0d441dffec5757eb68849f1926d1cd35e3ba6a235877c0e02d1890f5a4b52dc4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36e980e189ad3721dc437faae6cfffc4_JaffaCakes118.html
Size

31KB
MD5

36e980e189ad3721dc437faae6cfffc4
SHA1

e75165a29dd200e0eecb6dcdaab920f6374a486a
SHA256

0d441dffec5757eb68849f1926d1cd35e3ba6a235877c0e02d1890f5a4b52dc4
SHA512

74cfd7292bd167cd5fa93ac2a248c691cb850e463dbebcee5275b73d3d08bc505aa59022f1fa758682ce445627fbb9f42b36c6ba0733aadbb276a8d5d8a3f03d
SSDEEP

768:SNdItqbrJ69n9OzTFsORLPaJUd+oDyPhSOMfOpG/MqlM/dmOPk:SNdI0byn0FsORLPaJUd+oDyPhSOMfOpm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46F852E1-0FE7-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421629015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e980e189ad3721dc437faae6cfffc4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac2062f6cd9149036ba0264b6adad0d4

SHA1
998a17d5e62d4371d2a9b1fa2d73e43c0a32b75b

SHA256
8fd24aa42d4c51e66bbeb2f1e1465e0598dc888b530222fd244f45d9149cdc91

SHA512
d22c2668467b39105bda6813186bf39da8e2d7b2e63aa20830e8b2729d6d397773192174da9cd8b84320e8121ebf04b9fe0e343f7c72f6cdae9efb6f4b619dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f63d13eb49e470d3647c1355227e969

SHA1
83d6c62f4a31a398e7d60d2a0f6fdac836fdb861

SHA256
e2003852a3c3f3c8de61c781b95acd2fa33a6b6e7ee1ffd8fb815c3267ecfec5

SHA512
02eb3bada798ef5b841b2d9fa5bc40aaad32bdb08b510e34650caaaadeaa6e3c071a32ebe45341f3d4751ff262cebc2c12b62b60e3d49077eee39fa993a67352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ff49e7056235c993d659ff1f0ce6c0

SHA1
d34105b4237620ab38e348581339715813f4e4ec

SHA256
69ad37740fce56bc98da8d829301ed9e89114577ccb0e27df46ec7fa23d2cc3f

SHA512
bd24dcb2f0c5b006ce3ca5255e00bbc03ff73e53f371f4d3773555ddef90ba0e4b3df01e79b9081feafdafdd731c7efe9342365280b17c5306678dd35b945d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4902eb4ed4f306261fa2c54518c48d9

SHA1
0f30ef4b6539cd05080800216920eff98f7dd991

SHA256
1e4f9f8357571ecc09149aadb3aed176f7140d9e54e1e5570277d91d3eef6154

SHA512
df3595be26e5483fd80937a8fad396df13b10087e6273b92f533f5f0912a2adaedfa41c24c2ecd03916c2239d5209e65897550c1404525b04f1598d49b18b349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b13bf31710f451934a3ddd53f365487

SHA1
a0e9c7f5e415404ddf6d9ac14ca8ab63d2aa83eb

SHA256
31edfcea38748e493874c2f6a788a4e01079f514f754ad0c723e60ebd2bdd0f2

SHA512
719daedb3bdf8c9b86967e3dcc553dee6c6d7766773334e471bbe6cc8e3d61989e63e46a1b4ec17f8a6668d03d9b52927c858f0764132fe7912bf7656d490948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff49a9b1886d6ef1747c6efdc76ec55

SHA1
b4f6c8580905ff0e4f6d598b8bdf17c8170fd60a

SHA256
60bef560e19d356c62d8e1730c4af2ca8c4ebd3dd5a67e2c0137826014a3db71

SHA512
e14f0f4c3be81e37b8c641b854fa3f54e2962c1132ff80dca76179dfa0503957fe20f4b7d152e6aa36e87cc9b7405ec969464c1ee2e52f0e73cdaa86810ebc14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60202bac7450ee2701102ec329e561d

SHA1
c075a771b99866e0cb8a0df6875d95649e87ddfb

SHA256
4f652528dc53ac2c3631bf486c50159f9487cace62d0a068a5e8cf5bba1bec2e

SHA512
853c3ba5327fc512b236deae803acdf53485390510f449f9879b5300c921e1cffaf376f794fda0620bd1a4ada011c9e425af2bfb9faea524f13dd2c0b7a8a2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
190a369bc0b1b534afdfbadb400a2319

SHA1
100cf29a69ef14c8c5e61c72170779fc1701982e

SHA256
7795ab3e62bcfad944f511a8081050364a2549ba4220bb86473edfcd15104dbc

SHA512
25643a3d590ae3240bc08e42c2a9db936d1c3f30917d825b680866efd81a767e8c75ce13a954f10d98f33cb025efe1ee428256dac08c0dd9ddb7554855b09133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095b2b6235a8884995b81fed3dc78563

SHA1
38bc98086067fe471149c077bb934a28782fe226

SHA256
71da245a6491f049992a39e99d33715d455c51029ba9404b703bd54bbecf4488

SHA512
42704f96d0a5ad91ff241c039fd1c69d0062e42e7ef602417d7cba42a702372d900809d57012a672ec7210e432c9bbc1500245fc1338a79db26adf2e87e000f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D33.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E15.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit