06828951d539f6358514d80c3adcc91dfae3b63c73d8e47fb0cf7c1f611d4cc2

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

336a4a6be9c20576d85c6a967e90291a_JaffaCakes118.html
Size

142KB
MD5

336a4a6be9c20576d85c6a967e90291a
SHA1

ca99996133a80551d90e39cd09333cc7cb7e0d81
SHA256

06828951d539f6358514d80c3adcc91dfae3b63c73d8e47fb0cf7c1f611d4cc2
SHA512

18786e90d624f1dd190ed7f48acc2a95a20ca82f723bb48ca8fe2068f6275a03c68d2e8b472a12dfc773851ec65e1cd5ee376c6be40d78576b660045ff9cbc17
SSDEEP

3072:SYAQw4Gx7dyfkMY+BES09JXAnyrZalI+YQ:SYAQGx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421574019"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AC01651-0F67-11EF-9A67-52FD63057C4C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2228	2484	iexplore.exe	28
PID 2484 wrote to memory of 2228	2484	iexplore.exe	28
PID 2484 wrote to memory of 2228	2484	iexplore.exe	28
PID 2484 wrote to memory of 2228	2484	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\336a4a6be9c20576d85c6a967e90291a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0abc4888143918a98d103f9261c148f0

SHA1
e44261db0b1b83904b97409c8587eccb6ddd5ca7

SHA256
30f1c50941316750d7222bcbbfe37f78f433ae1d5aa9ba0bc129d9afe5e2f623

SHA512
9578174b68019b273ac4f69ff1c490adae88f61f1edab169179708aaccd2870643a5cd694d254e829ada4555a0ad8ac3d2e7da92bd845f08c48c3aafcddda189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22942679995cb1ec52e326e7f73a4075

SHA1
521c6bcfd21b27f616d795e765500ec67430e978

SHA256
24be9073c3ae99a00b581c9a587808875b6dfadf1a37940db98acd650665deb4

SHA512
f4887736b7d85e9dac38d5e76ef1a8341bd950e518f0e02e7770ae6189a482f8e1c52b0306413f337d448c3358fb8728c4148cca6e773177d8530bd90b0c9606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4dc96fca038148a1f65960bb9940612

SHA1
983d09205eca043b2d6b15fdea60125a6c943a80

SHA256
d021e3a6eeefc0056a5aeb16e98560b9166735f4df0d4fecb9c3b8505bf35cdc

SHA512
efcaaa220729d5e8f1c681a1ecd7e856b966127ade3ee5601d35708f8e24601b7e0f3db99231188fc52c96d6ae60d230edd3bcbcc309ea3a3bc7f4508e284ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39691cef8864f4d09ca40ddaf1b72928

SHA1
492be5b3e27bdae3bf6c6f0a38a24ce77698625c

SHA256
952ab7b6f93c7a8a3518d289d84ae30994f51c01603c7b40219f17f4ce6b373a

SHA512
9be4e5e26f669b6d4338084a86fe93410d6dc0e1120ca151e6cc6ee033f200b5ad756a07656e0b07ec86b7321de845984074e507beb584eb0461cf7fe7f4126e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8092f548b5e74ea203789de1a1b15dc3

SHA1
939eb8cdeae777f89804d29e2f8896c859c37a24

SHA256
b1359621f5673f9a3489d9c7229f5c880da1c44aaf33121225aa0d7eee1f2b07

SHA512
b666e85a52847a15b93704c3a3d07181eae744a4f081d148adfa68b99edb4387d4a37d8c6be95deb54a81b72974775e0db99501ad201d20689f55c48194d12e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d701a833c9158d860e1758a2b72cf1

SHA1
504b44d94f1198c631d4eb3ba0ce5276c094a9b1

SHA256
b27a0bb2b18eb0339c4f934c00505c6d61ada382ba572e7f7c2777d02da841fd

SHA512
e2f3c4e328f394481046c49d4242fef99c73595f771ad9775b6086a0bebb54c65335c644f9a033d2702d3f423c23c549bea7c8da70cee24b68954023d77e8891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79f6b8ab39ca83bbec3ac79577c6fc7f

SHA1
7f110dd26287add7933393fb4f141d66b241af7a

SHA256
989c8d927c82ff9a48aef4ec96cb0c53ca245e71e8ada4cfed2efd5e40a1597d

SHA512
1d8d666609d3aa09455a26b668d12c81f26d79036ac50d714c35e26be7b2dd1e46b50f33d27f03c57fdabff5f2691c555d86a9e9a7148f8afa756b91ffc9a090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015292c35107e28cc95527cf2363355b

SHA1
c1310de5751039434563b8162df174fbb2a2d4da

SHA256
39a758b131c8d52edf9f0a9f07b4a5c5ed086b3eb1b4a8c3dc36775fc188168c

SHA512
f914b6c44519bf8530629c6cc64830401118b25d1f616e371db9e01a3af3d4c0c6d109cc8f4c25cedf2eaf232f9b0b91bbdb26a46819b2fe8e0e19e09870c33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0987343b8aaab3257348e38e6807892b

SHA1
e31120d689daf67e896a54352e2138f18dfd3b71

SHA256
8573c4e1c8146bbd837a273f37d249dfa65261aa9f92161937c6bbafa4707959

SHA512
e3042c27e227d1a311e90fb5a0f6225f4c0d809043aef71f64f3ec868a6da7cd064d2cab6a2f5c3a4a52c4cd41c62eb2f18a7f24211f0c810e8e0fb54c85552e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37069e2983f7f5a704d8391fc5b87096

SHA1
d05530e6fdaa698e95b66bf26d1e792073a0be94

SHA256
af1c1b531dd75baf3fc523329080c2f5980df5fd32d68de320b67d22887933f3

SHA512
1211e865f6902146380771e0629a48134c91f3641fc412f435d48b67616326d43a84e7d1a0d71b26c036ac0074ceb870508ed05e074ef35ae130c20c7782116f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c8981521db120a9803d3abf3b95edb

SHA1
4bcf92a96d82aa5abc5c7f3779c09b87f528ecc9

SHA256
79392193b288d53659bcc65ae259b6c0d42c3a6c1db35b308ecf94f5714332dc

SHA512
4290559662fb28e75ca41d897fa27d51e9462864fbc067ee3cbb085c528aa3cede51d9aab6f696c948dd80f4408216a2fe7f8821ae5b5f00fc1cad9f3463a354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cc794df0a460714a670219481cc758f

SHA1
9804dab0b15414c582607a2ae56f55f3059b5ecd

SHA256
a83ea505b2c1fba07dccae505aff01e2e09ed1ec293f54f30d45591ba8f2fb29

SHA512
6aa33a95a9fa922c2701560a7bb2399fbea49b5bde7a3d0c46e6b27adf731fd31de61c6601e77ab4a424111e0f0434904294be9c0eb08b56277da82b41bc7940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b01ee22364301eed3917eabe6eddf8c5

SHA1
9a98937d7e9bf94e2c23847acd94d9605301366c

SHA256
8b8222351ea8b3e0b7e9167f66ecf0cbb9e59585a1e9a2bcafb5755d7e8d9e32

SHA512
a1208b4f76a492eaac32ba1ed2eaca43fe579272c2ac50a68c7b3f2d7cc03d0516209e8c9c3d3ef6144215c1b46e669807395696f0af29eca60639739125c3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0530e93cf551b07dd049cae771005491

SHA1
f79e35be6c803f6463617ce1dae7fa42c9af29b3

SHA256
c5dca7ec664abc7c2133d5c5eebbb171bfa84554c1e51ddbcb0fdcacaa94e01b

SHA512
bc5e6befbeacf13c9e3bff73f377841e90809260ad4640262a377936a270310799d1c8462baec3e3623aa4a9bcd3d370b48d5e4a9210c2423b93ef013202baf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2c9b957284b262baf9a92a912bd850

SHA1
0ef70c751f3a764532ca6a5f04844a7b9e15fa6b

SHA256
e8f0989cf848950bc09ac1466cbe18a69cf2a2f6c8ac4398b36d25a63eb45f65

SHA512
1050f945b9f016c55eb7ce4815680745d0b632caf5d41ef4ec3a8303a3dbe45a36a7f0873b8b2d902560c5c4618d60ba29c01cf11b2a8178060c52f5e51fe600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322d940fbdd24d1e6027394fef4bfe6e

SHA1
c59a028ed14833f80d37df36cb032ce28eb3ff16

SHA256
e075c64d675bdf2756ebc5911c2c0ea0fa30a8d20e26d67ddcacbdc3c6afeb9b

SHA512
90b9c36e254170e8ae9e400d3b401b13ec2518cee73279f36a8a0df020e18a280caed3a1423faae8ce1132abe0fd52ff0bc3a1693ebb13c8f8f894d8f7b15cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5516426fbf14d0c3281166140a7dc12

SHA1
93b158f8ede80120212e82b2385b87dd38f3ed7f

SHA256
fd0cf14bed2f09630e228f0bb16055c118c27949b1defadcac766a6bd93bd0ce

SHA512
dbe759f351c30dcc789c2e78f8f175fb4fd26a06a9e3662b475d5297e44158dbaf5bd9869b4d55f5dd809a9cee9dcc33f0ba563909ff83e2d358f2c65c31dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a63022886eafcfa9be99fb36dfcad505

SHA1
7cac48502193ce704034c15db80dfd8a7a66a03e

SHA256
dcc4d2c3e7c78abdc1cb948ac2c7b0c4219f22d74f2bf38143c69d940887dade

SHA512
fd8ee3d7fbe07faafe943003146d7bffcdcf8dad8bfd12d0222d9df56155f4b76c6442588d14b30554e1767b09ebb1914ce333e8123a3af379443bba311e1b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar515.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit