e77be8286f34c46174b81f8d27cd789deef91c890ad0607e7dd9413fc29bbdfd

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36db6e9b0b01dc8011524b135590dbd9_JaffaCakes118.html
Size

23KB
MD5

36db6e9b0b01dc8011524b135590dbd9
SHA1

e5f9aecf1680d606363874a19cd5f045389eaf7f
SHA256

e77be8286f34c46174b81f8d27cd789deef91c890ad0607e7dd9413fc29bbdfd
SHA512

111ed2c0050f2a5e39719e9e4a9fd30700e635c887f40251097f85c4cd960eb6ac92deee87159054afd0b6c49662964b75294d362d7c4a5e3eb7cddbe66ecf65
SSDEEP

192:uw75b5nfanQjxn5Q/mnQie9NnbnQOkEnteYnQTbnNnQcGLnLnQtNqMBdqnYnQ7tX:TQ/mGaDA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000640599d6d81df61c266666a506fcd7f1c13124c73a34fe14734528a2d035cdda000000000e80000000020000200000006072f8ffd0f459ecf52014ba7a2f9793b086372a3204c3dab0fba8594527ea949000000059892493db8a255aeb6f5b20766e2a8fec0b0401494bc1482073c65e94dacc83ff6b4bfe44b442e555b0c3c94c8bd041398141d3c6b6991ebdd72cfe50192738625e8a2ed6e34b54733d7adeb44c51a17aeb33baaf7c6958a4d1a55cfe3ac3cc4b68baaa95f9e6f976ac52823a9d25c7e99f941e27360ed373825a0be6e92e8be6d402f70c453a247e5e367072ed140040000000df008fba34ff909261b59f7c0dcb00ccc0eac2043edb90495c51d6deaa06edbb1ac04252f03dd92cb60c473fd1fee888b3c9e2b498d294024c7e7100a8807bb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421628123"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33E85BC1-0FE5-11EF-8840-6600925E2846} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005c3d8b8b1dd01128e0a9c726924565195cca2862a69bbeb213fc27931e157364000000000e80000000020000200000006306841a6e6946b0b43eca8eea1b3382e5dc56978bec60262061dc7ef1d27ac620000000e768426d75d7a0870d0e58dc9ff014babcf0bb46f7c94fcd7b087ccbdf4eda85400000006cba2597309a21ee62ea55f3d94f0a421dbe415aeebdebef5727ca2865659695ad6b04356ad3aa795161e59370b0b4eca097c737a13a2cfdc870fa01e7e8d5d1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a99508f2a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2728	2264	iexplore.exe	28
PID 2264 wrote to memory of 2728	2264	iexplore.exe	28
PID 2264 wrote to memory of 2728	2264	iexplore.exe	28
PID 2264 wrote to memory of 2728	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36db6e9b0b01dc8011524b135590dbd9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb81d1d35f74437403c7e02fa359eb4

SHA1
a80f90de40361629faecada9bbb7d69ace7addbc

SHA256
a3f7da4bfa8a9ebcb188c7d14e52a4c7be45c610bdb51ada052f0f2ec6722a80

SHA512
24f8554f54c8c6c4f36eb84c0d7c4eb2f36b14d46f76cddcb265bfb946314a81e84942163c6fdcada4288dc22524ff216ee77be70c10230dc99a87646f63c566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72095229f2b720cdfa1e5c85a10571da

SHA1
504d91188f7ba5500f35aa7fad434ab3b8a79472

SHA256
058a488ec2b250e07b874654dfc984b563c5983c41f39ba104b5642e4e15886d

SHA512
38d409ce9b98baf6c21bb048e7720c650044f1e388617681515b567ab5dfe462f5031fd252b4cad5e52127af38e9b3797b950757ebc7c2c53cf3b33929ddc917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
199be35fa9701e260f399a4942d434e7

SHA1
cdd35ec840d96b3892e176c43acdcf49a3cf8862

SHA256
4f3a5b288cd8497a7d2a640059537777e4c7f21fcd786bc854f7d64a1851d980

SHA512
d5deab16303e3d3999edcae981fc623922a254ee2c6d87893cff5f5acbad4e4a55d69b436fc830cc86ec495608653b9aff9370378865dc5c00998311574fc1e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9da14f339348c115a0c26e3d934501

SHA1
b91ccfd6036274b03dcdd4010902eb23fe79f652

SHA256
9a7133a7e2de19d1cc5d00fbf17b86c8940687eaf995875faaa26cb8e933f3e2

SHA512
9b0e061cba8f519a62f02d383360547c332b20b772dcfc4b9f2a6a106980c30d198761a8faa4e344ee6f6a945504da88d5b92224df0ce1b8241917b99c6e0127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1463f987d3856c1887ad6723b6af5e6

SHA1
98178acfbaffe1c9fa4b8e9b148c36e697530e2a

SHA256
d47c393536b2b6000240b288cd049d60ff1cf9304ef82b36a840888c101a796c

SHA512
43c790b0f53baa7b0ebeefa4ebf68f90a53cf8d22dfbf1a1991992db44c209aa8fc62a4ae82ad9f4fd387c66cf6c96e402e3c33d561ce9981f4eae73eb3c3259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d722d085790399869b290d1d396c5f8a

SHA1
e2ea7cfee63d89ebbb6f382962f91d0bf4eb3eee

SHA256
ad9e9d8555ba02fb3b70bca96a8c6aa362c580a95726c24e377184ecfb82bf07

SHA512
95ae2a7e6914325e2eadea4f48f841964dd1ee815244d01fca41672c74de39950e9aa165060507a9790bcb9cd32f98e7e528f354ba0ec6f3cd7c74bf07f5aa4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ab67dd5251ed6fe7cd2be5df280f0e7

SHA1
3953c957be92101dd212c95581c54685fd58538a

SHA256
eb6fe648281bcd36c732a51483e2bd82d930f907d950d7042bca4528022c6af3

SHA512
d6e511897e4e4bc84c7821958b96d1a23accdec2277cc17749aa2ba68adcd97026452396f804b410b5010e4a6548e3e1bfec2b09c299ccbc67fa864d386d45b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabdd8409e3ea95448a4bafbe79e1c46

SHA1
75fc0f76d4635dc0217d0b783861d9eafaa89a2e

SHA256
d42335df8155d9f4813d5b5ede7038eeae247d83ec342b3d45405139a2e30504

SHA512
4c4f0d265ad1b812d798890e7ec971f1d53d5cc3eb973701de2d6d8116bc487e53edf74c6471ec0c6dba30b56c68de52119361f4c9fcf27a8159a8ae9e2ea2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74a2d94d793934eace7cb71a5a99d331

SHA1
1032581af674a535fd24e0a03eeead13907cf3b0

SHA256
0d76ce491408fde12e3e4f2a3659ecb768a21dd0e7867ebbc9a7558b73d0238f

SHA512
8773555275988b0531fb3c891cb0e04a04592da766c0c4bfe953ce28df5e013b38ced724be86bba3c199a121ae2a72a84ec63c40461d725b24cbf21f3ef66e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a27b62995f3693a7e24c279882de51

SHA1
284cce1643ec2cafffef03cb3869be20e8ff2731

SHA256
430a137f4e12b8b1c6f140fe569506fe61fc9692eb7b223c00e3de828b5531d6

SHA512
3c141fb347e7879ec4c83e5a30ee0d8a46464440888d242b08a8bf859277f159513110935de8c76cab64c99c32ddba739c269561adb487a4a9cab4e181a2c00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e14d6acd332ecd617968f01f221aa8

SHA1
be047e94026aa039968f67cc7afe75cd4a731a24

SHA256
c7a07d02fcd254f6fc8ab1905d81250f4ab1ec1672205c0ed88f922c694b1de7

SHA512
04a0d1b044990455f8b81d55424c91ca79be5067100f5ee7704d55b8d978c2ccad93da8da1fb9c93a7e6ecb5751f7b53d0790c73d6abb45c8ac1d0912091e6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2879.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29AA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit