118899c3ced0604c1ad9afca4c2102f99d40691b330c304345c94281119a37b0

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

246857af3c2c94e2c0afe943f4c52c7a_JaffaCakes118.html
Size

3KB
MD5

246857af3c2c94e2c0afe943f4c52c7a
SHA1

e47828a9b2e191d79156afd0c581eb220b92a1f0
SHA256

118899c3ced0604c1ad9afca4c2102f99d40691b330c304345c94281119a37b0
SHA512

7cd6b26e6643b586deeeeb15193c8f6009bb089d7ba824d93716704b3d0b704535019e2a45e20d5846cd981667ac402db90bea2df2f8cc42fc65dbd00aa0f7bb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC8282B1-39B1-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426224022"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28
PID 2220 wrote to memory of 2376	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\246857af3c2c94e2c0afe943f4c52c7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
afeff2c45211c2052e2686fe6f607d5f

SHA1
b9dd7d106aa4822942d93823c218cfc09b162f82

SHA256
bc9aec1841408d04b6b32931b8688104324a7bcdb3857fd6e8bffdd4494db34f

SHA512
3bade761d81afe72bb5f77e1cad9376fa56c03f12f4c415f12ab56ba32233db9ac59485ddb17793396694a772b7dc0531df497f23f2bb1de24d65c03189257d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4f03a18085d0eae4d514c63d4ec3b1b

SHA1
a82eb4d4840ac2e8077f1832ea3b5a698c32f78a

SHA256
374f7c6bfd50f717110e5344a82a84c0af4c2479701cbc9098295d4ebcd9e916

SHA512
d609e76f1968cf559848087de22dbaf4053967ab64b0a66d582ed45420381797851f21a2dc3cd468db892107162b386e32d959239e3ae1f9c6628b35c0112217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01bcb2381c7e47788b1635c86c4c5867

SHA1
c32e4e978f4ecc25859f4885a11b427f5416dfe5

SHA256
3204b991105a381b551d55798daed760fa3addbaa00f69bdfa89f57260046fab

SHA512
2f98726bf7b61122ed80fa0a84c9dd0507f4b49f8ca7a1c64bf3a09a2b00de63585c2305c3d579d41915b45d34c09697d222ac552d1e7e7fa2f8144c75a94459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4954a50413bdd162212ecc00c85d72fd

SHA1
4d0e607898632f898f7fdceca63dc6139331f195

SHA256
3af659541d3377961f58e12c23313372d18965f6a8c0b19f61336ba481471c51

SHA512
0c20ebc658760ff114da59805419902d4de77c3dbe60ed234e58286a47099a039d1b6101044f38eb86f1cec3055fc1bc87437abe8964b560523a7a63aa88d7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a00d21f4ea87f999e4d6215feeb7c5b7

SHA1
ac3d49943e14574d34ababf055e8ac3b130690a5

SHA256
cfe1ba5ad604d188b0f9efbcd7f84dd0cc9f5c202c8bd497d1a4e1edc23a775a

SHA512
6c20ddb2174aa1cf7c7f7c36ee81a4a90d3cc47d6764e35576b1a0e723936f9705ef9b0e94317378ade9c8b82554716e72c1c96df39298d7d2a08b5bd38d24e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0b28e4aea1dfc0f1661febe45a2efba

SHA1
42c83fd17bb714dbdf93f4f107e777f89a279f40

SHA256
8225f111b560b4c851c7d8ffaadf69c93183828c18748c6d06caca28aa7c5a52

SHA512
d24147285b56bf6205f62e0eb6d023c9ce310589dcd3e7eb7ee53d165957d6ef7929b18e7569137ac2d728ffcba807a8ea628d0d909651ccf791cfef83e11029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0fd9e0b24296a3115b86270fd211940

SHA1
3f629b9dfbbe5b6e55369603d68559761f121ffc

SHA256
256fc3df4f4ef46dded154e4f9041a72c532f447c97fdd6e7c99ee3fe4b4face

SHA512
fbcdf2f491144995b92c3770c2290e16efd7344426fe64d7e8c20d23fdba03e72626489bc430c5a7101c7c436d7fb7b5cca7ce20cbb8bbc93124fc7e3b799540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa6f96b04e539df9e6718209119234a

SHA1
81a89d3957590df1b4bf1dc3f12cd39befad5ee1

SHA256
f15cd4bd59337f740d4568d4138778811188d3d52b4cee308a351962075928cc

SHA512
c2fc5700e12bac0dbbfa89fcb2d11bfe46623de2c194d44ff4de64f19d6230f27b74f77d92330003c99b312a057e7a7b77bb327ef6ae229eff94fc3587b64683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a909b1d991009cfdd399bc6fc618a9c1

SHA1
6266670e6e3f57d1be5b6b41711fcbc88643b124

SHA256
d02dcd0507d060caa1f38a7f06fcaac1a4ccb7c2e36462939f9e87b5d79a1181

SHA512
0ff44f4f6f93309094ddc06911f60be2c69afd4628bafa83e67ef4466da722335d66bcd514b9b5a16f8079f3ad1fa2a53c115d7d855c570d1727865925014a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f202b5bcddd7ca66ff9b62c89e5e1aa7

SHA1
cbe5a0ee0d01fee1d7c6548111428a6f533caba7

SHA256
74e5cbc0baf14f6691bfb0512c1b1dd26b6f34751979dd4ae7504babf6c21ffc

SHA512
e2ee5d1a41047101c85973a1ce2da11b5f9f014dbadf98a85f9b38f1ee7939f5f19bd2ac9b58e65469e049048405005449d94650f69ce6d40286dc69b11283d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
424bd93ce390131fa8982560ae99c6a9

SHA1
1137ebf01b41e7889b6be2a7043623f5256a0fe4

SHA256
3d058acdd36a007c7d4c33cdd8222207e1269159d419191e776eb7cb90b996c2

SHA512
19f227626061a6a9ad36457a3616e450cd1ee811c75e5cc073b560790fac53c8c03350aa0eda425e16f7dce33deb073c45f00e4eff9fa151bdf6f345374ed226

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit