2576ed7913e90edc9700bbbe60a03effef9667c9bf1149641f608a08d9834852

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34d278b96ec39d141edd4af5c53cee0d_JaffaCakes118.html
Size

23KB
MD5

34d278b96ec39d141edd4af5c53cee0d
SHA1

7df1632f03c619dc8a8fc6e6c703faea69e89aa2
SHA256

2576ed7913e90edc9700bbbe60a03effef9667c9bf1149641f608a08d9834852
SHA512

c103da75f7303eb0f85b892eec9b901b6f4370afe049ac65a81cfff6eccc49d1a470d85e357ffc44d23d7f8e2ebc084ab1853b6e460e6a643424bc80bd17b001
SSDEEP

192:uwPPb5np+TonQjxn5Q/pnQie0Nn5nQOkEntPHHnQTbnxnQKdjmvMBUqnYnQ7tnL8:6Q/ENg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003f1477cb088028aaaa14ea7fbbe3b189ef62950d2cfbfd184aaa0f9801bf3c8f000000000e8000000002000020000000779802f385b0006427d3dc84a0c5389615f169944fb851916413de9641a75ca9200000006452efa01b9f695d6c8ed0a4b865e132df13e7ec7ceb28968d131e5f7bd9d30f40000000816ebcf76fc750f3c998dad429696b298b8dcceb058d98e3e3080a35b644d7f91afd7bcd27ac2e830262f73eccda2ef156390bec6c23a747bbfe968d1074f428	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421596210"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005b6e89a961362aacfdcd1ddb2160c99f74f6b196239423c5cbe08cf45dbe4aa0000000000e8000000002000020000000f0415a74448e50eb04a965eea12edbaa980db5c01cf539c254926ee3211643809000000099ec56a56981e44e8f696f7b9b3821ae240d0003f836f7893ce46c069aedc0f4a7735637da2b4d0e124531195cd57b75e619c92ca7c10a8c3d6cf83654a9510041cead426ee256095d26e18c33eefd5c444697bc80d00a55f92781eb9624549531429e1f781df6ed2e8e909daa455db34892d8ca0e186df639123793c2afe2350b78ed5a12bd64c10f0880fdddbc924a4000000037f1d4117d67971e8f79c3d6189bf67270b8ff4576a8fc47bdf2e9a35067e4863dd82acf57b7260f3adc62d1ac4addc2348293cc90c61d56ab631b7915000e61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E598E6F1-0F9A-11EF-A5B4-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60eaebbaa7a3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2360	1244	iexplore.exe	28
PID 1244 wrote to memory of 2360	1244	iexplore.exe	28
PID 1244 wrote to memory of 2360	1244	iexplore.exe	28
PID 1244 wrote to memory of 2360	1244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\34d278b96ec39d141edd4af5c53cee0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91759ae4abde6df782f45b2af7224990

SHA1
d744847876b1182bfcad28e4ac7ca23c8fef3344

SHA256
dfa5534f48146fc8017f448d990f1fb2e5803f9f03589ded829e54e697aeec8a

SHA512
c6b48871f744a3869b621e5f28aa758cea44880318b27b694fe07fdc26118eb10dce3ec19743b6803914995f56df97012ed7d0b3a0a39d17b518f623f4bcc354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc907e3b1fdc11b48b383410741f6865

SHA1
1d3869b644e76af1c159cf66ce9495e87b287acf

SHA256
95b9399aa4a6263860c5d288cf5e87bbba869da6ef0b78e1c6fb1798796d2156

SHA512
c1ef110b49e8b60646f3c6d65d8977b8d73e49ed4ac01ba1b0601d9fcd1a29704ba7356437a818a390cc7d0421bfeb997fc17000817ab9cff365e2eb9fff4f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e5681efe80c5a3f731930e28801520

SHA1
f47629ae019e43cdb015f0f422aca5bcb6e71448

SHA256
7003bf893da6266935691df0947907fa17e34c81edd499f19555c2cffcd1c331

SHA512
59f506c74f3e356449acd8f705dff4da8e328af096f87125c58a6415c52aa761b9cf872ac7602529affe8e1bc008a056e8f7d201f62122a384ed3382a98ba25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a887b34b94febf5e18157a1c418e4c36

SHA1
ca2def62b31ef194f48cd9a5342b6434bf626b4e

SHA256
808e29e85ef2333cc39a118b52faa00cc01ef5c80b1f96d718711946647a027a

SHA512
82c72ca49141fab2f29d786dd9f104aad0985f5600400d8572f1d10cc9d16097a1f55d6057b98af6594cfd8f46dd74b83d6135570a0e38da56f0e652619d1d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814704446dd48c94180e8796d48a670c

SHA1
5d5ecea74db278799e51c55677f49be308e5e1ed

SHA256
3d720b60f900bc99528f1516f004dbcc18a5b2627cfcff38ebe02ccedfca34db

SHA512
d0d2c653b19716bc2dfa6574343ab94ce47f1a80170584135e764c55d04d1164b5f8431a7cab3e9c7584b54fd2c92c41c63cae9e7a8ec5397b6a1f5cf8365047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7496414f128de052177ffb44a5a2b96a

SHA1
6c35cdeb0627a48ded1a7d9f4b59de6c2f88783b

SHA256
6c4a617ee946b11cc50262e4d8e1e0e9870304ea66600345a2b74d6f28ebaf6a

SHA512
06c6f902b116d21b6c523e1286ba9ea7dbe6de848871e653729304c9a04de9aecbb0fbbd4af30ffaa3dbd0b08597354b741e767399a821c3ac81c65f27adb8e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3aea450e9f45643d2c1438daf930d17

SHA1
9712694f2ea4ef69c12ef8b28416f2f0495c6afa

SHA256
5deb7f16dd4391693612a0e741e28fbef46b3098a5b1eff56ea422f345f764ab

SHA512
633070a138b4925d5d8bad78ea36172a37f656ade470e8414425f70d821d42eee23080f36ffb6e964b3bd0dd9cc09538efb61a91be7e481b865488268f240001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
316c33c7b6f250475f18eeb03a6ed839

SHA1
c01d798e306d54d31b7abce2c3ca270705f24d2d

SHA256
602cf6441fda9409fb87ffe91529c58c1c9416029d03169aa1808109a0f9dbbb

SHA512
8836a958c91cd2ecc6cd6f4fdb08dbb0c7bb816ccc56c17ea538c72f6fbcf7238581cd83f92073dfc9ed223aeef3e2108b9fbd742bdb5f7c63773a5edb84663d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a258058d8bfbd56ecc3a821f07d6d0df

SHA1
fafc72f9e2a33de36da821f4c5e7e33c284cdab8

SHA256
74f2028e6ec5c24d3e7c8cab05dafaf960d41a468c972cff3aab6fe1285643fe

SHA512
7cafcee3cfc94fe03236139f7a61ba329ce6d900dae23e1d87032cac00d3fdcab4bd165704aefa7d48b628ea34c0c33b3efe745d7060cf32fb223c1606d8a9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31131f8e8e379230e7cf98785c472416

SHA1
68cfe2431e472e84651818b4ab990f3b454cbed7

SHA256
2ec598d5a70ecec4159fbb873ef30fe8df0dd42b0a8cbb70a4121e7fb6bc230b

SHA512
9c5d31c0aa40ce06a3ee00e0354c7d80194340a78d465c9ba79744c6a8e287be237039758b4c3ac34f8f283126e43b930f33b909eafadfffdb0a9574b6240c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d27d2afe93cbab73998483b11784c961

SHA1
e74c49af68d421b40b3b88ddcd14d9fbc466011a

SHA256
ce0daa8f97d9923e85c1ae9f55d2cc060d84a1dc94db0c360f8635ffe703d1e1

SHA512
08ee1294d4c08199a8ef565ffdc5500a2879c300760bce992f776f54b84bbe8f830d2b4c26d2d091e05688c9d7601be739cd0505f2a647d41debe579e55e1c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b722b896246b11ece72dbb9d7fed43bd

SHA1
3df07155e1f21cc6272da576aba0b376dacb0022

SHA256
60d83a844ded3adc584c0fbda5c8dd0826d9e4b1747b1c8e2f3f1a67a719d5dc

SHA512
c6c2707a87da6f2c27497208523bb7b47d910b3847f4815d74fa6d282a38f1863150ffcc2a40ca2aea6d357911976df09a9f9c3b16aab90b081eefb6a613ab43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33CF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3421.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit