12119079a70f123931dcf3b5a142aa61ac0adc1070e2479235e04cd3a5695102

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46a9e7e21791db6c9870ed5a6b3da4b6_JaffaCakes118.html
Size

73KB
MD5

46a9e7e21791db6c9870ed5a6b3da4b6
SHA1

899fdfc566212a8fd4b0a407dea73f9ca7d0ee32
SHA256

12119079a70f123931dcf3b5a142aa61ac0adc1070e2479235e04cd3a5695102
SHA512

35775880dda916f9b3b3237b2f284bae7d77328b6a1c2faca18168c66b563b3162deebb639ef8cd9d65713906c212a3cfb21843f9da0f830274ac28ee2f88a64
SSDEEP

1536:UH/Q812zguZhgDjXizjbQwjbd/DD+xQ0HAMoh+bKwp:GQFJZa3UIgZfwp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000328375f8ba4c125b6e803a5054eeea83e5f32886e509f0086975e4440f9c0c62000000000e8000000002000020000000c14f73768f71f381cafd4f57028509523cab9d34fb16e19d8db56d7a4c6741ca900000003f2cb1a6d51f73f471ce190cdb7dd012b943cb0a0bd1834cece77596afa4ef9baa3c8301fcf1e20e7b6d501ddd932f887614d72b4602aaaa27c8c21f86d58ff4014e92e0a362782d63da71b31040ed2da538845933047307fed24c66a65409049267e17e8a258a591286344f04e27d1ef1bdc88606d722e4517322005bbcba5f95a76c0aa8b85684330ec8aa65555c7b40000000046deb94f78525e19ae17818a56c078755190450ddb432bfe5c628c119847c9181af00d5e2887a69b6651d0d694334449340322a3e904f5a4cecb82877ba50bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000009894420e816d651cc5c608317727c87fa4c6c67f30ca56e07895829a60760aa3000000000e8000000002000020000000780874e3c0cc6e8f5d661128cedf4509eec8cb0a39d2a10a841349a7e5b3adc72000000075886db17f2fcbada246ba3a5f8cd02a6b7de22918abd03ad213ed146d5f9eeb4000000052f21ba020a8990b2f5723d752fe94d17731bf2c4ba6d81c6cc41be36086c8edd6b0659c8d8189648603021faec58147c97f797e5b6519c6fbb433a297d74779	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427137320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bff71f0dd6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B5036A1-4200-11EF-8F5F-66F7CEAD1BEF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30
PID 2148 wrote to memory of 3000	2148	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46a9e7e21791db6c9870ed5a6b3da4b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
090182bc67d52d5ab5c1726eedb0b752

SHA1
e843e605d309371e91e9efef25fb835dbefa25e5

SHA256
6efce2304da159139d0a13e9920dca3cde6893db7132afb4a76676a6ebe5c8d9

SHA512
26c5314c2281cc116b8f6a0d187ae845aa78304ba58e73a4d362dafe89fcf04db822fbb5d8e862b01d863b56791caa888fbffe57333ce297cf219bbf727e9db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dd7cb23e79f0c514a5409d8023810e1

SHA1
189c7cbb81e4ae8b9e0e7b2344cb986bc5401862

SHA256
7c17d38ba627df8f282a351638db5ce5319c4738096500d006f10783ffcef64b

SHA512
33607a4fa307e09acf7eb75078c159ac14641868765ef782c08c766e4248c8581462219a3843fb80517d4d69d62bef64fcc55c892da02f33e7030c8a03eab5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b00a1282be60b3a9237a0cca70938e10

SHA1
131947c2ee2fad8499c5d63298109c3b51252a80

SHA256
6e8c7365431f224d9e01c367c902e09995fc48a4650cc62759caef1935e22192

SHA512
5075bdd78531bd4e838759f6a98dccbead38d97afcfa74b2f8f87b1c33fce7b3b059819a3d6ef820a9b8c92bbdcd03a40ac377a34e8816874fd66176f55da91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee347b463f14f19004ce0de9e9466356

SHA1
f413e88d96319c338ff800f0942794d2fe770422

SHA256
5044cdfd39b640dc368108888077b0442501449ba478c4aca58007ee787e62e6

SHA512
ec17b59299cc5455cdff28c41404c12e1ca93a1731d046bebc0b8448a25c1608195c40a3dceaad477b30113e76680e284ca1af5e116ed0faf9ac0054d1fc6d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
978a2f1253218d378a40f7d00ff370e0

SHA1
d070ca7b38a4830fb9842d77da436fefb924bcf6

SHA256
2fb54ea14108c407435fdfa8ff0e7d246a1dacfbe963b041c5b9a80ab61e4fad

SHA512
1b380a52936cebea23daae114ff8fa6c02a077efd8808af77b8e07e1b2e2927ce233aaba86c822f32d63476da1d609fc947252de0884831575a2ffaaaf9a56b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9116e14345c3d48e541a718afec1e2d7

SHA1
59dfb80e94cbad135495276ee5c224002a4b0baf

SHA256
77191ea5d5de363b9ca21f3e156f725b2a5d9b448a133ef022acb55a2d3b7305

SHA512
722569f309353a2166e0266b22378e5086aae963578b8295fc8ae249b0150551212e6ce1dc23b5989ae3c8e61160cf7f10a36658e86ff83a8ee8a6b22d90e553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f795cc86e4184d91cd2bc047911964c

SHA1
a3eebbe8707aae5499ab446836d47d48dc0d7e80

SHA256
70340f1f5932cf80ecb6f6a415fe258c67ff854912ef46c07ccf12c5af31b9dc

SHA512
fdfc131ca0f4a10ec3edd62d0030839386dc613d5763c5f40e5080e38b7922e82ac1092c87fef55dcde70e3b88f259b2f5567ab0bb4ad9d2b9d8ae59d6f13a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a8cb6416a294511e51fbc897f5b8094

SHA1
f7b085cead76e89cff0fe4ca7651b566ff0c9b0d

SHA256
fde33148ac387e3e5752637033adc933db59c95798b55aa831164d16cd31addf

SHA512
a6c52a93162ba18f97a60f87e9dac0af41464c9adb56aa522ff16e577a618f3b848168bdeb1ec407e9ef709e552f37063f5a9c4a16c1537846415c42f2922024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a989386ac5350ac6d3901df85569daf5

SHA1
c60cd093d649482248fdf35672c1896c7526ddba

SHA256
d3f27b34a83eab7770b2fdf07b0e9b613466f2fe69de44009f2fe17d01050ea8

SHA512
07baabc016402b977d88a0814d98eb4743c8af9ee0694e39f8c808dcb057914834f2cead28e78a4c81492435bc0e5b3a7fa0b725f132647d63a2d361fe0940df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
218b0b9c7a96cd7501349a89890012b2

SHA1
4d123a1d20c2b15cffa77e08775f2e0511933bbd

SHA256
724af4e4b90719d9e0dd678263c3df83a966cee876a7082578e636eccc27ec77

SHA512
f3ad996a8bc8205109562d3ac8aa52c64fb0941a97edfb8f4892e1ce87537f339e195e77ee5706ae46f5976e85ca1baee296df044ec5ec445c75ac4bf2ea5eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb7baa8e63ac963751f994f4e1923bd4

SHA1
4b7854d28da9e819706a36461e3857c5c250c415

SHA256
214c8b1687fc969f093617eb4fc03d8d9a12749c046937813c6a89b75d6ae033

SHA512
c945c09949cc521abcd7076eab453b1f19e0645ade6ca7fc2cb89b84295fcdc26a44c2a0fa3ae03b1839b629143ec1006aec76b3a2ae2f2f80c29b666175a9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0511154e34725c65cc0aeedd13a30082

SHA1
ed5285e3339d805f86d9941136984a113dc224c3

SHA256
45f4caf775f54831129101f523cdea8a20224854addc41608ab582b46d175adf

SHA512
c589ccacf5cc66d52a0f41840c18ffa4f1d47371f8729b9db4fd4ed236cc73a908a7dc9e78b9e6b06856e9bb9a67d34eb4d121b7295dbd224e54e8c05afafa3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e991ce6bde4a219cec9e0b31370e7cb0

SHA1
c9b55e5626252019ef32e76587c4a420426bdbbb

SHA256
ca1d38670ea9c1ac07703b20798c30902db6438220ee653c7d8b45be9b84b56a

SHA512
602ad2a98d1fdcdb543f81735ff0d03ff29a08662c50e93fb7b58c937d2edc9ceff24f4caf1f82640198b0b4508375e860f9509fd3d07e66cd9921a67adf66d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5cf3b21a1a923f206e9d90f4a0eab5f

SHA1
32a574263c16ed9a14b951b3190d1e9ae34326c2

SHA256
f0bbebc6af31645d26f91cffe1bbc62ecb4cfdcac458c9b71365c71890eb7296

SHA512
9e820ed39a3b66489e904ff706638e0726e7ec55cc0d26ddc9e730bcc42fd9953364dbc4a7be67f5b856b87adb843038026c12945318a53f08b1bc9e23a22f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD349.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit