0091f43469e6c2ea6a3ec6ed57e7443a86408e97e59ec8baa98930b8b2ebadb4

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3433ca120af08529c325eb017724e13f_JaffaCakes118.html
Size

22KB
MD5

3433ca120af08529c325eb017724e13f
SHA1

477579eafbd2ee0a540ce8e508e5ba7790bec228
SHA256

0091f43469e6c2ea6a3ec6ed57e7443a86408e97e59ec8baa98930b8b2ebadb4
SHA512

75da12c544a4d10585d10c6dc5ea436455fec6e11d5cc2ef856a435105b1cbe1b424a6ad118890c56311980aa74e3e0c8cf0a02cb733836d6dc5e512925e660c
SSDEEP

384:cVA0/edn9ELY93La9uLc39PkL+9tLM9kLE95CLQx:cVA02GdML

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{161D4761-0F84-11EF-84C7-4637C9E50E53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000721c0f3508cefc4da21f1602f7a52c665b9809ea2e1e6f848fc104a2001e62f7000000000e800000000200002000000014abaa4be85a3fc9715355a760b177c4c551a29c821d207e0c757e318b228ff5900000002657ec85ababcb9f8343191b8e5d8d978fd50055a8d8cb21115e33577108d9dde437058994250d73523ec2a8b46ebeb74067e99bb4229de994249e89ea9d68898ba492db14dbca916815e6ebf5c3a0a64411c1f1560542e1a532b3db44e30c1543117ce65dffc5fd2e4907c160578ac5bcdb49d6a4cb1254b3c10ac3a8c3eda4eadd52612ab1a9367991cd1035dc2b5040000000918a61486bf803ec9daa70604a522a16b912c6033b2ea590a70d9d505b4a1fdb2595dc846a8bb9d6aaf1d09cafe3dcd2f4c824df5cc141e4705aa5161e4eb93c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03908f090a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002f643fa53933c3e52b40d99496406f9c8acb62f72f0b775ac7d72fb2acd6c053000000000e80000000020000200000001a36955f1295c8175d03a4e9bb9c75edeb3eba97994d6f8a5c86dbeef16c93ec20000000c9c5a9779b7c7ff7066b50ca93fb13c446e27528b80cfca9411462426ad926c74000000077755836270ec8b7476a6da1aa0675a6e772814868afe35d7ee4f6324dcbe8a875716c560d96b732102098695ab72829a5dbaeffbbd2013f2088befed002a7d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421586414"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28
PID 352 wrote to memory of 1636	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3433ca120af08529c325eb017724e13f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0da4452127de1e6deb9faee6cf35c7

SHA1
58316737a1604fd95cc9204738054cccca0abaa7

SHA256
3a0db0564bc8864999fb2d248e9462b896283d5c832f31b24b4fbea560bc1f11

SHA512
8d1eaae649ee0d96631cb51ee089453f0e81e712209e3690c77fde49b06b346d71b38de1d9abc1e646063931b4e059aa4043b8be0c0f74f0b169c11bb2d7c412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9ca4fd31657e91936c91c557088d8e2

SHA1
a21955208d8f698a3970ee613cb28ca7fff748dc

SHA256
ee7c484ca118cef278feb7e1b18e55f10fe7d36868cdddef39ef38aab4d93258

SHA512
c7841337847a2c6611cbbed2e92bcdb200ecc200cc35d95d14f6567ca38cdb0f351848439951b47e40b8d175ac9f6f53705cd11b36257543fb28e08b49140acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88d06d4274f1579e3b8778b4b59815e0

SHA1
d2bcda0d60b89d715fe9d7395647cd5a10907cc2

SHA256
7456f01c6c94106f7b5f47c9062443d0f99903bd59c258ed5d1b8da16d0d6425

SHA512
65793fb176f6be8fa2f0d16e12dafeaef7014ada1486b6cb36ede3758bc605b05ccf782616ad48e4eddfcbea218869c837ca5ecab27a982147d922099675c1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3432bc11edfd59e061a1eab84bf56a

SHA1
c13331f061c17ad89171ed0f529dbbba66b71255

SHA256
888f143e82751dc243c78afc70a004e3e65d56eb57938628d5b2f40712370d8e

SHA512
c330e1307e729853ebef178356542a9c42e6164df36de907c276dbd0f119dfac6a28bc5f769f3c74272878bca6e9049366aad73c20269caf2b69dfef5ce45643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf38bd6714661185f5515ba5433275a

SHA1
b99d474a5cc23291ae25ed626cbe31c49b94b0ab

SHA256
5b2ce7e7f8780bc3f9150b4c81c386907d8562b3335b7a11e47402ab864fbb67

SHA512
4b950caed9b81a828bdebe6f35a1a33dc1690c9672fae6a1d292832f17cfd8a4a3e82623c2b99d0ad8682239d8f450665a3c342c24599bef46206fae563064a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e5c2b2ae5c8f2d59171f50acb58516

SHA1
6601b23a5c1abea248431b2ff20e2f79dae22e93

SHA256
3a0d25da54a704ef041fd24bf2678068b94a9bf7e5462f8ec6a92e7a09265aaf

SHA512
e124ccf4ffd71152877546b28660a5b861b6e15edf13f08d8803ab783607f624adbc3e23d4c39eb8eea6d8e9def3720ef9270a9b36ffe1926f4e7a88e5fd3b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc27727aaffda10603acad40f69e072e

SHA1
91e6364315eae2dec16d94fe0315e8165a73e69a

SHA256
a31b2c5d0036d56ec8bfe72b50c728af5c216bf63698e9401e407f8f39a88e6e

SHA512
84e13566c9584f86f13060824a003dfeb7f4414e8902b4375f309dbb4c8c96e37cbf9fb719f562e99763bb216a5342b2c57b110f2c3cdd049d59ae1f659888d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a7a8efde8ae3888e2ce8bba798ab368

SHA1
371314fabe82b81ebef73464f4f73d9266a0c09e

SHA256
f670ff2f003b67ac7f63e5d321d01fef929519245c2aa19c12d1d85504a73bed

SHA512
6eda65539b4833793e1001365e110c384b0bb941f1a10bbfa661c1b7fb056263561421b31c02648d7925e33fbafa9bd03c1b3456118bd37a4cadb7abde05710e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae84ab084aa9e8a6c74c2eabd73b2cc

SHA1
d05c4a857b4b8a8f4b88e6ca1de0a325bd671ddc

SHA256
0e7b6db247260c6d3bba0390fa8070d539a337afb5875e3f40a1cc7bf5e47891

SHA512
3b96acc41cc9e4a4ea6651182b8c415eea735e1e626334ddf4510a8f9494d016efa102c87a44b4073b43178cb9b9988518a0e06de428375b9c99f90906141aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e044d6e94cf78f99e9a19f871848717f

SHA1
12def239c8a33fb98f7e9de40fccf87664132301

SHA256
82a9316d3c000b2830907b97b28c9598b157cd20bc31f07eb7f9fd717ae2f880

SHA512
13820d46bc59bb01e6d7d5af947d1160fc300a83d48b64f8bdf176733757da596f4c69b7c299124a2b5632ffa1f824f12ae0439cd044317ceab7e6f4aec105f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c199d5905e7fe8c1ad7de4edbd09627d

SHA1
3d486e1bc6ffab7c4370e024b4bb81a26a73c5a5

SHA256
ab0d51da16cd8ad824ff2f72a63e170104ecf38277ebe290785f878915d2518e

SHA512
5df99fb0b27e715075880915d6eec2f146cfcac2fa511f071cd9feb6ab3bc78fb3e388f54c709f2ba53a1511c6051e4e0381a7e4f3ecbf0d685173885d4323c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4868.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4908.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit