9cc3152620a5db3254e9ce7fb89a51b214672c570381e0f505b7cbd5a819b3f2

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2797f203298abd8b03115b46866d7519_JaffaCakes118.html
Size

4KB
MD5

2797f203298abd8b03115b46866d7519
SHA1

a4c77a82382a87d60f6c59d563fb524cb050b697
SHA256

9cc3152620a5db3254e9ce7fb89a51b214672c570381e0f505b7cbd5a819b3f2
SHA512

115de4bf893eb32150723b1780f46e58c9c294fe082124d10f0c3a9f45dd99762b5bcdd96c0983adb8defb88d03926b85af1229d134da83eeb36da289a05b6f5
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oe8qJ1Hv:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08fc72faea1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421379082"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B3DEF01-0DA1-11EF-8E9F-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000059b919538f18a7e65818f9a0513b7f5485e30f21e7f9c3534aa9bdc9dbb4e14c000000000e8000000002000020000000e9f7d1ecba4e3668ae11ea408c4e7e823db0220336f538d09b1cff4d48145b459000000078d2b63514c19713db473cc9562de5cc36df7ae3c9ce3b8c7fea78d1d11e01ded42102fdfff889109f8a85b94f8df4887886099bce3f396dc656292c2920a6de446cebf06a86fcec60f38292de347a132c88d3fecebc8ec89f107019048a3e54d747a86974f0a9017681ab09ea858a048124e83dd2ad2ea233f09d34f7fc957e5f9ea7d806b5d1152c31a53a8bf36ff540000000b2c8f37345133b8cea475700184df31baea47b8f5f4b89d042ed88091de338678169e60fcb4f6f1a83b9261ebb58bfddcd71eb46b5826475256b60d17e295a4f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000014fd5dc6d0342cd6a549b93e5cd4d1d9adcf2e0c6579060c001c99c1eec103a5000000000e8000000002000020000000255b8ce5196f15763799cc640c2ad11e3861069bfe69ae571ea4f068acf5e54b20000000625c1f428f6ceba1588362c01a484155df9a7c5b4532760b5b7020ae4e1b18b640000000f95e1be5d475d7670b33802b67392b5d9812fb5407e74cc630d0e54f40a44987a0cb91a15cf671360efdb19e8e29ba9a7c547e51e4511e889f31d3d09d59ee08	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2700	2980	iexplore.exe	28
PID 2980 wrote to memory of 2700	2980	iexplore.exe	28
PID 2980 wrote to memory of 2700	2980	iexplore.exe	28
PID 2980 wrote to memory of 2700	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2797f203298abd8b03115b46866d7519_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
149eea8079cf2513c9eabdbaf1f5f393

SHA1
64b2b19faca88fbcb26febe65df62ec7baf921e6

SHA256
ec995a3ee4752263bb2c6225b8258fd0f1e00007abbf3bdc4c65ea8cf81147b3

SHA512
d46c102797df555a0b0bcfbdb2eaa941c879d748bff3e00ce2d60cd7f8c0b82e7601fefd0af0c68125f99ed21e49b803a5af640b1b4843d808a2adb5e61c7ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e870e13776d9cbaa51abef98ca981c23

SHA1
1e05c8add93b141ed65c90761e2d1dcba9138be7

SHA256
744f267e8e3bf1639e5bd7af1084b155f31b3e96972ff8e617b249c6f1ad3503

SHA512
07620e916393d4ec6b65bc673eedd13d3d119b122a18d64b5f69c9cedc6842ac4568c97ff49b66992d28433988c5ff4abc0ff0d5fd7835b8d214b56b082750fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da54caff7a8fef0e3fd43f9f4422de57

SHA1
767c69e193d500c69a64b61b5493f70e979667d9

SHA256
ba96748c8dacd748fb092922c86c9195a3d85f04b833620ef5328872255bc3bd

SHA512
ef9d036dc06aa2de2e7c6771fd7348934c9318bc8d0f3138d7a0768f167156acdbef6f261198f69724cbf1d551bd4b2c34622e1b41155130e4ac04e8e67b26ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15e01165cd4cada6baac029b0276c0e1

SHA1
24019b8bd6d2c9a33d03cd89f5489b093c7df78d

SHA256
3994ede9d31d388455dd551710ec68a3650de16b8f9ced3a4d965c53a98331af

SHA512
319680e92210e33ebc4b6e6dd4e45383ccb45e531abad65d9d2a9a50a8299aa8466dcc5f506f5edf9ac28548f0325175ae06e7ff78fb0e1b2c06e941c3b2ebda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490dc3ca88bcb414eb21c21bbfafe569

SHA1
76b9f02ed8fbc7899738d20b90c36b2515de8b17

SHA256
b05faff72aae86db60e810f7799a6141777a682166f1083d70c5b7da51a6916c

SHA512
de7013a2a3e398c7d073e053a5eff47534953ade1c05199a111778dc648a9acd5bb0d063dcf6215f7e9727af84fc55cf475f18f3d324294599b09da973f313c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63795aa14175040031b9c6d5ac32eb23

SHA1
7d7ae212a1550b3827f79f14ff1f07dfc7dbab25

SHA256
a0a7b26a9962a10aff7f82a70f1bcfef72f987642c27e15656b768b61d0b9dac

SHA512
9ab62777c5ee11228b0c5fdbebd014410f612553806b2f0cda18b2b307c5b9019f1be04fea95e5f01316b19edb08181f838b94fa2c5d376cf8e4a06cada2ac41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
971a2d87a7c4a66d28c6f82367eb6378

SHA1
8570cf10a4cf77896bf965102ea293575d2f34b3

SHA256
7e3c93e4c98f518a66e46e3aaf4a1b899847f848c2d506919d2d802e7cc7c95b

SHA512
98d88edd7181a9ed0580473eba12ba36c83cbe7749d4ef914101b2f5183a00cc117b9651a4b615a743a645b4d5764e0c64a4ec01a1ef03bd2569d4835401499f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91b6974fb46752cc22b79df74523cfe

SHA1
c1da178afe41a49c397a3b2571e3064bdfe34f53

SHA256
cbd0956bab33148dc6010e39af1ce598b270bb8ef69d967da50a8cd3881ce01d

SHA512
4db4c39037fb1846954c29bd2c752d6ad546a859b61428827f0d25fac2808acf9df7d11030677da01d9cbdcddf55825b68f44ed73e6bcc678642640cbf299fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a91ece0181589d8f9e826d10abe67ff

SHA1
4d487aa8d25b40ca9dc46b9b3dca84bacb614e93

SHA256
7ed7d0215ce03e226482e36f0464b1c1719f0d3f4a98d416a397e1cc66ef42eb

SHA512
3b84a7bc416f641308d2e09d78334d20d0a3b16b42c96de36155c601656bccda7b75d9de11199ce876cde60cb41af4359076b37eddb945b50b7ed309439a5751

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A8C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2AED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit