3d83b67545dd157f99b02f7658ca578c7fd4de4e3f031734001db5359467a317

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ad66be394a01ce76edfcdaeed19e53_JaffaCakes118.html
Size

36KB
MD5

36ad66be394a01ce76edfcdaeed19e53
SHA1

13d6a8c27dd3421ebced76255f495a951df4698d
SHA256

3d83b67545dd157f99b02f7658ca578c7fd4de4e3f031734001db5359467a317
SHA512

57622f9f49e60bcf045372aef3c56624751825c17dd0dc927ebba1dfdb75590704e5d3ff737ebc3577a25acfc6b8c54861c789b8c0eaa0b04abdb236e42eea58
SSDEEP

768:E4FQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a4i6781DdRA4vEOjq6h8aRlR3:nFQW81D4RA+vEOjz6raA7IavC81DdRAW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007ea195e50a7088eb2b8092171a11188782ca176119f73b31759740ed00d53ba5000000000e80000000020000200000004d5ee634c485d3ad4e5880b4c69f9bd026fe7ae8bf9f33f9dfe475a672e017fd2000000082a38626247f66db0713d4af19e710a2b4a6f40a9ac0ab18563ba0597f1e6c3c40000000c0735413849da9a353deeec230b33dea68f93bc8dfb95135fe3c9b51157e7691cdbc496120d08db54c2cfaaaa1d3ff80700f1b254d9947bdbafa73868822b95b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{157305B1-0FDF-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421625498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e5f3eceba3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a3f09311d4de58291122c7a8a3de16faee9bd2797e7be0baae0605f89435ef6d000000000e8000000002000020000000b4f0f25b9307f48356ef6e29e9dc6520eb5f014a17b680d59c77b18f68771ad1900000001c079b3ed2c81e21c916b5ab46eb8480f16e3fcd50e0885663b9dddd64c0205d55ad2d5215163932e5934156b5ac9ea33ed3cbd09e1ed68d879350ac8026e909a6ed1ef2a40045585ad0b9d371711fcd1a427b648271adb5b90fab5d0a9065c695d6a815cba46196dd1cacf44f219c142ebe825b6489dcad01bc26d5c68c76c709aefa5afef4106bcdaa0857b28d725d400000002cfad9fbaaea645f3406fb557d15bcf08b0d2f32cff8a2d1d4e4b5086f2222e49d90f0d9d963b8f5455580cab597f069255deef3580a3c7ab80b1d29045b51fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2584	iexplore.exe
2584	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2540	2584	iexplore.exe	28
PID 2584 wrote to memory of 2540	2584	iexplore.exe	28
PID 2584 wrote to memory of 2540	2584	iexplore.exe	28
PID 2584 wrote to memory of 2540	2584	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36ad66be394a01ce76edfcdaeed19e53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
702df70d0a7331edf4586ec271993b81

SHA1
1dea97ebddf932d8050ad8935878db5f40321f42

SHA256
9fb32902a6037acc9c695a82b2390444d746501f7b40c31a3aa43d2e9a8dc906

SHA512
e5a3ea75ad7350d45d55aba9ca3af481a277a47c256b529d7fdb1e1e32949164864200cb7fec7c3347f79efa1575354f5c83e3d562937d9505213253920c5246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f345ce697c14aa048b634e74aae3e807

SHA1
2cef3042d05cdac831c9f696f90e89471cf4c2fd

SHA256
fded7ca80cc332c8d1071f4f5c6bcb4d6c2afadea478e17632a0a9435e624d37

SHA512
30ee114c78f81426a57fbc3c33058d8cb41195e002741c7f95cf00330cfd2fdc5c5b3c700de392e09cfd34da9f5dc1ac98fc97ed022866ad0e51d15083ea870d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5610c76d2ff8001a37538bb746534935

SHA1
0473d7730799c16fecca058acc8228f744e23707

SHA256
6eda9aab116a9f6072dbb1a6a66db422de421f30add706a029397f8db431af30

SHA512
9530f7fdd785f391ad263628cbc1a061154ead793bd0d334e86682698c8b0e393aeea95d691df01b731118e4ad936bcdd381b5884e79cae3f421fc6fbf5de091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
607a9e73e9358c5a77a575053c22083f

SHA1
85f5f6677629079cf1011f7ede42f3c770c296d4

SHA256
1cc82f6cd4fbd113c2ab5ae9ecdb8b621d7633e76ac7830d46331cad7c475ad3

SHA512
5bdf2009665f5aedbba647b0c1a0cc44b974204e4e8df53c05ba88661ecc1f760aa352cf9a9d4ef6a73a7faa6792c2a1a917d916dda8a1bea31fdedb1392ae0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66fe1f5d1723dbf139e4c44a0294a0e3

SHA1
60f8a20bffde91beea2e6b025ef3795d26a86510

SHA256
d26a37a25c9931cbc2f27003f6a76f78a3d89c81ccdb4d63c052f6c6388c8162

SHA512
aa8ed6aa2da9b68c6a80ef95beb28a6a796b6e9de488c46fad38db63171a92c8d9c794d4c3071c428f098ced868fa5a5dc7786229fdd6770b41d8088e64d5b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2df0f76f3d35141a8885c839f1d99b92

SHA1
d3a19365a0ee07fb78227fa9ed2eb5bb3ace1cb8

SHA256
5d1b942aeeaa05934328c14314cd8cf5e0db5cf690bd3084302c04fe6a59db8c

SHA512
475495e7d932a573e8d9139f93e56ce61e375624f8ef4b8fd9672420fd1b5ad2e994d7475a185ace571e0b411c7e933b455afe8a7b4846ed543e91d1f0598a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e919fa866baa00510c086dfa6cb8932

SHA1
d15d45814713cb2ed8fd0140a216ce7efe57bfb3

SHA256
7d926e8ed48ec3e7c46ed9da6e6dfa975bda38f208bea60ab14465f3efbd7efc

SHA512
49ab4ae825c8b9bcacc92c14b89e2ae1d474cf54108f2ae5cfab5fa840aa4c4d663efbd9b3767237aba10690adef33b08324b5dd420bac4e57d6168dba448aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64516157ac2cd7ef0562cab7f82d037d

SHA1
3679386e100b6ddf6f2f0ba4c57b93f2d6375f3d

SHA256
977e95b6fca2abd95b175eedbe36d4916ebbba5ca022aaf6143f887c04a6f5a3

SHA512
814ff106ff9456a6636241fb812566be12e3e763c80caec3e38649e1f84a3558fe6163928e5133e7bb02718c9d8b1704fee8b6ad8e76ab4fdae442b6497f2462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f78cdad14f464b96772a46f8ad55ca

SHA1
a29807835a1d21b7404ada45bcba25418993827b

SHA256
6ae3f10124e8f5429794fb526b9f4585bbe900a550203de72527e47a16a9171a

SHA512
01912ab1861098c21a7613c967c216581341ccb8e4f1fb7ffc03706d949ed4c67e357dc7112122d58ba357090fc4b59eaa17b223518618cb411d3a9e51c75d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6a2d51cfd75cfbd9e3f5c8894d9c44

SHA1
1a98421f0be72d6d380a6e33527e50c3fcc39f21

SHA256
89988b647ee9c56b1738afce20ada49c8580759891f0d7dd430c54a3f9629bca

SHA512
67114ab34ed2c13fc959c936f7c0a32c4d299830067e74dfe79fa766cf93fc0393097355ca1e8d936063c4ca5738d606369116d9b6f0fefc93d36a28336c7040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9259f19d3d68084e959da510126168a8

SHA1
bd03fa1ad19e181c16da47e108ead5b7574cfd91

SHA256
7c610b97c4b489d4e846c10773deecb096f1947112fb5a6420bb5a2abfce30b1

SHA512
5fb24e54356a8a0d7fa26d123a5f6e77dac5bd42f151f9becd5f7c1dbcbd151cb112514767de0c31eba15e207023c5a46d78c07a556e1b1f138efed51377c283

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab583F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59BC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit