757b05edf0b47e35269735fc072bef80506434d27d5e41fb97392543cb1d1077

Analysis

max time kernel
108s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

264ff6937087db0d7da3e4d2c737b5ba_JaffaCakes118.html
Size

230KB
MD5

264ff6937087db0d7da3e4d2c737b5ba
SHA1

7132b514421e0639f271fd6e0e2b8864cb826485
SHA256

757b05edf0b47e35269735fc072bef80506434d27d5e41fb97392543cb1d1077
SHA512

89fd6d3b513afd9ca941f098a0a53b228506c1bf3ca6afc2297865eb09c5f438d529a1ef3e53c0a78f8b1d2f759223ed9a42f92aa4509d2ca1c41fd44253791d
SSDEEP

1536:dkoN8Z4rmcdeVZWIF4kpUBWHA9pxRTwF8ZM8nXeeVZBZgTKXOUl9Jqb1yhX/1PXS:NtgsfMCv7XOUl81yhX/1PX2SD4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24E24411-0D6F-11EF-822E-56D57A935C49} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421357518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2344	1736	iexplore.exe	28
PID 1736 wrote to memory of 2344	1736	iexplore.exe	28
PID 1736 wrote to memory of 2344	1736	iexplore.exe	28
PID 1736 wrote to memory of 2344	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\264ff6937087db0d7da3e4d2c737b5ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
db55fcf96aa1cbe283db60343dddf8d5

SHA1
beb8310089358fa28334862da0c2e758e4dfc51f

SHA256
1fc268e957da3150f11916ae9915a909448775c590483f22f1e4930f7f472db8

SHA512
fb59a025820fe6387661e9cca055978fea92e9fc02fdfb43be961b88f62e1fb3dededab5d10db4d23b1b92ae26a4fb27a9651caa2672ea88aa4951ea07b935b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37560a1736b0d17682469ddb83018e41

SHA1
e750f89abc6fc960083964de82c58864b653583f

SHA256
361f6cc78f88e6922f340f575416ad8802af482d8847ca8658e90dbef1402f36

SHA512
c20f3dce221fa1151a050271d045c8a1a5bc2e26c538aea31d39f39edb0737846853c54f15cfd5a9d620319cd8fac3ff5667662d6146d5c6033c0ad4bf9a2445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea228cbc97e79a435a49ac97120b225

SHA1
a7e54c65e436ebbb0ae9ad2150a561627cde909e

SHA256
ba131059c2bf099920cfedd5ad2f4c8f0cf332a78455be1ae2d78fcf3cbe3fbb

SHA512
4ff43fca187c46ebc30394752632a47b32033c09cd2ba0dc773947404602d203791f46006a98b6593ba7edaf881b3f710a68cfc2a0e0a7bf37be86d942b7a4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86907ee07b140314c267f011f8ccbd83

SHA1
d520cb29771cee0e630289bce68e147d8acf2c98

SHA256
6c9fe362098b6976350a274ed7859d26189a2ac34d6bc047208fa4d1a0d06ae8

SHA512
2e40e2468c7a920fec85811424b3df2a54a23953ea71f753b61ab73e983993e124f67c771363e8adf5edc49658af75dc1581897286789a79616436e1f23a425c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fdc8fe7e2d94a755d36130fe07b60de

SHA1
de8ecbe062f348d7576ff918aad74bd15c6015c0

SHA256
014ca98930fbe657c59d663b53150984e01abd58d392759860671de3cedd3264

SHA512
696ac2b3123ef023dfa899381a03365bfcefeec14fbd6349362a22219a7d9e36a08713d9a4a3eca24741c688f3007fc54091a07a4c8359b599ca4b607d3baf5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb75789525ad1ec7fc2be12850efe792

SHA1
27255daf73a7ff1966fe43f1a0d8da5ac8a7115a

SHA256
d359347926b8d2d8c1122543410fec3ee4e8600f7e22bcdf68182bca6ec8c5c6

SHA512
98739c5f25f3cab93b0ed2b5458b30dcd5211b4af8ce50a3bdb146396e48c94fcf237156695386ec930783f9dffa6a54a5f5f76936ef67383abf9719fcae6054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98bb55e6af47421be116ab4a7c04e59a

SHA1
734ae97251fb1b8466d59069e65e93107fd5e1b8

SHA256
641001f3eaa3cbd53731af00852abc6aadf07a260fc4df91550e63e7dc7ca5a2

SHA512
257752556e730de930fd7b81e5158b19bd10c5567b24658ad202f82ca92a7cb38b7e45936ea0e9644b20c93f89e45ddf18b2c9da6a35198edb0a222007101741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e1560126e2392a0a07bff01d7a7f815

SHA1
2b51d2a664a5aaccdc052d3f15df5f470e944269

SHA256
2e41132edddf9aa0d5f5633b1d39b8a92e2e457b46b634bffea4f1e56841760e

SHA512
44749e82d3f2d1135ad0809dd47de127a9d16740c434af82704ba59557b1d243bb8c1367553754361f3240f7b554800ad9eb0b7fbe4378c77005f07b875c900e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc43ed3a64454be5d629108be4c4b82

SHA1
d2b7471b9887318df80e922e71c69dce68592a37

SHA256
3634a2ddaa9bdb68971471a3722575df9b7a91c701df7e7c550668ecb4250dd1

SHA512
0188c4fcc2693d103f30d2321048fadac4e695398e4c5de46d3dbf21c036284ac4bbef7ce9060469d5728cf0d9942869fde157ccda1f1b786a1917e1285804bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b621821e55d7a774c2e017fe90939a

SHA1
788296a7eb7a206ff833b7bfe8dbadfe74614834

SHA256
f36000f11a0dbe740fe16d4d0fb86b90393fe6f544660d5d6a68e09e5593ea49

SHA512
50e86eb863954f72c921a1c2b961772ccd4b8060225476b5c1b5d745185767ec680320567c6e448e0e44f0966ff5c4a842b602470f4a5a79dedfd61fa5242872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204f777d3321e0083e5af2462414080b

SHA1
1644bb5219726efea5af557f694ccb5c754cbe44

SHA256
e2b9b7071e8b3a9d651071c8a47bc3c3dd24b984fcf3a50b48dd7dd11cee3946

SHA512
de7cb25a423f8e7526e14d9475c1c89477b6395ed8f3d54167b22468c460664fbd9b49cd5f071b43878a70cd7b3c779be9034a24f5a21ffc65c0692ff64c6b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb7334dff79c2e80da3ef3a08e636ff5

SHA1
f51325d5a7e0ce53c0410dc1456b07db6b6df223

SHA256
99004cfd7981d362c1e30fc83ce6fd33dc80811ff02aef436d17178fe22a66ab

SHA512
c2d96a311a8daf6f5b6b86e81b37e7b9a9bf6bcc98a271e00475b14ed18071c3cb7c87716e09fef8cca56bc59907f5de8920577d4d0ea7f41bdbf5184368911a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1fd6e5f5f449e944dbb326367e8df374

SHA1
910e4811fabaa93fd137faa06b3205f2eda45d2a

SHA256
b31c776388a997643ff3fa822b149ad4b990b9c9e67339d31ba1ab744883c856

SHA512
5d2c3f895d57b3c76f9960ec0ef98c8b8fb3a631b953548cd392ea5dbd84973cb81326cd283945ca296921dfdf7970bbe5ab88b61ff027c8cc5488a431add45a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2479.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit