36948e6399037684f6a899bd6bf82773c3e4dc0d642ac3aa609ba525389baa9c

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf64dbd943d073f05709a162ac31186_JaffaCakes118.html
Size

19KB
MD5

9cf64dbd943d073f05709a162ac31186
SHA1

35e41cf9bdc2387c41bcd52ffaaa9e955e0c41a0
SHA256

36948e6399037684f6a899bd6bf82773c3e4dc0d642ac3aa609ba525389baa9c
SHA512

0ba0c94dec5e7f027493a9d9cf7ca56dabb678d27313e9a53c65c1ffd811cf04f8a0077d9e86b366a2f43a2251a738ed5e5cdd7c34e4eb05d12152a7777bafe3
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIA4KzUnjBh+w82qDB8:SIMd0I5nvHHsv+zxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424241463"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9F45F11-27A9-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28
PID 1708 wrote to memory of 2564	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9cf64dbd943d073f05709a162ac31186_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c3ac363cf39e9252cc93b2a7c5c209b

SHA1
8c684b101be4c723d96a2ecc301f6fd2dec110da

SHA256
606fb7e0665c631ae7393380b58cd76c91cfcc615de17f536e4f2d0100bd425b

SHA512
d45987c118d081dd04d7050e4d8bc85c7efd22986718516683568d7c9bcb651e60c655b2b2bf9b87822bf03209ca376e646b832ac004e0ececf38ea3faf81d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
955eb1f2082158487fb781749b528da3

SHA1
18fc58107b630855101786678b7f45d52081afe4

SHA256
83b8d93a565a40305984dd5fe5c5645398a488243751b5144368b6832d64a90e

SHA512
309f0998af0ffabd40672be53c53cf50c0dfffef66d36a35543276830805e38b0012b031c71d21dd23d770aed0dcabdb2c622c63dadfadc9c6ea04c8e69e66d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e71649699fe7fa6f61e75a7e0021d1b

SHA1
cdcd455984cf264dfda468a19e2de05b776a2e4d

SHA256
1a14998443ef1bb67d3ade8d1646c5f76b28ac463d6a00d1f51a583fed44084b

SHA512
ddd1069a11e3da9ff1741fa74763e2c26408c19c9a2cfa6b98d5b01020eaf1a7509c2dffa5c3ce226d1d3f43771bdb115b827d0ae31ed6576479516d4709fcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c87a5ee7e605a7959945035dc2d72d9a

SHA1
26fa534b6129af1036a054e9ca626961058cec47

SHA256
7c9ea40b35755324125fa08425ea3beff9c89aafa16806f0b7561999df34d7dc

SHA512
3da62c6381c923ac334f3424a52fe95bdcb10ca4cb934d43119d1f79cecbe82ca8edd5b258ea64f55cdbf4c3c975cc891dd0e31464e558c54e424fcb6b192432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d52e0d0faa9c4a9104f3ba7b7fcfaf0a

SHA1
674244fe6ef94e642674bab69916fc0887af13a2

SHA256
659ce8dd70c39d003b86eda60117354d694c3c66edf59ef3074e2b1dafc00730

SHA512
8d16a673246f36f206a927fe65856d1adcc4242663a04bf17f637f7bf797bef84baddd341e9778e37edb29750fcbca5e461c7a9293234670499debe3a35e2119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44c54c518474d3752bd0a47695776472

SHA1
d14879548808fa0b2e03d40e40aa3686e7b92a77

SHA256
82aa72ab2e91fbc8d8f44a85e38c012a5db03115d86b8299c5902aa7d842d088

SHA512
4ec2a261a3ba0dbb0fc2c924615d569c7aa5b5a3365fdad32abb5903b684c87e0ee94deaf461f7cb64458fe07e29e18ed10e57540265d77d43d1a2c3d0323d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff8df73f04fb3af6aa1bc291775914da

SHA1
fb9f1f718fb31bea674ed1481a625111c27170e5

SHA256
dd728ecbdb2e36fac82499d2a13a60730b791d8a4ddb61d2d84c43dcbb982564

SHA512
8e835bab842ecb3c07bfc6947e1345a59224fcf7172e1ed87c9ed34fed55d1b3d4e68e63af399a1409ce148658962de3fd103ea655f38d6175967b9e0bdb84b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd9414e91f4254f432b15b6362e9c3ce

SHA1
b0e6aad684f4a680ab0b3ed17fd0d0a08056a614

SHA256
644a7ee3418f0e71d3c249f326ecb92d2df923c2e05eefe70a2a67187e3bab6d

SHA512
c1d5f25ae12c74bd37c313507ba20112da261cd6fe08d26c9580c42a33a684b510850756cc0f571a9b0ccbede60380bfa1eb61e9a92f7831d0d874197eaf0196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a256c8f7e2b1b23b3398317dbd6b65c4

SHA1
a8319eb64fbf13e4dde4a338809d357fed60215f

SHA256
8ebc9a5785280c107bdbdc081d1a47a7c1de684c4191dffce434519c855a09ab

SHA512
bc2c84d7126a0c2bf8d736f54420fd78654b1527579265ab91eb123c6f4bcb3a3e8ba026a862903750d3f667148668a51c559c12490f95521acc33858eba2fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9280.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit