c1207c45e5f9b06b32b768fb3569234724ec2bb9ae5a10827364700db7bc4f38

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8036fde6b412946cd946d96a586fe75c_JaffaCakes118.html
Size

23KB
MD5

8036fde6b412946cd946d96a586fe75c
SHA1

16de7420428bbe35eb99c9cec5b017c1e3554bac
SHA256

c1207c45e5f9b06b32b768fb3569234724ec2bb9ae5a10827364700db7bc4f38
SHA512

aa5c779047df56f62e8a86250a370c6d04aaa536232d5e69fa8eef5a6d8c4fb6d1b41e4a035755fea3f1dd745978d9feae8f70c6b183693a13c23d4c912b65c8
SSDEEP

192:uWvkb5njenQjxn5Q/6nQieRNnbnQOkEntG8nQTbnpnQPCnQtNwMBxqnYnQ7tnsY5:qQ/5D2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D282E31-1D9B-11EF-928E-6A2211F10352} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423135699"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2288	2068	iexplore.exe	28
PID 2068 wrote to memory of 2288	2068	iexplore.exe	28
PID 2068 wrote to memory of 2288	2068	iexplore.exe	28
PID 2068 wrote to memory of 2288	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8036fde6b412946cd946d96a586fe75c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5d47da6b9928b54d022151e08ae72a5

SHA1
47e8c889f60d726610994e72ae07e3a3dfdc9047

SHA256
87c935b576d7aad7d40b48303c46a3df30f07a31dd7800ac59492e6fd27a786c

SHA512
a449c78b4c6d4a9fff35a4d46067f240743cfddba4d08573e5a59b14e88cae1db6266076b5e01684745eb43d7cd3f8747fe521319bd86d4a9d2aae6daa262277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c0d3c5ed5f48eb5cfc77193d0f3aff

SHA1
781cb938bb671e8fbb6bd53669683a422e3a5a46

SHA256
f2b9d3ee35a8733e144a8a374d8262d49be013157e10ac9f3145abd63ed49521

SHA512
66ba219d8e5e047a1ec7055b05707acc760d8f4913b6af2eecd67d6e2fbc1ad90dc128bd9548c63953375ae13cd092b28267884980b84d391be63b217c627172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641c4debbe9265c4dd4f37ccfe17c4ae

SHA1
f0730f74312c845e785bb2f1c3107ca834a25433

SHA256
30bffe5b5566e6f35a9bcedaa286456f06a72025fc9c2b08d16089dbc08ac81b

SHA512
a86e97d7d2708a05277c25b0694b632fc3a2881ea42f4ab03dda3c1cbf11cdd40066c721285dedab34256d5d6c1cf4c52bf278f1c7a605ff26e9b4faaed5edf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dd90cbd3b413e0248598a0358119eec

SHA1
cf28f8b026fc8a081a1f7bd9c7f53d414606932d

SHA256
efa147cbcf9bb70507ca32043a67f5eabbe83eae80d008de867bf3f167fb92b0

SHA512
8979e7d3856923a939d20cd0bd40ab10d02e49a6060b4ce97361b6528136663ebcad4472c9daa385c8924bf32f3694287593d0bed319432105cf2147958d7049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d21430602ea16015c26d53c9cd28e0c

SHA1
61cd656d3e84434ad6c2aed903e4aff21a4683a6

SHA256
78cf5d02e4b8359525662c9422ceb0e2d8f83cb77f33ae2506a86b072fe2713f

SHA512
0cbae84067aefbed543fd9d339c087906216449d4e02f71f7e3ac1d38ff4fbde4405a85504577bb11a8f4397b3b62cfbe49b583ba33287d52066e7852d92cb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6589558002cff85ec943119d1d03702c

SHA1
d805157ca6444b6ef5d1bbe835ed14c35462c0b2

SHA256
7a65c384e580ff33ff8f8f0bd3eadcad9dd4d641063209d4faa293c22bc89963

SHA512
c01ddfa652b45f7adc8b8f9177856d4209215aef78e0a16d595c9488c2e72c6bccdd1c8a6410a4e603fda085c4949178cde754e3f2a8dc41ab3d7a15c0cf0685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59d7797b28db775c51036cd92704f0f1

SHA1
3fafb9efe209d5b687e6bd1610f1601b041aee53

SHA256
746cc91f3e7f699e686996109998ca8ac224f45f76f6342222006930a74239d7

SHA512
904b29cbd484bba4f4956bc94064d8d80a1c2f9925e67d0db724f169ad7b8d47326e239be66f7c9b7d811fe58a7f9b20a6922f643e37bf0b6305f64bc3f23c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb982b9bba5b18a6259c1955afe56dc1

SHA1
aaebf3b12028e3e9e2c0f7f5ff0ebed3a23282a8

SHA256
fdde62f5cc274d23d7d9c057bd8dee5c9162c94ebda723c2df89638a7b5823f5

SHA512
bc127bc124bc6f69f677030314cce4bc28a093b97e8ce987817898b82f03330e6cb6357ebf044e5676fa8b1e7a02334b6fe8f3380509c256dd6bde98e3b924f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d41f3d081c976c3b93d6ca0a522258

SHA1
6339fe10d54995ad99bc812e7df64a977268e5e1

SHA256
60796c3241502e1375fb21f40cd844fe1ed70b773f88939b8cb6d078cdbd6e1c

SHA512
d083ef11b40e577655a425200340b66beff22c2bde683ab35f6d8aabe4b1ba7b9728a95dee1f55efafa796ac31b2efa747b441dd740fab76333d7ae5fc70e427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D24.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit