643aafcecdc171d944396dda6f52595bcdcb6ebc22c607a8439f412f01d4a8ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36a0ef030ccde1794d444f18deac8b81_JaffaCakes118.html
Size

150KB
MD5

36a0ef030ccde1794d444f18deac8b81
SHA1

6cd6a55722bf3f4e4692527487565859c1badca4
SHA256

643aafcecdc171d944396dda6f52595bcdcb6ebc22c607a8439f412f01d4a8ef
SHA512

22f7b81eac3ed41876ca9d801d9e4f84ddb65020c311621922cc155ee5a2132e4aea0212635763881eb8fc19f88b87876da19ba0f6ba34cc41cfca44820d650b
SSDEEP

1536:SbOC5PPSYu3eyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SbGeyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c89b48c8e4b9cd523761b456999da5ccaea0c88a15151e1e72bf16a49d69359f000000000e80000000020000200000000f346bcd1c86affd0fd022bb4ffc4077f0772b0cc014c74099eb3bfa7843f86220000000833b2ca620be2131eef80dc7845129705805a6c28811e4faee287f618ae6814f40000000a44d54b644e2749db46f7a111ca9fd224bd1e879d32c494000e02104dbc569250936239155db2dd9bf8cfb413b507d682bbdb772d131c5acb9b56239cbe2d714	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{523B8461-0FDD-11EF-B023-6200E4292AD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421624738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003acc4610c2cd5c4ad289ca1de89338b0a068a91a1527243307321d1da302fe0f000000000e8000000002000020000000607f0e87a9451f7f91370026668d10103f2fb426fac13b69918efa7797b0d602900000007b54322553483332905e69a01b63daa1aa88f95b4875cc345d32a0e362adbd6182f85e3f64e0dd0bfad8582193238308ce3dfb6378de6d2163edac59158ed48bbc5faac93b87de4e649966d76da9a14324cecddf888b6513db6fc9163a7d3eedc3910fc57c18d8941a4cbad520f1bf001deb4876c776ee81019a6ba893db700afabf6574d09356e6064b72ab0ea0dab14000000000849f32fd0c9d5609dc1c54189f40307693b6c58506bbc5f04648480d80c08eee1a23e875988faeeb69648f6734020468ae9435fbd6890b16888e6171512673	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80980f59eaa3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2848	2252	iexplore.exe	28
PID 2252 wrote to memory of 2848	2252	iexplore.exe	28
PID 2252 wrote to memory of 2848	2252	iexplore.exe	28
PID 2252 wrote to memory of 2848	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36a0ef030ccde1794d444f18deac8b81_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d801da883b6cdc01728e0f1a87db0f14

SHA1
866a2409352b710a98dc711a26588799a02af530

SHA256
5aa60ca8e63ab83abe3bfebc3ead84a65140f6c20e4f9cd0aa3e1d998bc9988f

SHA512
45c7924a13f742dd222e8181d6e5af0aa4a4ec15521c6881f2caca8d0e103048202682472b4bc6712d6a533343cae2458d72898671726622cee2fef6d185d01e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dbd83bc37b633f177afb01619c76f96

SHA1
182e8a3cf9dab1bbf585b2358a9c7b5a4484de58

SHA256
6257026dc639294e6c42f00d69e267456527b74fc2afbfb3605ffb5541f264da

SHA512
1ec05d025522c263e9dd3b43046017e6a6b8f8a1bc9230ed0724a2df0c5111556fea39056323d5452ac0ad94dc85d6feca378183666ae86154b35be2b1971b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb821399e8f9d2e0af791fd3c7e37677

SHA1
801d5aecf2e70c89fd2d464941e1cd8a37da016c

SHA256
8884d822b4944bf365c255f48c799d91119f121e809a716977a37212941db9ea

SHA512
93293ca030cd6c0ad39109a097e1cbdff486eb9dec7bec457d35e6109c5cbf3c61cb94af017bbbd424fc9b982c034d39ce6339a57798710ebdffd04f4e7d23a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc79d6b869a4178c97e480757529e97

SHA1
60c28b8c9983ee867b258b5db6d23c875979dd62

SHA256
889d03a15c5a4e02917de34bce4e5966ffda8ad0293dc93ff9d924e34f75ed2c

SHA512
a8ebc823fa05c72cc7ec01d807125b8fba311dd299c0936b57f5b869ab7513a1bb1538966cbcfbbc9fbbf894e3736f4b0be46227bf7f4a5a8fe8c0c9cd976cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9e87bf708a4ca1615a1fb6789b68d8

SHA1
5bc5e16707796ceed453f3a325d7906597fc2220

SHA256
c505808643566bc2ae38a3be48ab999b3523e8f0abec6cdae84099b44677a282

SHA512
5159e7899826643fb874214c8938131f30d8e4d3de93a0a6915ad7fc25a8b20367fb0a51d97463015b70168b74b54762988e7895f64b4de2c883495f07436aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf83e06623fb5bbd2778dc28c10f317f

SHA1
784696c2223011cfa462a8a3298172076fbef23f

SHA256
bea1146bdff02f9a1560c621716ff55b9fe9ec3fd5638d4e204f1b102e703227

SHA512
fa4af22b0598ff1b80fcb1bb27bbf1c3fbb394c4cacfbdf35c23611653f8c40daf9429ac4c365bc1ee2ec20986aab871b2aaac756ff44c30af8a5085029008f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17da316caad922a47282052aacb04179

SHA1
2d3b07fad9dc13200adeb5ddae8b896f5edf0a6e

SHA256
a06c16c877268b3dfc947c9e3ff90b8bac91b67a457516b05202d5ed85c61bea

SHA512
81b46e090d93005f64e39a6ebb01d375120b21947af6ff82afb7729a225add852362f0b54353bdd36990ac4b8bfb6a149026543859bf3fe6c731eeb00d2935f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a910ad1f8f5d5ee683ec9ef2b1aec1d

SHA1
a9b518251e14355d76a2eacb43de6892446fe312

SHA256
c38e1a72f43f219eca05d6d0ebd8bff6590d976a47526ea102f050865254e00b

SHA512
b5df5533637f094a3b12ef6b1337f0bf35f6e4c89babdbf76f3571842fb992285ba87bf2aaa7b64953b8bd48fa031cddec2141e7d4ca61dc042238561b3ee855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f86669ee8bf1dc68597b53cb6db5bb

SHA1
60515d6a6490913b2a36a91910a13745109ec290

SHA256
01a76f956ffc94d5c18288c3a8c714ec56c68f516bbf97aeb9f365f54dc257b2

SHA512
9c4d4d7403d06569e6c3574b910662354211be4607fbd634be47ca8cd07fd8866dffb6dde1b24f3f8264aa27d11313b2ad1eddd0deb1b8cb0dd0b6766074af61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13F0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1441.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit