852a63b396ef796e97d92ba0c733414e9549b5fcf1dc8936895339bc51219bc3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f3f69a0dc5d6ace9ddfde553a403330_JaffaCakes118.html
Size

259KB
MD5

1f3f69a0dc5d6ace9ddfde553a403330
SHA1

d080a0b55ad9e05af75e6e6959d21c4949ea6f72
SHA256

852a63b396ef796e97d92ba0c733414e9549b5fcf1dc8936895339bc51219bc3
SHA512

e2e0fb270ae05241cda2f589fd7e018ff6a635e10dca955a2bd7b557d2abee101c4451354f2129e953f524d7035d47c332ea60f6bf009b47d1d82acd17fc8ba6
SSDEEP

3072:zWCo2WAyXrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:Po57z9VxLY7iAVLTBQJl/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421213253"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4166EAB1-0C1F-11EF-A499-62A279F6AF31} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2516	2644	iexplore.exe	28
PID 2644 wrote to memory of 2516	2644	iexplore.exe	28
PID 2644 wrote to memory of 2516	2644	iexplore.exe	28
PID 2644 wrote to memory of 2516	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f3f69a0dc5d6ace9ddfde553a403330_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
aa175007f1393fc58fe19fdd51b0d1f6

SHA1
a3d54221180554a87cfbcf9423cd79827698bb1a

SHA256
cc808e6382c77477fe226f6235b4f3a9480eeab582fac3a950b74ae38d4be074

SHA512
6d9b915a1fca991fbdb810de2dc123d03d78dfc60a08fbb79694c5bedcbf17fab5813461a7dc13852c53fbfc0fe269f76123a553b22eb45ae77a6b70834f38c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f3d22e7ebf807ca4790882511da2c92

SHA1
1d48c015823639e6f022338584fe0ceaaf5841f2

SHA256
6fda0746609d57e012d1f34873db4b267a1bbe7cc0507d88f51eeb2c292ab7b1

SHA512
d57db6207c604e1859f65332e2b15535b5aac330d55c1b060af4ef00c498414f7dc76c69fb212a41aa9223c589b9eaff4ec683681fe59f43712560b855b8b182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38c405eb0d1c2b14dc64d014487fc213

SHA1
5125f443ee3f157e3423f54a70c40b3f16e433fc

SHA256
1e80da46a1fff83947ae058b1ddcd7957fbe43ee22b45fbdd59b62adead661c1

SHA512
ea509a41232f7b2e564db547985fdd966f150f4f162f37c5ee656d541ae158b516e2fae1d3a8918276c0113459bd669a35c539b0c32e2e41478ff31a2b779c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88bb584f1d657d199b7e7dedc02c5976

SHA1
8b6ca5c972637ee5c4ef56132a34a44b9d59ebcd

SHA256
fae4e0a492fa29ac1cdc4e53956d6f4011646dc9c13dd8bccdbdec73fb418acf

SHA512
f00794b29139a33b2a97096b255b845ac54c4e853a2b179ea885c866953397855e91866bd41dccb2992769229ac10119244d2e08aa7c5ac70b4a48262f2c7210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39f39227c29f6a73330d80ab3c2786e0

SHA1
7bbd978fde5690927cd1191edeed0c1ca88efc2d

SHA256
77f570df60c3c7fa01717dd21ef36c87c24a51a116b6ad1bdb66bbd1288a7a54

SHA512
7b824945e59e5c8ff03c96436254980eac8b4970d394f7a83f715e581dac7cbaf859ee2180e70a28b520f9fd9dad29a30add932e7c9364f341477f645f709459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
959145a75c3f5fdcfa9369b9fd7d7953

SHA1
6406501c7681eeca5ed6ee78256623f3212bfa97

SHA256
a8d13726ebbf2dbf32e3bcb5c8857ca9ed458c15038869eaed03510d0e6ffac1

SHA512
007ab5525bd5ae7018cec7579ba75da648f7f051d84988c62acca0e283d1ff9171aaf65a22d97a38503110c724ebc70664595873ff253548df2c57af116486df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f809a5a3651756a27a6928c5056cb3a9

SHA1
9e64d424db48dc96680e185c9766819a855e37b6

SHA256
13322577acd6e4994ff49bd2efc4a5717eedacafd3f78473052a54f45657235a

SHA512
edbc65f52479c7a70ff40efce081e3ef071a4cb2d00fe6e47da0237b99e13cd939da2bee9210d72f3d060a6aac3cb504fddbb3ebb68a056050c54355f49576c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85728a4f74f639f0f8970a7e78e9ec8

SHA1
29521a822ac59ca8a3bdca2e76f9e55413be99a6

SHA256
017fdd32c49ec9c598558392181a21f7545beb5525808d3cd2a301e3c8440a83

SHA512
517382a7b405d24f23dbf2bfbb7d5ea238c9c164d513a0e312d60a4701ae2f4e8f337adba3aa6879e04fbc8d8a9e03fe2a8816152f302e7c2ecdee1a7283d231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3140666d2172809988e2c72aa94b9e0a

SHA1
ffec878548c5f7c954c99733d03a0bc6c1084268

SHA256
c545182480f74180a1066b9d58afeac1264c706fabb6aac84ea60ce222494bc5

SHA512
33e587c781a959250d3c7543b3bf4881c00c75414c1b70d36e0cfd1dddcf9f742e59b6ab5d429055bc895870147cbee89a567d18a045a2c72fbee0174acc65a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc82aaa1a33eba78830aa30c12a430c8

SHA1
58ed221780de068256ee762ed124f25bcc2e9dc9

SHA256
d5f2c81f3ddedbf2cfb9d44245de2a5baea7bd68885f62c32a679e680450e0ae

SHA512
6f04a77fb8c45762cf73d9aec59e8fddee7bde21797aff2a3abe851ebd20d2f854cca127e131550820c51d572d11d93cdd120142aa3b746a562d6bcba26bafb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6b60b176d64f8c0968e3198e36eb1b8a

SHA1
3a15eccac9fda9bb3b4168ffdae9b8f3c53aaf23

SHA256
b9e5946a092b5110d811adec786440b433c7d32f6d9f8f9ef2e980a191eacaba

SHA512
dd41321f85d81b3d011aef61169648ccdeac7ea357afed92d737a778b921915e8b4e1059768c1a209c24df20e35e1745c6eacc69c8cafc52b6f30fe9a7e0c4d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10F5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1261.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit