
07b265ff5e447006ce627d0750c287dea3597fdc3ad64f4acf591feab16796283634320c8a08632adbf006fd424147e46729d8a322b0153da6bbcfda6f5e8085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a979bd310d69d853c36ab6712d33acf0

SHA1
a4694412839efc1a38c664293e3f612d3f73e773

SHA256
f9bdb2fd9292f29d9eb9cf0c5341725aea7c9823743511aae7654e179303caa1

SHA512
4bcf0f23e0e5af1ae75a51ad701442289f05483b7bc43994f650388465787694206a796c8e10027c31a714d824c3afccb126930fb905f72429c26c1260e5de4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22a4862b874a8e2fd887cb43bf11790a

SHA1
718517dd467d60d3c0d7cc35d84694fe0e0da5b5

SHA256
d894f51e0b99cb891621d563ac066ea1d78d6882d3a019462624111e1183d2b2

SHA512
1ad5a7d8645024fb670aa8f83e57f85e10e37eaf1741a82d506f72413672b85382f054e799747dbfe4beaa7d326cb8a31baa8e3b5d0a397cd8b2ee294c28063c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d920193e335512eaa77026cacdbec93

SHA1
c43dee40ba49264db23989161069959a24dd0c4a

SHA256
a97896f939353a7939dd61ba1ed4df110166b98853abc828c2947b1392bbb945

SHA512
8e54f7f3dfdf40c32127d9da9fea6945a54c39351ea5f908c2f1a3092bb68d7d8b34ab9efeee22aec7e16533067f079783b82f8064aeb3e8d9cb98a1313b9e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f20d9d62441123d9f097644bd3bfdbdc

SHA1
e091fb349112d1a2bc447cd5b955ed2ba281cc3f

SHA256
045be8be7e1b98e5237382bbfdb63a8c8d8736e25108e2b8848ff796b8423a12

SHA512
9102a11fc78557e6a5941c342aaaaf0e7679cff41f3f1b7676b67cae55effc1ace528ceb57b686669b43ff0d1bfc56f07447420b37d291e2657d73ec86244c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12707a1db4bfd40a2753a995eb2b4f54

SHA1
997e6cc53c169e23237f0575c6ecb894327e0234

SHA256
c407bcda3df1034e23c44c142e2e207da0b5ce90b533702a5de0bc81e17d4b56

SHA512
e880c21995db5b661046373730b6ce57d55b5961fcd9898c745d2f37d52ddea5c7dbc569433698f85ee55f122ce37f57b5235f3e887b244422871326f77ba906

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit