31d47b712fbe11daf2c9fb4bf5f4296c5d35c471fa08552316c10c467329785b

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f59218f83af84c6c0ba73d9e842c83f_JaffaCakes118.html
Size

26KB
MD5

2f59218f83af84c6c0ba73d9e842c83f
SHA1

459798841e915d30e001d66b181bbf06da03a115
SHA256

31d47b712fbe11daf2c9fb4bf5f4296c5d35c471fa08552316c10c467329785b
SHA512

69a134f8ed1c8eac9b34791e9d55fbe7631942607bfb85bcd198e2c928aeaaf2beeb355079bcc40d3a82bcbeec394592ce353ba5effff6b42c2f1871000cf802
SSDEEP

384:HOAuwNUz8ujMBT43WVaZ58jUdx8XFxP9gGBRXgh67z1BgUFqzo2iuAcpH8Y8ew:HO+WjGJVq58jUmF9g/h67hR6H1Vw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421509668"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65F3A211-0ED1-11EF-8B04-EAF6CDD7B231} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ab556e51aaff0865efa471b1ce92c442af041d113750a39ce52f40a296ca8638000000000e80000000020000200000009c1607297720313fcef788782c576cac64845ab66e1b3f8536062d77b7291bdb20000000ad3a311262f308a08ee20e4464ce26b149a6e0d191c22839595e071626ffd325400000000279be9d7648814a60bce93e4e97592315a97ccddfaf65dc3dec8c7dcf94daa2e621f3fb8eb31b6d328cc8b6d42320bd7399c814702776212bf3b283a6016485	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c8b13adea2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000009ecbe543b769d31f3e9ed91355c490f656ea284063b8cb22043b041582087f1000000000e80000000020000200000002782242ce12fadece29124aff1aa3435938e16aab53710747ec257f11e94c4ea90000000b92a41fe46b3b8a21a03b68e78cbce189294c7cfbfa81e0077bd1d72ce6a1b79f2620854be7b18240d7cb8d74cb1218c771465594016c785c604c833582a7144c8b1622b0ca19e369ca5351e07c26c69b1df35d7dacea71abbd8f7e96fc0904aafd821c6937a9f1c7cbd914c1579897b91a140ec32de73141068950b92b73a84d992dd771230439c04ead858774ad36f40000000a0cbef0486beaafda6893544c952c009ea1f3a0009051c5192afbf35b914d71979cb21569eff6b01fcaf99030d0d738d9aa86a425b5845f9303c5e2fdeeb1706	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2608	2180	iexplore.exe	28
PID 2180 wrote to memory of 2608	2180	iexplore.exe	28
PID 2180 wrote to memory of 2608	2180	iexplore.exe	28
PID 2180 wrote to memory of 2608	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f59218f83af84c6c0ba73d9e842c83f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a8758577359dd97999e453b4e382e1

SHA1
891560be7d0eb267a169ef82f1ced65762a42038

SHA256
1e70250451009e5a0fcd495f0047ce5de3d17b6af4bf1bdc1d1d557bc2390508

SHA512
f676d6637afa28d9f5feb086cfb72b2c4edf4c569186af743a64eb707f06359c39c4689990697af94e4a23981953b0479fac32cb471811b3acd49b9f95a6dd2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e921761c79235be4a3d18b18304ef14

SHA1
93b53fe94b76a8697c0f0b642cdd6835e3b324c8

SHA256
a092477f6754a8dd425ae9c838dd80e855af9e51ab1a11d66c79f092915047c2

SHA512
9ef5386ea59fb1ecdb2e8b8e87f5af3032e452945016e752e69731547a3f875ea6334cbc26494855f1a662916cb8f18a382086f56af1a21f660cddcebf7277ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c29464b63a67e96e9fe7355328b0fbe3

SHA1
918a34032203db30b2a7e52ca1b9d07d0e4b04a5

SHA256
6646345435346555b072eed3efe9ce893883d5d0d47c0fd2d89202c1847d4b95

SHA512
c6fa38e36c8ff281786e8360a5ef6e9296b0397259dc0ef962fb1660ee1a5e7fb96dc75b7efd31a3d7d55a1cc6ab66c06e57e8aeb518fe5c6ec7ec47fd3537c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36f9874cf1d7ecc1186a2483272e93c

SHA1
dd6746d8b763fa69c569eace3eddebc49135e299

SHA256
068cd83aa83dd9f65ecce5ffbaedf17a9443cf99adf1f3177ad6d6c7b2f31252

SHA512
c296e8747d8613375e5411c6e39d1f6e8d9d10038654fb1a8b20f8bed5c21167ed9eec3bf2ccb7dffc59c24261faead51b1c27a1db57924b0667039bc7fb4074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ddf26c5410769cd71dd80cb6260af0

SHA1
ed83787aff4a6efc10eff9d8f59254ce16a6243a

SHA256
14e558e15f5f33cc63ee074e99601eab89b4b70c988840af2c055cd1daaf66ec

SHA512
abce589da90a3b52d8e9005f78471acac34145ed41b86df7b8889ed4f802417b5cd525f33bbebc045d3659a1a016bc3e24668e6e56c838fb96d398cf2e084795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f6bc784a81d54804dec2dd63978829

SHA1
f08d480e13bfdda95458f6f9591ca19384cd4fb6

SHA256
6fa5fad52d26f977c819a04d8c22607cf5ef654a72cb5ed20af8ce6fc16d5881

SHA512
c940d951d1bcf8e20404d425272856a6d239598470eb1050a3c9ae6a12b31ebf990dc2a6f617e917cbee17803344ef087bc38cf279fc0d5ce3e859542c85a94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02e3b3c310800d510b44f81abec2dbc

SHA1
f6a1fd6c7b49a1f97beebeeae900573bb93c9b8a

SHA256
ae9447decd1830cc85362e35715c159f7fe7f9badef635c3444b1e06b8179187

SHA512
304970287b6bb51d01425446a84ac0b4c6e20398811593b02c4713566d5ab562d61e04bf21964fb80a3cbd470c8341afd0fa2c288cfd6ca13f8ee530e0cacd76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d10a3545d78ed6afee76b818a245287

SHA1
e3753080f2736660f4e0230a00e3332e51332978

SHA256
2b67d2eb23275f89ccefb7e577061d93adf3a47bf37cd53ff4ce0d7c5b72f5b8

SHA512
5aeae99e4a3b0143c4ec41ea98816b9f3040d6a8c5a45ae974a8a8be937ef9764871d15e0d6d33497904906bc2feeb1d3758604347a77771f27c26dfb383e121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b44bd5810992974bbf3d6b5ab38d936

SHA1
dd9308ceaaeb3339934915be5393c5fcfe624d78

SHA256
4c52f9d3f88a9dde5e68b504b5dbac5ff730365f50f2f84b02758dfb2cfbe1b4

SHA512
e338107a35236b36b6d95d32b0aa5a96b4715ff1bf2af65a3fa7fb498e5836c6dfc2803c0539f3e7692469436d46e840038e4b2d8a2f8aa5148dd14f6f21faba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A4A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D2A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit