5984ba24b13a892fd1b66c8d9f5db9692afb7d30e549e5595118d036acba8a5c

Analysis

max time kernel
136s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c558f53f898d8ab3df356fa9ff8f43_JaffaCakes118.html
Size

172KB
MD5

36c558f53f898d8ab3df356fa9ff8f43
SHA1

8ffdf79d28af2435738b71d8990d8657f285486d
SHA256

5984ba24b13a892fd1b66c8d9f5db9692afb7d30e549e5595118d036acba8a5c
SHA512

6bc0e3e1dfdeb11a1ee720044c46f512bd91c29d5990981a408f268dd40f9a56d28c8c113b40cb06ab26325e7f079bfc4584026c3e450a0d60009157c5b6baa0
SSDEEP

3072:ScjT5hnMjiA/Nl5xVoEelCDaN4hapm3rwThNYglYE1t0P4a7XCli1lOyfkMY+BEu:SuT5hnMjiA/Nl5xVoEelCDaN4hapm3rV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421626879"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003613f3d2629056982db8b88089881a86ff56f266eb80ecf3ec7f12624ed54ad3000000000e8000000002000020000000c43d65b263642cb0c95df4e30f3e14acfc57644932578b38f237238a0f63af5020000000296d5e8189da9f1c7d41f28a76d5701352907fd7e48c6ac99e81bc05c118e2cb4000000082555e6a36725e53a6457fb3fcf8c6e25002854ed4068bb11178ac3fea96e6db52f130c2421e75842fdd4a43be008a1d4cc54c5d710d8f168f19cd77b7608de7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000095bc2d5bb3832da35133bf1e739a0384595c7faff67bf5e765ae1c85b12f2ece000000000e80000000020000200000003c81ebb7483abe8e60b7cf9e313fe2db9183480488f52d16c5a2981a7c6a5c289000000081a4ea89a78d1b8dd11d9b84fc9d8b43da1fa97ed0e19fd881e86dcfb1832c92d06444ddb0582f86028d694450333565fd0b6ba73932c6775923d433bb45b85c2ae65f0ad0c86a5222e5aca8ca14392acfaaa7e3bc417b8962ad3088817491003a4f1f9056845b3f9271b8d9e69c9227c1ed6a3c9c2973f97096dec5e5288e180cf4e4d426409ce5e6e339c018c8b67940000000c27077bdc8c9229fb2c499fe754ca95e4809d6f344b3dcc64b2ba9bf64205873aaf7a8041a0aa947b751ad68ac71976118cd3638b990b6de073a71f6ad853c6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{469D3C71-0FE2-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701a1f5aefa3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36c558f53f898d8ab3df356fa9ff8f43_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df9b57a612307e142e21b8b46ce3b717

SHA1
356a91bf75d691a5511305c82e8b9c8c05adcea0

SHA256
19281816a5a0ba2bb504beb1b666a688000ecd2c8705481af33e6f26d72d2f1d

SHA512
819933361eff2d6e1909352ca58469eae5892626c38493304daadc6c91616427db73df037b1dddb4d89c42e4c3a4e42e4184b2b47a4c4da8afc015eb2325c97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c25281b99665fbc9d6c18a13175743

SHA1
526d0832297d416aea4d50367a3d121c16b48408

SHA256
a5e44ecc5ced7ae5cf3497915952403936b479a8e31821cea5590af8688e49b7

SHA512
06f77865da5cfb58fb52c07b11222845a1144304d6ecc8c0410ab9831c125bd0e8a536debf7b5762774f7d108dc841428c3216eb479f4b948152e9cc2ce49770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29eaaa76e4bfa7cec8d9b997cf00f6d4

SHA1
70c1a76f046ceffca8f092bd933a17f900fb0722

SHA256
7ddb267eef7baf7018eb93dfe12560ea4f9c024b61514a65cf52be136fbffaad

SHA512
3bc368f042923e999328d03d2bb43efc4dd09d0c76d6358b17852bdb6b3101760701468fd584d9bcb08445ab1d90c7cd4356c0a4f9a6bbacb2de3bf20d1c93d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b25fbc4288a2db7e7a7100fd5123776

SHA1
632d75b8846947f7dc826e8f9b3e8182829a3920

SHA256
dacc00091b13ec8673839b0b9fee92b09fcee0390f7c2d3ef9b0c1522c8434ab

SHA512
446e3afa7a873e2d124a339fc655ea63c2569c377274e16b92ba2eb64330e22995a75216f4c8443faa14661e9a9ddbc155c62392133804bfeee57c8bc4f2b66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0837514d29fa5cf3bbc1693b10fa0f

SHA1
c772b1c1729fcffabb09042013ea90ef94732e91

SHA256
d631cb85ccde79002822c4ed2c4c1436204b002d1eb704b8e4603d82f26d958d

SHA512
883be1f916db6a4b25433fd4d77b8cafa5ac9952346d829da77971a108830d6cd58de559e70b0fb935678e3b07c55b6f913a6a8a104db46d2eae3863a19a776a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d580e5c0c444979e2277bc0579d36bca

SHA1
3ba88f8bc831416c28dad179166bc7932e52f053

SHA256
3bc411f50849b00c15ca377abe8a43360a5ed413dbef2d8d34ec9f913780e361

SHA512
e9c9ba47bf13ce20bf9e3fb79fee7fc62dac72da715e2420c85132fb58fec32b05b06e31647563dc1c37eee234949aef1e54904142b6bb2aed477c6ead052007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba655194cf578b6cd97914b93a2c9b92

SHA1
c102cc2fb0274a02d345503743409cbffa5b1c3b

SHA256
83ed956f846cffa7d5e26c3c5f15b1cf5ffb964104bb1b37a50d3a4c9941f097

SHA512
08b83fbf010de2050e796522a35864703b71fd20a824c9779217692a7e5f05d3966399d55ae0bb501966f3ce8c036828d466feb05722b3808ba516b836e9af4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
827c3ff15666687ac06608d7cb0e725f

SHA1
1deca93393f63e81b3ddf2c8df2b8fabed3aa227

SHA256
12d9fd055bba14dd5b5795cdc81264d137fe705be1dea52f28431faa6e91a89d

SHA512
a101e27f19012c6a450e68097f824c9b16b8c5ae1c913590a7fcd4e092462b1bd9610a71028d56ee929851a9cdda8084630acd741cacf2e6ebeda88a5a54504b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e18aebd3398c2a280178a7d7ea2a2c

SHA1
944dfe377f11d88cef130fc57ff2baf3623c94c9

SHA256
1d9416dae27846878832502cabd0b3df26e93d8a77875538b8799dbe1c02d617

SHA512
d0d5b701b9e1667f73e10a2e75b284e4bb228da399fcdfa7fbd1dd082a5b633f7efa19d2ad3356871bf69c3d7c750132b552c481d69bdeed724a1e3de763fa80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6db6de8d463a883dbb402bd2e02f77a

SHA1
1d5cc6b41a9d15036fb6575f3c5c7512135df51f

SHA256
2c0c9b322664a3c41f8a92b9c0d7aadf5841ace413102b89da61d11e1982101b

SHA512
2db996e6c8ac15401c5f74aebcd016129bb500e9bec733bc109024f609f445327613bf275a3855e866a9292e2f8e8799b1178b27e37f2759454c6b906152f6a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f7d5014c0b3f83857d42ba2d6209cd

SHA1
bd6d59416fe3a700c5b8f4f935d614a557b5e117

SHA256
dd1ca9e88074076cf087ab13560af4980e3c7446ea1d141c98ce1b7857d7d783

SHA512
1fea9e4b26d2ad9b109d4548a1f58bca7e4bcb3bd3b73a4eebb75a25a8fb15da86e9d7acdd105bfd492569941af122cde7c5581b58d542779461eb0315ba5522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61d0f61649a3ac7bc0b61623802e9f3

SHA1
b1109b765f1902fd23cc4d105d3fd6444f83b7fe

SHA256
37e77bc75f15ff854b423aa4d1f7877d50fdd567b96d1e4af15dbd2cf4843987

SHA512
64e1c09493d4aaa1c19b46d50f8372e8cda8d57276c7de651bb28e284750f6ddd15149602ac3e99080a1e7309bb0bb3ea458001468b78e5d7f674d997c1d0c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25CB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit