122f82728ba326ac45374498677b643657cbc0c39d50e6e26fd8b0870e279886

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a839143f0f2a8b86a38bc62506193732_JaffaCakes118.html
Size

213KB
MD5

a839143f0f2a8b86a38bc62506193732
SHA1

91926393c8a633b2299c521b35c85f45e3c8dad8
SHA256

122f82728ba326ac45374498677b643657cbc0c39d50e6e26fd8b0870e279886
SHA512

1bd470574f2f5e713923472d9559fcc317aa92ad7c04202c5d4b9317200b6825931da83cb2cecfae00dfd0f0cadb36e149d1dced0e83b5798e22b103ef0a3f3e
SSDEEP

3072:SZi56Q5LXYAC1wyfkMY+BES09JXAnyrZalI+YQ:SZ2BXktsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1EB3D61-2A12-11EF-8F67-D62A3499FE36} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424506424"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2596	2652	iexplore.exe	28
PID 2652 wrote to memory of 2596	2652	iexplore.exe	28
PID 2652 wrote to memory of 2596	2652	iexplore.exe	28
PID 2652 wrote to memory of 2596	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a839143f0f2a8b86a38bc62506193732_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a471619f146d3de68f52810d27e234b7

SHA1
5023256313f4876bfeb135a6ef9a77c27d97b57e

SHA256
1a946bc6dabcb0e56a1f50e7f424f5e28e054d7f5b51f2e99f75d016141d0398

SHA512
61c3bc2fcd7fb12d7f857bcfb2d7ff5698ff88def90e5e2c4f2394a4faf858532a85777de00fb060a03dc5e1c95f2c409cdb3223cee847c623d0e16993e035ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c3529a49a81f556714ed290cb11c87d

SHA1
9a29bc2d5411ec5e39ff0c5e26b7ac6fedfee57e

SHA256
a06dbd548602c67d20f581d29e58ac9c169e03962c2c45021e58497ae6406f40

SHA512
af877e8e5db34e9c5109ad3ed97fcebd9df0501d5b0569896931c8a9193db530b400edfeb843b32818f32a210c697433c7d1354575281fbd18c85a4169ebfae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb3d67f4334e3803f18c04f76bdbacc0

SHA1
5521ad3238d34c02d135c8ecb3929042d3f2ed73

SHA256
83971e7ec89a4d5a4d7e5b55ed3324b63e8c4a96b5fe8bf8e03032c8c674d493

SHA512
d2d970e1370e89af4e5f22875a789a7d29ff93a17bc81a9b3422a60e9f0708ff5140d41cb873b5651c0fe4e8fed075bfbf7ae45f61106171c346be2bc256f688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e64bf3e6a44a68e3da9d23660b1e1610

SHA1
7120404e50269ed4a580c9fa5917dd29e518673a

SHA256
dbf87b77ae39ab68c0e212c0f11533a08de56bb46048f4681fe84ecc8345981b

SHA512
a7be6789d57640325c1ad701241ea3a1a01c392f193a618b401f5f7ba7c51c28c2035720a6f97caca4d2ea3dd4ff437707fe9969e7725e95d470f1a2e881e5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92fcb3c0cfb145d7488d973adaa31cc6

SHA1
0acb6351465a55a91f4b4a3ce7adcc9c7babd528

SHA256
7bc71467ef00fab465a9a2369cdb5951659a9dde9c82275e48daca569a80a1dc

SHA512
3dc5d988a24d4a86acc46961b9b8a1976e571855faeff3c89be5a3f466211fb69649e9d5459c7e7f1a0514c35cf9221d43fdf60abbfc42667309b31cd24bab05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24584ad5c0de7f81d17e2619b4f63af0

SHA1
28c4c28896574d8e50ee8b694b629ac9cb6fa996

SHA256
8b4a29a408480f135d78f27b19aa964b5b694d8061a26d2868edb372e08018cd

SHA512
cafe4c0f876934674d418e1b2b07ffcfb9a0335520352e160d1b5653a611f21cbf4c51e9d7f4c32311fae989feebec65bc0a9b47a022aa03855540a8d2667333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
670ec57cc5c95ef96cc632fb45cc9f44

SHA1
764248ee6e33b48fbd78a8adcc33e68518e3b7a9

SHA256
186dbfbe6b9626a7211f70d16bbaae28f66a599b292cd406acc0ce95d49ff24a

SHA512
734f16df3ce399439bc231715666fd8ea87c5e8d1e73eb4943c16d224ebaaa8ccca9a346b9334b828153c4357d31118a330e58c937c2d362ce3c71312c6296c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5b74ba3041f790ff483c7c1feb91167

SHA1
75496cdb70d88b4e2a1bf764927c50cd717f4e2e

SHA256
865436a203c15149f66056d8588107749902594ce3c18c5c26399ca6e6f916d2

SHA512
06b43018d86576a6b8f4a9546de690576740372b66dc1b779dd0dad8b617b856c0e5df6310af92aadf5bf6d066721656d3d155243df1ce177b363bd1ae8644a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20d7b25c55fd7ee71b3497296db3aac7

SHA1
2446650766d26f98b1ac903b83e33721c1fabdb3

SHA256
372b98059aa800f4812e2d206d372d86ddf03de23434e66e2246af6b601c57c5

SHA512
30cacf3656209b7826f27cf59e9848e13400c3e44e3a7d127b8a6c9815ca6db04d9e6eb9d4372b701457cc7de7a45772c8b3a3f81dda41fa728a68b1a7c12c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00455d6127a0bab1d4f55e602b60c03e

SHA1
a5050a485f7244bcafed4295025d3f7f828c02ca

SHA256
59a758590f1ce62be644c92f44680730df745a3000167876d67efb11eac02c17

SHA512
6b5bfbfaaed6225df6862f3aeb7330cae178b458805c140d5db444fdc2dfe46d8c11d487c53d7c83e1567fc1713562ac55482c53e57970e1f682cdbadf32e50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c47c077a0e525d0792b412174cd8e8b1

SHA1
5bb993692c816777bbadf4b56da41d4f3f6953a2

SHA256
739d57a1989d81ea18c1988e17f28526e9feb3d4d70b35c06d2b1f037eb3ac22

SHA512
c65d5390be5117e9ec481d565d49143f8c8c6c431e7ade0ccfd325dee3f4855d43cab52d78b0e029f2572cb11f4c7aa6e4f44e520a104f68ae746537b7de3471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1ccc2ac29da6c4b53a9f9d586d472ff

SHA1
ba5f04e3e8bc8450882c6474d02a96be15e719f6

SHA256
269d268f19927c057dc95176d30ecb5fce904f414f95f8106ca2eff5fdfa9fdf

SHA512
3f66d10801985a81598f5eb5bb66a24919bbe3489fa83db5f0b57a9c984742422424e258f8caa3be52f7b7147ee79795268acb59c6bd831110cc3e862f52e653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e6417709289866cf04d638796295367

SHA1
a45a54b25b8dc2f2f8eb0d2e4d95f66044a70d12

SHA256
eed7af947396a268ea46e1ab7981deb84ddb35df30723b75639f7f0a0ebb4f2b

SHA512
bae64b92cc2375154b6786386522f190e136734cf6f7906cf2f8629ff1397c3ee8a157c4da3d348aa7a35b91f3d662b1be0443e89dba105868bcf5dd8810f495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddd45a90538eaf0ca6eef5b18457e528

SHA1
cb5557d1fc1f5b4a03c954b588a193e9dfac8ab7

SHA256
16a5a4f176ee24ebdfd41928c48725811f2a9b88019bd6878d8c110b6a52ed14

SHA512
d69fdcb56bdc7673ef148e2c5bdeece20e7e54d5ff36bf7b010951a46f61e0c0378bb67d8aeaa88196ee78e7a969606c28333835c6c8d00abeaaa322fcf2d962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d69a3c2f9997776e9e9780711c1850

SHA1
74b4c35a493f055ac0471ae2342b3f5e420fab75

SHA256
181da3a29761433a0ab914ff7c6b6f82ae22af3ce8f9baf8d86423c19f7d9a04

SHA512
69276ace755cf293fdc633f8165271b5ee9b23acf3e43cc3b5fc233c96a6071842eeaac36c033965a23645f69936ac779182fb4b670b5641183863a27b9fae2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4a98a4ab1faa2d0cc300ad2982e15ad

SHA1
33b4ce6177f75426db227d8ef21c9eafc9d9834e

SHA256
aae77bf2da9ca63a1ee3e190aaa2cebea16374bc33b9130f394031028d3dee0a

SHA512
7e3075b735c7081f30a261a84f3a27a818d6240f013a8121ba327390f69313ddee1f536895d858e733fb451663e435bf5b5c27caef1aeb1c055c663b2e0dfefb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cea8552cef5ed7155c3a8589f4cf3e1

SHA1
8cc19867ac3a8d96fae2cccee96b6d99f5781fa7

SHA256
750848a29d595caccd7301bd8afac58e12a3f2051481b8eb90aa5f3c77dcc4b7

SHA512
994f4d5ad596cecbca3cc6dceca9f3a75e693050edf70270b213a70f60710bdf5841401c57c87448e0ee4e870ebfcc5ba7e8dd6755b5384773b2b16152df6b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28A6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2947.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit