c2efadcc1f475b04fc9ca5c84938f963700fb5ea58ef9381bcda1e8054ee0d34

Analysis

max time kernel
149s
max time network
158s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5beb1e6eef791bd0d2602b78e7c473e3_JaffaCakes118.html
Size

50KB
MD5

5beb1e6eef791bd0d2602b78e7c473e3
SHA1

c007a35b565ea9368ce355a45c92f98b075b2133
SHA256

c2efadcc1f475b04fc9ca5c84938f963700fb5ea58ef9381bcda1e8054ee0d34
SHA512

cabdf8d9494159155bb6e86149de9320f2428f14ebdcf9191ce242f62ce65f3bfcc186230806650d2294b8eb1209ba0800d11e6157ed670417a9846d115d76df
SSDEEP

768:ToZxvsncvsnfXDWmXSQOk0xKYVByIvXUWor:ToQjfXCBk0x74Iv4r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424993E1-45C9-11EF-BA93-6EB28AAB65BF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427553484"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2932	2340	iexplore.exe	30
PID 2340 wrote to memory of 2932	2340	iexplore.exe	30
PID 2340 wrote to memory of 2932	2340	iexplore.exe	30
PID 2340 wrote to memory of 2932	2340	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5beb1e6eef791bd0d2602b78e7c473e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b28ba3bf69357089f67aa0229235ad3

SHA1
b114a3561d6deafe1e802526deb6b389848c9887

SHA256
bb2c98d20dc62a7d1c8ea198912f2e5b31fb3c81512c290468f5dbb1bc70c41e

SHA512
b3dcba2903c03ee39c81fdbdffc51d1a2ed1ef12943860dfedce4124cb1d5f7c5c9829c82f6bc828c8a15b74c9a4a630be941c474c8dc7f1479d73133eab2c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1e9e7640f36461ecc8b10bbdcfd7314

SHA1
c81e4243afe8d1bc0b31cdf75d7531d2169ae625

SHA256
2a49b4fbcbeae566294e0e6e1faddfa505788b14ad53accd666f265d368ce064

SHA512
a2b6353c0a9439a62e48aa44b1631f3b7013f701c28e90c74e49fef7e462d9ec99f4551cd4e96f275d6109754c87b13027e1477b17fd5af2a94c8e5d00e2673a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b6dc92628f0939e0c7ddea298552e7

SHA1
65a71318d8ee41370f7b0b07d53bc66eb9dcc724

SHA256
fb522a0b8db8ee8526c35f8384142eb429abf4df136b4ee59cae24f1870e99f2

SHA512
df0879b412286dc97ad77cbc637f759d6c527c4434b9cc1aa4c25390d6f6d5770102cad9b2ab57e808f1d9783676c976da8257c955a614b84a8286ba11582c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e76d0ecf1b1ca8f486b17541c5c38a

SHA1
4f51110976acddf01dfb0df1b26f0aa132f5fd30

SHA256
964a259d2c66561a282dbc0fcfd5cea47868307ee7ede327606d293c62c3b832

SHA512
94b6a23ef4745a28356c13ea592bba10c991bf2479461831122ec548c80810b0bdfa84f0c0fbec1159cd2ce29eda2c694224480896cb368eb63d76696022eb3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1533ca732b2b4b974a0a90c8f98dfcf8

SHA1
989ab4705bcdd1401a6e98b5094ea1bf94934ba5

SHA256
c93aaa6a7e86ce52518ea2f4692fbaea978aff6f436a1b367df9788e766b8718

SHA512
9839887b952538c299a403e7be55f09e160069b2478785cbc17bb4d812c2069cc562444037da6f745b636d7341cf792feb5c06f8b4f0a29c79d246d952823ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ad1e4f543995e8b6176c6acc6155275

SHA1
c99ccbb73f405e1894d3b76afb028703a71171e9

SHA256
4d246e5dc325f066cb732fe11962b3594e287917bcc7a462f018ed94bc799cbb

SHA512
2ebe42e04f82dac81139fc3421f1af7d3571d37c6fd6e37abbcd16eecf37149cfe5434ce18f43d289db6537668408f696dc1bbec4a19eb4dee054b2c653659f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb21c25ab6c8624b0770d5b24cce08c

SHA1
eae82aa3f1c2c55ebb48a0bd00d7f973a26d0f78

SHA256
0a430c6a0598f87bd60b4f6c2c87a110ef3f13984a9e12875dc1c9b752213470

SHA512
76159700df935297dff6d27bfd824a5ff6045850bc58b9439ae36d7937ea35d2f2260c86eb26fbf65d6d11c9b4b5439e46eccbad52a01f8548180e3a7dc63e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af43a104325e30dcc98d076340a2bac0

SHA1
5557232acfbed5d6aaf638415ac636d6f0cf2f08

SHA256
889bc13e85abacd0f2b645c851056545e6d5a55192b130b0c54852c7d6b0bf6a

SHA512
7e449b5a13031d567c56acce021526a96374efaf0cbffe4d192e689945675f3571e6ad59549e33c4d5d3fe9c5ec9d7f3734fa74bfd6482d30bde4a3621c0ead1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ced66aa955fd57d99e2aed7a748d4c

SHA1
283b4b41c5ddd1b6d01f623be36818a645e229e6

SHA256
c70b7f1c3d6d60529b500901d1aee0fa9546efe267013676e52c01bd8e757a70

SHA512
a4910ce115e8d58e0514e5c5c4500f1cfb5fe499503ba863db9618fbcb6ce85d2fa4feea08107f47746eff0f7b2a85f6eadb66e7f0fa83ebf0a7aaff7d730b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ed522bb68fe29c459ffcb217a09a4bb

SHA1
efc597d8cac81e24760a5a1e3f2dd57b2e0ed627

SHA256
c034dca99f49cd4730fe05df58b283b48eae990ddfefd18260928c5fa1736df5

SHA512
132b00590a08cb51f242f00fee575c714e1928988ecd4207af64cde46983f2a6ded236898ace34b48863b77252d728417dd1e3a2c58279969ea032d49b66e0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6402acceb81c146b1b5e6f829fce7929

SHA1
e61e79f8c9771cc6012b7158b345eea426e7bd4f

SHA256
6d8526902d0830bfb43c444d3684f90ae124d2792db0650bf577de67359234a1

SHA512
8e9159a10c59b7a0ae4cb4e3312f49e32943a7d8bfcbf8b5053b6741e52efab0b6273ccfb66a563ddca8819e123a4060a04d33d4dfa21515a10d6785844c7432

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit