479e058adc902186d7f4024c14a80e4accbe38fc3ea3ccdf445b4b26d9f602b0

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d36a1477f7c8bf60b104266ab14944e_JaffaCakes118.html
Size

26KB
MD5

9d36a1477f7c8bf60b104266ab14944e
SHA1

dc1115195462d8eaecff217c34d06e28e138a4e8
SHA256

479e058adc902186d7f4024c14a80e4accbe38fc3ea3ccdf445b4b26d9f602b0
SHA512

e655972285989ebc930817433c9696fca6d3537d0ea9a1c450c991449e893c9acf3b786c64b762b469121faaf2fc6b111f01ad82c413bd74b6a8f1109c8a6633
SSDEEP

192:uqAHKFf2lc7Uka8Zb5nnq1Ph5Em6QQdGSTnQjxn5Q/rnQieB8NneWjnQOkEnt1Qm:neQ/qygcOIoXg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424247769"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{895305C1-27B8-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3024	2896	iexplore.exe	28
PID 2896 wrote to memory of 3024	2896	iexplore.exe	28
PID 2896 wrote to memory of 3024	2896	iexplore.exe	28
PID 2896 wrote to memory of 3024	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9d36a1477f7c8bf60b104266ab14944e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34898dc43d47422990b26dc00a6317a9

SHA1
f474ef3304781fb8973ecd4136b68fc2bc3b5988

SHA256
a2acf7b666a87ad7e321e61b6623c0e34a50b77f428411cb1f0bfb4ccdd3b50c

SHA512
90ef93d7e0805852f09e46f97e2377b2c091494e63b2f8a396e86bdb99453953063cd133c9e307facc0d61bf58330545bbeb840f8da1e8fad8b684d1f22af07f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf5799a471b073dd85b59b7293a0536

SHA1
00ac36b9e92aacbf7e01693f54c17ed66e5a33a4

SHA256
41c8053c673b76e08e2a4a1300f03c201ae43319ebb7da509c07504325d03ab3

SHA512
244634ba25236f8d0134882bc727b87b5916c7cd0ef020f1265fe963b21d9421a2de3feb15f3735f43e459c556e325d765a9287e90f0ec649f229a82b57b5723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3a1b6393a243f9082c54d18e7e59f9

SHA1
4db02aa37b83bed3b7d92776b61ad35bedaa0298

SHA256
c137e221ef2a0327fac2da660f5c42f84cbd18fef181b1934b21190cc97ef1eb

SHA512
4d70c7717cbc8665b8b80449465fe4a0bf8afe33bcc68319b9ed51b22f033cdebd23a70d3ce5924bb00558800aac12cb8c8e0015d00749460c2fc97b32e170ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0f41576f732d0f6f30821b3f9c0739

SHA1
4a2ebd8c1e79ca586e2cafc3d5987755ff9b2f78

SHA256
88ab76abd2e32890b3a5eb4f0ee629197767b415b2387e2247cbaaa6e7f875ef

SHA512
16b090c548d3a106f964ca31a01544ed363a945c37f58ae4a8353bbbaa54e323dfb1eb38783fecc6fb174e8673a54d68f888aa93fa24c2ad8024c9a2dd6da4b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f78cd51a2281ec8d4853f66b0b8d115

SHA1
1cd960862faf2a7b3fd320dbd41d27ef3cd381f1

SHA256
1f3c6505742487b0a97eb7f977af29d99f7897bca42ec014ba9f126560f89e61

SHA512
12f605b758467ef22b0c2055df131adef23c89c17fc3f28833fdfebd074a4c52f7bb63ad65664bee88b16261fb5d4c0a3c51b9001226422c178dc48878df010a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fafd7ed355c4c8edfc009effe8a8bce4

SHA1
48e16a6994baefbf2306ced6ffeffd8711786dce

SHA256
5d4b5ddf6c4ec025c04a760ec35ae42e5b0e6ae73bb2a54096ec84c6c8e5f423

SHA512
fc63d3dee4a79167a080e25cd5ecc4b1416f3e31c06c5822180cc45e0e4d6a9ef0f85450460e105e7b880a8a4b1eee62aa1e2d3a65f4b416bbfe2bf34782ec97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6fe671c2bc116b31b073ee38271bdf6

SHA1
2bb529fc96d4706c0193258518563d31d3f475a0

SHA256
69b16e2f7c8209f4255e1df66367e67449e4c1a84e2c505654625840b430bc33

SHA512
7201335a70b83f30a1a19b34f6b462cf05b6ab0f9c111e0e241d4ad476dc2eaf4345fd1aa9438f0dae153ca4bf6c15e6636eb77ee03451204409b42921d9c1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a1bc5e7899066ce44d46aef00fdbf89

SHA1
b38f3fb653370a7788e5f149b6cc51a367a52475

SHA256
895808a49776f28c26ab9d763a34e7e1d69d66b6b109ceba7db2d61e242f7b5a

SHA512
9d7e16a9012e38d6bbbdd5fc26cb599e2577edfb15f6faeaa179331b8bfa65f2dc28634afc6f0ba1907463c79798b4e286370a103abd743aa466960fbdcadcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd6ef4c6eb53a67a960e59014e9bb95d

SHA1
f3c3bb4a8ed91271bd974e69ae027f39eb4f8e4f

SHA256
feb597088eb0d4468f05d2eb97cdc821a4bd6fca440b27ae24683a7cdf7dcd5b

SHA512
6d90436217177a4ffd84b23eff8d3b58b6f77756dbccfcb6803f956338f0b9e57c0597159d81c43672095251f6281766854f91856de87890889b46023eda0f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16e65cd7940526cc7402da3fd11b1cdb

SHA1
4011f21530f886c367c19fcc29965f9e9cc5f601

SHA256
9988195bf7387aedf70387d3b62491b2b26713ec2a9ab6640c0d67192d53337d

SHA512
59133381f0a32751e07c67448b0a3ed6bd337b9be64d63c708b2b3d5528d307d46bc171de2f026c29102c3b98cfbe598f9c2f8df8a1eb6d94f9270b73c39746d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7deab307ddecc44e45b2b91d69735015

SHA1
8f02bf4b795427fc9c851f8952840c89224c5933

SHA256
a48dc4c7d9ce47a97fdc6638bd87dc147fbc5d4b7513b98ee0a0a2dba76976c7

SHA512
44641fb1468750767c1457afc6ab83a4ccf72493f827bf313e8835255c9d6246dbb88b4bae92c1f5fc6f9b6a1b3de447483b19cb4c0596ab67c3452c5f91cc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E6A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F5B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit