95bfccc7ecd4ab3daf70000ebd6b6a9c43d473ea5db8fa04742116e250cd187b

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36d7e199db28f1754d88e40322a1e318_JaffaCakes118.html
Size

141KB
MD5

36d7e199db28f1754d88e40322a1e318
SHA1

af4eb2bc4dc15c86f8f80dc77af3bf99ff902c40
SHA256

95bfccc7ecd4ab3daf70000ebd6b6a9c43d473ea5db8fa04742116e250cd187b
SHA512

f7d6b0e116618cee62f774546d511ca1d03041fd2ff4325b9f452167c24a8a65896c15cf93f0dee2c7809a8912d2a181613dd98b9edcf7ec11ceb11fcb8f738e
SSDEEP

3072:SQerKgx7dyfkMY+BES09JXAnyrZalI+YQ:SQerKgx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421627945"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C86374C1-0FE4-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
640	iexplore.exe
640	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3036	640	iexplore.exe	28
PID 640 wrote to memory of 3036	640	iexplore.exe	28
PID 640 wrote to memory of 3036	640	iexplore.exe	28
PID 640 wrote to memory of 3036	640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36d7e199db28f1754d88e40322a1e318_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2b09cac036085a83f831da53279bcf

SHA1
368047a4d5fed12bd59c6d0f455a0798c760601a

SHA256
489bd9d03d2dc35dfcf0592322ec74fd3d2f2605fd0b3059c3e519aff1f84891

SHA512
0abfc70b025f303ca485458cd853e5aba6bd7c0a3b02a8325b69c330197ebf38fef93833aed433cf59160168fad999cd1c19bf7614738a2125c9b95b58e0516f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cc0631a83f862c25d636eae4e89861d

SHA1
8a9dbde2c3b59539e68e82046a22648772c8c27b

SHA256
832ec42b2e5a16c32e0dc4f2cae2567da977a7f51b5c0091d15de4708dbbbfef

SHA512
67953642ec5bbc6ef3c3041b720fcb7513505645bbc2b55c4a6e425ca5047aedf59c6052e0b8216def0b70595383fb9905846056cfbba22de65ddab19fb5568c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06f1b505a629b4737dfb577b7f481cb8

SHA1
4527b972b6180c176441988a7678c8b52e613b07

SHA256
4cc1d6701afef2a24ad23415335dcb0c1f234b176e019e2560eb02a5bd4aae10

SHA512
feaec90cfde6aebdafc695cf777ca490665ffa19478f4b0f70effbaa9800373ba67ed06d2419d123c2cf2ea15765db8b5b971658ccd1434fbe4310eaa104eabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75af1318d1ae42223dc5c43853bf21a0

SHA1
4d54d6e83a52d0c13fff6e6a8b5686eb05247065

SHA256
0dd4f4234e328b1d441533550a802432aa70bc60743f0770ece453b6c7099767

SHA512
284c503616340b58f114541d2a7414e9ffef1aa04f51eb8065b5900f3bd6277977a099c7b9a7cbf819ac3cc229705bb22bf5b65bf1ff55813eb9970a2596bad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b4845baa07e8a03ac402c32990c2c0

SHA1
2d2f86c19b24b2603041e7fbd3f563dcd2974c03

SHA256
33281b9499a869d1036f26498c583baacfcc2f29850efba4c2e9adf109b6ebab

SHA512
f5ac7e0eab65eb72e9219ce122a104cc062cbeeb31dbde81262b759888a1e945bfa2331ca1d56d64ab35187878bcde28755d7f80fa97c9dc12cb30d1e9743c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad263632851c44aa6391c5bf8f440d19

SHA1
5527dab200f227eadad77ba1e5c3e363849562a8

SHA256
b4b42dfbd400c77e2f719f12c6bdb2ccfaf3e50f9cadc5346baa79729fea7c40

SHA512
0d8be29597791472b29714db0c51926b1add96faebccd407e0bed9e3f9689065342f0002645f17ccd0131cd884ab79b4b34c7c5191c3112bd53c7103f8602834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
708d5673e35e79c7dc2b35c84868369c

SHA1
4c182f7b034f985362c3fc741f88507509708da2

SHA256
08a9936d59e2874f2abffec26705f54b1b16b48e64c3fddb7f4b589bb7362add

SHA512
c59d8995fbd294d5ebb1610d8d5dc7ff8c6b97fac1f24653c3ea8bb81c1e89c18c1477af45d19d891c74388785d181e18224baee96bc909b799b8cd30f598ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224ea26904ccfddc9b8580ee4dd1d987

SHA1
29057ea2abb869539ac2211ed7784e0f8574b494

SHA256
848fdbdb0cd58e35ba608dc04c8ce9dc5134dcfff173e9b5bfcdbda405e43e75

SHA512
c118f0515ec344bf5ab76f704aad48c00dd7be5d9d6d828d2a7f0427ddf5e19336940ada5113465fbd78f91b82f6c0a454d2047d6bb4920fb6da713b9c86afab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb74a1c9e710378e7cfbe11d658b92b0

SHA1
d977ebcfd8c33cd2e676dde05809d8e01e19e02d

SHA256
c7b074bf72236e841e4a0fca263b678c643ac743048cb4267f90fb205e01912b

SHA512
285b66634c9664fb699d05e6c2809586d3b5edf59ff728f5a06d660f1f11d34faa2bd4379bf26fb6471d1ca6556c4304baddf14dfa6fa6c473ac3f012cc32c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar95C3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit