728ef26614f9f51bcccadf76bacdb28b5a08f7ce4fd36d39c6f5e49a8f523281

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3431b3adc866f02f92084cac8f7db654_JaffaCakes118.html
Size

139KB
MD5

3431b3adc866f02f92084cac8f7db654
SHA1

bcf310e904aca51a2dfc2a2bb80a848366a27266
SHA256

728ef26614f9f51bcccadf76bacdb28b5a08f7ce4fd36d39c6f5e49a8f523281
SHA512

cb7fcd231c029a0cd9828bd8e36cdb4af7d76eee66f6c7abf71c7364eff8fd1aa1cee95b29344564345bf4135d0b9164af168eeacf47c1ce4ac692881a8fb480
SSDEEP

1536:STlIVck+PlEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:STzSyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000010e2fd36ad5bb6703da89a49884744ec003a361f6984e1d77c290702bd249eb8000000000e8000000002000020000000803b02a2cb234a01fe3f6b7bb09837d5301f06149c1e4c1e83bfb0e11c914879200000008724fd61c5058767ae65e9bd820b590b128ee750257075450a66005f05420edf4000000071b6d3e9850e76797bfeef3089402437da7035c7514d4a9c28188e809d4a11a8007b17781324af2999fc5f8726f6ce65af6f5faf5f191dc4e71441422de4e4f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10849bf190a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DADCBAF1-0F83-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421586316"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005c97b0e8b4b2949ddc79a76c2ef4821650dcb00d32be837a6a7fcbaf77240f69000000000e80000000020000200000004a3fb3d853b30b9453464ddd35793936b84ca7cbc917ac05139316b7b032299a90000000613e37896d8ff7649a3d86c7df417cbb95bcf41fdd959d4075cb61f9555ee14070b24b69ccef7319111bf750370ed46f01176b2e46528f5aa296f2d751be691d60eab9ddc1821a906a6c468a7b54091756239ef0ed4dcf3e1452956ff1aeb055a6db4f4cf3c6de0902604d536682a5ad55144fad709895e008d2b9ba80179ae7cd300bb25f03f29da99f0dbe396191594000000073910c8477eac7ef03f6ae04f9f9135be24ff3868a01bc60ed4003f1cf465ed3e0c3f9fe7f814b41efe803739d4de29bf5e05b1fb36f3e71286d6f29b25691be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28
PID 2020 wrote to memory of 1384	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3431b3adc866f02f92084cac8f7db654_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3816abe8eec84d387d0cf2f50c8f5511

SHA1
adc6174f3570e36a2dbbe2dbac1e3a4f0a572f3e

SHA256
b727e54fa3fa03bf8260f4ebbf52b09668371999c65ceafc3f493132867252f1

SHA512
b27bf42463a44c0a77f3057b073e0355590114d1159932f3627a0de7ea49d04bec57187083ff071a609f4053e51e939db5263794e1c5970521c1f6821b406fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6877799dc5c9f57a661508cf2b31cafe

SHA1
d8e3b0a167acf7022a1d41d14dade5ca87c722c4

SHA256
d4726631fcfc4a3eeb4d4e597bf8e8330e6fbad2ab53ac31a4b4265e277cdeb8

SHA512
b218cbbc9960e7970b3f90b37faecc2a97681445a725f201701ae7312c04e94c667516a9a16c66cf0b9b8c17345c2b69992318b5def4d40290adcb748eb97558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca36e6e63d451dafc9a8a6e4f371aa1

SHA1
28fac53e461ebdddbde2a16c84eb2f81e442c878

SHA256
52f72631e08fffd83d10b2b84b944a603eb7856715271d4ca1cb128a89c3a778

SHA512
0e3251b5784cb13e3e58b533649ba18b391388f8670f0a6a1c3a717509c6b265295bf72f880088f4775175ccf6fc5b2bcded30964d37f882a93701c91a41284f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da105416a46c8d03390ca380fcf167cf

SHA1
31e23070ba129ced615c237438685d16b4f4d77e

SHA256
07e99d9a57ae482ca2cbccd45c0ae3cd9812c85a8c4efa0c77998ea514bd2033

SHA512
19d49247cbb35891fcd52fdf4ac7790ad556f13f81e7677cbbf05a874000630b981a0d4e21b722e084e4e2176afe77d3b950464745078a32b6df33ad3bdd0090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0e967ddcdd2adafabb384582930c45

SHA1
b13bd1607a8ed682eaef9c884bd8219fa08bf61e

SHA256
d470f355613a693044180955f5b1d1766fa2f3aa2a0e9f82609eb9326b41e08e

SHA512
0bb7834b313f448abf55a5f25769cd2179d46454be42495125ba3ddc8b03679ca4c39c17592639291aba416d4ff1790fcaf291ac55d7b26e9ec7896ceb1780bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a19a185a32209d4c2f12761f5292b94f

SHA1
10fa86b015b80fd44d5e09a02d820d687cb62c1e

SHA256
0bec3ecc543d021080540a6d3498cb570eced3de378083df85e486d0329b8580

SHA512
61a5a22fc3f1c669679f038f47a696fc7fc50f02a65e7bc7a725e0c1b242c8be99e98a1c4797f74e6f35f739cab963fc208989ca6feece1e128d5236eca32d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f48db66932cfa3d66c67ec3de1efa68

SHA1
72a78f56c1221da7bd4323c0a8dc9b6c1aa5aeb6

SHA256
1f5a133629e37a5a2c74763c6cd697c08b4f2d7a023b46de4ac92e2ccf8459b5

SHA512
495d7e08e1abec5fcf1a1732e0f7376aab43310213972119ea7cd1bc13e01586afb3c2294ca93d6d5d2ab3b66183e3158d3cf9e1fb750c653f40e83fa19de1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9edf2e6a8c5d178e924797cea6f892

SHA1
1ab3501d133aa41d7bb99b49d8d4469e7925b50e

SHA256
185cbf977ab8f19064ae5481d161ea87fbb16fed47ae7eb50452085f36b908ff

SHA512
f984badce91f07cf12fd3bb8e408d6f308d8219335533535c8b2cc516cb4687e45a08d886dff011445181ea2184917ac94c3976dc6af3f2a999c3f02894f2a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b16009e89c74aa54f52d37b869b0748

SHA1
61d34139a9a450bcc0c2670722c834529dd58e0e

SHA256
9cd907e47825c7430ddd2f2d2dd9c9d90938ce3fb8d8a775f9be2a424751a124

SHA512
9aeaacb97be314466404f7817eccbf25b10b0a4bd6b13afbbe28c91c8307cf217138d67710f13108154eac1bdb8102fceba9e0ca1ae7505bf5962ee697d45f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A60.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C4A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit