fc3f381bd19cdd7817733dab0a4f5fcb52e4f78c9c032a9c667a9826e70c533d

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html
Size

69KB
MD5

340656509ad59a1f7624ee8ef711297f
SHA1

408de0a5de519bbde7bc6c1a2e42c36ab4e1983e
SHA256

fc3f381bd19cdd7817733dab0a4f5fcb52e4f78c9c032a9c667a9826e70c533d
SHA512

eec834004a0e50940bf05a7c452520cc2e7f9a2d32eaed688176a765f03f556415a5f8fea43732099cc2d873144500d8e9709e22aa7a01f7b60e02780f1955e4
SSDEEP

768:Ji3MPpgcM/cT9WDr99DXOIAzPoT2fQC2aZZ1MdtbBnfBgN8/oAOcRWQFVG8c//IZ:JQHZ5T6P280tbrgaYcBnz8PW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000d67c14542ffbff171b721914513d43d755fff1f5049594f0066c0e9af2c9f45b000000000e800000000200002000000068ac49ad83000faf8d61b31a2e0bed66d4099be00107b2b2d4d8d2c94ddc30b02000000086589d34d20abe8d69c9c437ae8e2063ff3a820a7cc02a301fbf0e0b7c076fc040000000326f713b28218eb73b34f6b583c39e8125826e76fc7e1dec786e4615f10510c776598bbfe0e87b2f8a22c1c360c040ecc351c18456b1a9470a7a9fa952ac02b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c185658aa3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000adfdaedc59618fe19ea308e0dd6433621de2b7413723fa121cadd1efe8c3c60e000000000e8000000002000020000000c609fc33a20d38888c086f396a6b6f50e6cd06d0d8de80f7b7e876028f5af2d0900000000fea0216612515e3b5a94d627aaf96196e8dbbcc13ba19a7f3bbfa93eda3fa441b61573af7851908a2b3641ac95449c80d4005623f11cb082c7597345c853c4594c518a6a687126649cd8f734076f2d03ef47ea78adc3f7bd7d5302cb95db50b16377f769f15678cf3cd4d698f2506063cfec6e8a8dbaf8e3b1a15b03c64d26f05a13ec0e1f7340c46c63970706764d6400000000a38b3a79433da05b1fbd9e8da4caadf95f3078c05e666d0ff48435dc8ddd99b3d138d995d80a023c1d0c6bda1169ffc7fcda74502ed7c31aa18557bf38769db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90A40661-0F7D-11EF-825B-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421583612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\340656509ad59a1f7624ee8ef711297f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acabef21b34b9ebc80342bec96d3361e

SHA1
2c445ee1bac74b034ebbe21987eadaf2bf127e4c

SHA256
f25f58c181cc9ac06639a4df854f4812700181f8f594122869cfcecf68af9385

SHA512
bb274501362dc1313cd924f2bf850fbb147f3016bc9682073c6d515b2a91ffe59077d0b68420761a166b248bce2a7374eecbcc0fc022581e7acec0399620dabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3940b25df8699207812cb4a88770c40

SHA1
817619dbff07db3fa7c29b82384515e2739fbc2c

SHA256
43f5d6a728799f5bebe1d195ab48fbf6041737ca3644ba8b0fb6aff1f4fa46f6

SHA512
e4cc3eb1ebd472b6e8701f2b02e82a9133a6c55bf460b6fba83616c6a93e5f73d1aa023ba9676dc626bbc1f3dd94db75d1d91ba07b5c00e4fac12c5a459f52b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24f455fe97e999a2d0cff2b8dfd2f1ed

SHA1
e16429855c8c51c93a745e41ad085b740a9db9e7

SHA256
a6298a1e87efc9831f6e153ed75d9fde8a1a7a77007cb8371e695cae03d72c55

SHA512
e49da9c9a68c0a0d21af6b59018a5a18b6f35137befa1c82ae41ce0c16762fba50d5614bf33da62c2e37a158ed91464172fc1b01bf973fb2007df372f891dc0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d57c38574ab98a15c8b5acfb7991c19

SHA1
ce4c707689110852904e323e21133f498233858e

SHA256
ec35ed3099c4566535ca253de67f918cd77944def6743ef0a8488f3522943e2e

SHA512
e075f297f8c470115f9acc202536fa9eb25f5d248f8f5544dbd61f612a8c55fcced7393314aa405b610b1c9a5fc641b0c69173d1f8a50f4aa12e4fc596d245f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd66676f81bd535cfcfbb586eaa8852

SHA1
4c963cdacb9cda8aeb3546b97ed4ddd647f395ca

SHA256
62266c07e2c688f365575fca84fbebc0f32ea63bbb33c5dd8489dc2c69aa508b

SHA512
1a659e5d363cc9adcb112d300095ddde0b2d6636fbaf269df9509a5216a27f0c544ef6a0d49026c04393ff4bdb3523427ebb059df5d91e1c4ddb46b4f8b3706b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dab3dbabf77fa1ba60b5a5d70d5ab93

SHA1
5a57e8b999e9b20c00e0f4bbd30ad55da2653074

SHA256
76ec2dc30b6f778f704bc6a6ec746d4477aa9bc4eee6abf97f7429dcd56e26c4

SHA512
bcc89eb35a78e9b761f5ae51871be1e16448860b9500bf7f8bab7341557a2f421a0e96b3c17556704320e76466e69b46e4c6e095314e0d1b81a170a22c7048ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41795ea1019063d608b922ec1ed3ff77

SHA1
9e6c7801cd50be950d7eafe57ab27473b900b658

SHA256
fd6ceedf87b900af8b31a871217d17bba6b045c1eb9e4b1ecc52a0e0cf6239bf

SHA512
0e96b209169b210cfb200e95de9f297b94fb5d759662e1da3141e37288dab03dab54db84cc53b4de864646afed56a63f315b29fcd98ca321ecad80cf729818a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31b225760d3c34eb8d159d1697a042b5

SHA1
5030ee854607d3c58379e59b80ad5394cfd25ccd

SHA256
0a2798bc6031c2af9fd0fbd1508df79e0d87f4b890defeb0bb1b98ae3dbbdb91

SHA512
02b051daef7c008221ef26e85ef633f9ec261f168ba47431cc4d85a0fa9c3435977d9c04c53741938970e236512a5c4e5eb176304e43904bd88c3ed8257fe30c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e72fbda81ae77d22cd6352dceb0ea1

SHA1
16308f6e93392d1a9514ad7e70c6cd8c746bfbaa

SHA256
9d824395fb428e133af9f4108f2d1532a1a3af07847cac1052998ab595de67c0

SHA512
7588c264fbefbe2859b01310d546e7c4f5d8da94740543be54fe83ca34933daea49a2ffa51ba932c7205c5d6eac448e2682f6fd105e1d1eb0b19e37ee836c4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93646eb188a9d0e323256d44cf2341e9

SHA1
01fbc648569c2a4e813213bb2d78781b4fdd1b10

SHA256
6e90e812dce40a82514b5bdc745f2b33eff125ca9df4a86e1263338688dce9e9

SHA512
b071585751120881932c42561924e563d678ca36e56fbc2db0382a78f4a0d6fa18c75d5a968ff6173f5af4449eb9ce24d01309b7d728ac37d47a6631500989b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353331a8966e68340783c4d4d773f38d

SHA1
1d8c93eddfae23d9c91f8baf5f7dbd0ab69ef38d

SHA256
e874ae4b676e38552e91b6b40ab2b47966e6ad3983a29d54eb7f1f50361db79e

SHA512
b40cddd46747ab4ad8dc5c3d85aad007b5968624a51cf1397820debd1104b353570ec6da7415c68052a5009e17b409dd8ea826f6c827773c9e7c08d84624ebf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4a4446ce8b3bc066ae075657d739ed0

SHA1
9bbad6c94829433336bc3017a289365a8b7c38bf

SHA256
faf820914dc470149d5fb2c4421aad38f21ba01fc5e748fff513a644449aa030

SHA512
136d18f23f863eacef31eccdceb96f59ca0a395ddb74b999c6d21384824ff24a6a228a2308aab49c97ae59522c70c4d7f7ee2d28dc6c8ed39b1b2ba9a5295890

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4405.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CF9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit