d912e40cfc8e8a190d54bff53b3472422ddf7da8856eb75f0170f787e8325e65

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2688a16026a31656a2efdf854fcc994e_JaffaCakes118.html
Size

150KB
MD5

2688a16026a31656a2efdf854fcc994e
SHA1

52d752ccfd8adedf524715f33f50f4d79f944007
SHA256

d912e40cfc8e8a190d54bff53b3472422ddf7da8856eb75f0170f787e8325e65
SHA512

4481f716414614dfefc0a6a3050db7b3f18207a130200f26f4b64581a532c8ff42f51fa59590cdca84248e054415cb8541cea66f279ebd9e41bc0783180333a5
SSDEEP

1536:4UM16JzJzbtkcyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:4sJzJecyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A0161A1-0D77-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10abdc4784a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421361042"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e6eef24556b152f2f75806b37e174026a295605ef91ed224adb0306b3aacbcf5000000000e80000000020000200000007da343a2318ab4203e791bf286bb2f119e3fc0959bb6468ee5a4570e364b5fc7200000001ca7d4e4726db761019415bc6849194d69c32e6689941a2bca669edfbd22595440000000d03fcc6f93d15fd48586bfeca07cb7e85d5e3c2cbc911071754e2ba59fff7c1bbc4afcbebe220adf616a7683307fab42d7beb54cbc1a554cec7cbcfd5107b619	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b84dc95c9fda9e7ec44ed312aa68b5dcc8562149a3c51653c5577212dd2db02a000000000e80000000020000200000003d5fc24c1eb1158c61896af5e1b50e5323f3c16b432349c852078e46450ec8f890000000cc1ba4a2c4a5de8a23dbe5d540ad3ab0db2b801ff2ed68ae42ef8804fea26f3a9d3719b43d7d2605e9edb6aff50c09a5a91e6763a2b09fbf36f05d361581de9ca026362f2c8ab8a4c424a837500dc7fbbc6c6be8a6baf919b00dd4b4bf9ccb50775abeb969d2732b433e8115c696752e5e9a65b0a8e0e4cd286daec84747338d8290404ff7ec034fde66fdeed329e60a400000009b40fe32af00fbbf8106f939d6fbc74625dfb18e1bf00a1f0976d11b2cbe815340c9bb37144ff9f310a50726804d168aa9e298fab84253c2be7c7a2c1267279d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2688a16026a31656a2efdf854fcc994e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a4a5d8f5f394374f519b92081525842

SHA1
0e479c69b6a30e640bca1847e01d801ac209a8cb

SHA256
12ea1d4df2663956356d2d772fb1dd1dfad1738655312cf0f29fbd778f978c2e

SHA512
060f5e93638488d96e8789ffa98dace71a59a6537fa4e6c92baaa163780c29845e62833dc15d493a65817e7cdf2cddc36f338e35e785aef328a53752d15a4613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8ecaa2cb7b96cc5f5b1709394347a98

SHA1
9747130b05692443dfa55818a7208c031d9b5f94

SHA256
b3656cf26aaf3491700df7350af055a1baf2b9f3f7c63fefe31541c08a63aba3

SHA512
d16fa082e7097ded547726ba4d94be656579ce7c4f52cb9a9ec2d9da4e2e22c90fde462e0d437529340e944a1da12fe2e04a1b38e2a1284c271a0581f05c2cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
accd4fcb67509d9fb68241f2c5dabe54

SHA1
f3c47131280ac340452865ea0e1bf15c19b7acd8

SHA256
70d485aad25afb0eb7e188ca48cb042a4664003f96fad7cec1d48ac033ef5ec3

SHA512
6d0104551fd6a678efb17ab7cd43c55a8a811949d8dcbd6ba6bd13f287f6ff7bfddd9c68e4b1d153e2acc74714f92a8dc745c6a45406d7b37aa4d2012a536372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0475d6bf0ea34a249bd0873caee4aaac

SHA1
9576228ccf2d5824add645c736b1e4359c952fb3

SHA256
bd202632a0f0e682a06c8b2edfcb04c9ebade45b74c6bc15da128cd2137296e0

SHA512
bec26df36586a535299190194a33a058cf31907f49452ab5723f6fa8762e772c2ab0227b64802a34b5c91cb39925af26f7d586fd9b042d45affe3614e8c12354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4abcbae40a2ef1eba805f2f6010d5d1

SHA1
066ad398668d9c97e6dd2610ef38bba2c1af971f

SHA256
bfefacbff45214b03e564cf6d332348ad3cea601b5f61a2908dd40776cf636e4

SHA512
9a97beaaf3fb05ee22b1e1c799bde90a3a688da1922c45e9ec5cb8d14054fc31769dacc8b982cdf80a54b8fcf0ae1707afb27df8250cb2f074f266574db3f3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cfae4d85251339c752ff1af63a9beeb

SHA1
ba984363e75505d6afb10ac84a1aa7273c2be3bb

SHA256
0f0ca08154b733825c2632572e34c3c1c73e625064f2caedd599aae48eb07ab7

SHA512
fdf718fed6058aaace6998ecebe361d52dd169ddf81c3b8e5847a169b8d018cac1099d47c7ba7632828ea268723d10e96822cab739dde324d0ade9bf8ed7e5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14b5a9789cf3a6e839cc6c0bd840fff2

SHA1
67124cfb2146e9ac79fc774d46f7352488bb9040

SHA256
4b3cce049459aad6bc9e50f764e50af4a1f9a8b0efe2ee053a1a26d7dcbaa4aa

SHA512
3c887500e18ba76a74a70d2e9f197f8a262b7f24ce530e3f8c4a9130235c1cb3804170faf70411b585ce9879f5b3fc3ccd4853b9be884648f42d8619ded3071b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e741409da12e7f012650d2db1110cf0

SHA1
cce55b42ac9ab0bae21764978fbe55adb445e631

SHA256
9b5a72eac47d370b0fe56daaea054b331fb2d1d2413f55b9ce3f2f91f0e8b86b

SHA512
998f5c7f210f9df7cb6866477cef959e377641252ade03c436e3258eaf3c07c50d7d6d7bd0ff33494f2ae274629ef604e777aebd3aceb88a58f46b189301771c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118bb53d7ce9a53d37507a1b160f5e38

SHA1
5c759e349689e61efd5325a1b8f4aea579945aeb

SHA256
48fe5061d4c5a45eac6bb5a1d09b256d845df43be1b62b589af4b03ca0c3451f

SHA512
f5f743dbbcad2e5539ebcdec5f8597ed9284888c54d3f09aa842df609b205d1e23a0a5b9670b6914fdd9f7543950e9bab6270e9149e4f75b17ad9eeed6c69663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc26ea046b18220bf0d88a6f51b40ed

SHA1
a687392a679063f4cd74934a294df7bb117eca2d

SHA256
65d51672e0a6bfb70322368a0f91aeb88c32278e39832fb68244f85d16c46f44

SHA512
b11fe370f35c6cb5738b26c8dbe8bd2b5449246d8d60979f49e12bbd93ae2357d52830c59d0caa29f56d47ef8deeb35221fc91d759ef95c8379a8c65714ede99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e6acb58f6298e01e92a9e90684fcc6

SHA1
3bd1fbd85f963140589481495133b87b0e87dd40

SHA256
463433d517879419a6fc641bab2b9a146a401097b8a7e3b2eaa5b9346c273255

SHA512
29111657b55730df2f4932dc956507c48c407178fb2b390c9d61b843ab19ffff0c20a0ff23e647573a89d4c7ef8715bedf92fe4f2c6b047e37ecb3167067cbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA4B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDAAC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit