539ad81ea3dac19027e5e19cbcae0f7b3dea02f08a955eca7a13688ed0b5d1e8

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36fe2f46fa6c69a4459c20191e89a564_JaffaCakes118.html
Size

19KB
MD5

36fe2f46fa6c69a4459c20191e89a564
SHA1

b9d043acbcc6f0e29c659dc646f7f5d03a720cdd
SHA256

539ad81ea3dac19027e5e19cbcae0f7b3dea02f08a955eca7a13688ed0b5d1e8
SHA512

d1e5533667377278c5ea2a658ee583e2f6637a288f727dbc8e12e7f92c944d29576ba0a8d993352a35d53b272349efe4cf24616a2d1aea43ba192c016f04600e
SSDEEP

192:owHPi1YSSAXa9q/kBwnAlgq/Z1OEKLW4DoyPPK0F4fcKWf2bd:owq1YSSA8XwnAlnYoyPPK0F4kff2B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9403511-0FE9-11EF-B97B-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421630172"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2416	2208	iexplore.exe	28
PID 2208 wrote to memory of 2416	2208	iexplore.exe	28
PID 2208 wrote to memory of 2416	2208	iexplore.exe	28
PID 2208 wrote to memory of 2416	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36fe2f46fa6c69a4459c20191e89a564_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9048882da6839823fd5107f9488b1e1

SHA1
763c631d59e1b8f672c0bada48664c2b51f3ef3c

SHA256
76d263132462adf2f7b4ef34f9ae6c41548b72a4353782e5ccd835adde60a900

SHA512
fe703c370d3d2b965b3fa77111fed6d591abc680074990a23f4ba24875fc2c17531a793492c21ad938832ef75917a92fc29ee316364fa522883046f7b7a1dc69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd669a2ac635ee4f4168e5d28e02190

SHA1
a20652d7e524060e7c32c8eb4bb729267e7cf6ca

SHA256
fbf573a2e154a3b844def22a3bfd52e34b176a9fd4aa1066f73aced1d50871ec

SHA512
35b938e8e710714e2baa7fe797c6648069f601f474f1caa25eb127ffba0de11e0ed5d99ccc4b384e0f929a3632758737359e190e3e1c2bf551b2e31e959b4df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c370842fefa492d7e9172ecbc938f6

SHA1
0cf460f7f0d788f37867e67e5ff856fdf8ff547f

SHA256
23d9d32f69385c69e7c12761cfd30f3737901232df0ce560ea3cf938ed36179d

SHA512
1389eda7703f41cad29147216ffafa15c191c3e88f797055e73c8f7febd70a9ef077c577e9430800824d364d8b6c05e219cc16d9c6c5e3e3fccdc0537a1252fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25112727d7ba5d52a844b1413f7d800e

SHA1
21c4aec6481c6b4be68126c37c9af173470010e4

SHA256
b77fb842eadbf37a727154694ad67e7c825ac8e2f378990be1479d9ce9dc0559

SHA512
994979ceda012cbccaddb84813c2b3d5c66c80877a24e6c5771b1be61c24ac2954c7a5d2519502c08b19bb2bea8c5f86c2a3122c14f3b0664be83142da1ec304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f7ff0357cb790dfb98b5472ecbb45d1

SHA1
fec0c87e5474139fb2fb054657b778741973c9dc

SHA256
cfbbe474b8886cc8820aff540aed2a07732a02e26ebba309050bb3edf722cc1c

SHA512
d315b6be58b59c27ee277b60681d260a52c05c078f04902b9202c7fdfecd72cf409520678e118cf3a4243920dc099c92a39514c4c862162f6a2abc2a6ac68335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0f6f0628721ecd86c3d7f366b7bf43

SHA1
429650dbb455637fdf528c94d5adec5aa2de7449

SHA256
d19b6cfbf9481a3d10a4742e10aefcf20746c6ce82ecf2c6f30dfb1d4c39f20c

SHA512
346880f6cbc909699a6e90f5df2bbc5e62fd5e0a85c49d7fad357079d79da9cf5b9094697631960ade554dc6634a5361e8321af0909b4413305e1ceac52c9b43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a11f66fc2560b68f64c5ce23d130451

SHA1
51c3db89bba5674c6c1a46cafd0c18a45b7f5fdd

SHA256
958a7360736415b0e7f4525b7c9d96f067f40177fb59f205161b6c8d368ab719

SHA512
431e309641fb555ac168bfc551647eeab37e32429e867671f3d16c8b17c6496cae7e9bfd593d0daabbbcc7389ed128693a4095286b2db37d435a34c86eec7876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef44f702095e1191e330baa378bab86

SHA1
e38ece1e6f1dab80b5b6abc3e9755346592824c0

SHA256
7e63a9e068f96191ec76356b7e6da5bdfbe03d4c0bc2b19cc750c3421c4806e4

SHA512
76ab940db673a182d19c463d92ebf23810031179b6e0b40dfbe4dadd3097a9aab111c51aacf730227b71c431277ee7516ee75ff0c61db65311dd71020334e65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a8f59bdd6d3b88fe70080630abac0a

SHA1
fda1b8a4a0ae938e27eb131609c3f54157db2082

SHA256
992c38b564a48f7810b7bd79499aa19cd50044a5888042dd61bf5d5e50a45d58

SHA512
9cccf8a77732b80d63c7d65bb9a52f3761139c40fc48a1d461d67654a39c8508ddc9da9b66ecd44507a123f0db850c535786e2496f26900fbe3ba4fe9c7bafe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74b447108035895c8e21aab1d0b9611

SHA1
f06e384f32bd8ff8f0122961ac5ad8420d789c33

SHA256
bdb23970f5c703d0c45a456ede26e37c6c74f1ab6ab19af8063f1ca607adc3d2

SHA512
26815748c2e737144d0a4c3decc8bcae38bc4f6307cb4ae19b2e33ba75500660767e7830c88d3c28a95b12ec8c80ae47d1b4db25e0b3cae363f3a09b181eb14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
110f1ea2c23491c382db00dca121de9e

SHA1
34d540c15c2473c5dd741a40988eeee428950d12

SHA256
939dbf64ce8c462622296b5840cbd27ab88df567b7731d1662e68175a501641b

SHA512
11d0ca3da780062a57b9fd5985c11c0e47295e3c0cca267a3f4c8556f85f096bb7a58645d78204025eabe4ee9bb12d4a7c0b465c69f2757ee5af1ad38091c481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B16.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B29.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit