967361a6d445fa6b6ea890d5f97853238bd6ef4a685b8a36a25306f18aa676f6

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a4be77d3b6dfbeff3f44e2538af9cb_JaffaCakes118.html
Size

139KB
MD5

35a4be77d3b6dfbeff3f44e2538af9cb
SHA1

a63a3f481472d298f9d0342551dca62d0db8fcba
SHA256

967361a6d445fa6b6ea890d5f97853238bd6ef4a685b8a36a25306f18aa676f6
SHA512

7edaa2abaac9b5ccd277a694036ed4525e2f08af2320850404261c719c88c63fcb74c449c91d486931d7c87d6a42c047325a4918934d3d4041424eb97d56fca2
SSDEEP

1536:SOpCIeOelwyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SOXDyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00055addc5a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fa858c09a3bd9560b1d6f44cc0e490245d65b19d8d4544de8329ef341d476172000000000e800000000200002000000074d4f1c0eab01213a5a8cf12a4f38c242c35ac5f5072568bee6815822af009322000000058652fa9e0a97e10391119e6cb7fec453d86f02c074ba92797f95c0b9de704d8400000005efb91fae037c2ab59a944f2d0f827fcb6de72f4758fdea377560619c17116671e64dd0b67f067b02d6f60da525943cdafc63fd1c34b6741501844abd2b52eab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f0ebc1248358678993b09ca532700b8730ee5b9f4cb495b3850d2c40fcbf0f36000000000e8000000002000020000000b117b1de781a3d7ba625edf5a2a8ff8c96aaea1ca8a0cd5300fcce2ec6c2a120900000005dda1f78f353d629403def752688c779127742e8ea255aa9ac30cc05a9b73206250906132ab0cb8831e63c0dec20e4f82c566f8d30a7618b0f7acec59639aface2fc39ce57752445ab54afeae3871185d1ec8cb2e48af6bf405220a4c9b3b449830d3da3913243417f2d1932c4ad7c919656294a33712b8917d27377fc236ce48b0d1fa5e564a186040e1734955e0c61400000003e338941ef51c99555f4b78b3dd5738c5dfe730c97108136133bbcad81b92478d0da0ffa151eaa5df086408a646ed1b379bdafddfeba411421de5d0fb980f5bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421609043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C745BC51-0FB8-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1676	2452	iexplore.exe	28
PID 2452 wrote to memory of 1676	2452	iexplore.exe	28
PID 2452 wrote to memory of 1676	2452	iexplore.exe	28
PID 2452 wrote to memory of 1676	2452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35a4be77d3b6dfbeff3f44e2538af9cb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b459561387794b01a6e7d026551030f1

SHA1
f314d2ddb782e727ad36d46d408e562f80bf0afc

SHA256
d1a229de1bf74dcf5024085346fd47700af81c0f2c9819168af7d8e61561e412

SHA512
e8a8de208e58deebd156751ce57d4381f6497c1d16f456f1853764e597858d212a229f902e2f6a95c243b6ce7f2c46f3a3b44a6b7340a0834ce30e34a7c33b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ba4f4df7e48ae86bb26bb70c9fa78d

SHA1
481767387fa7a925d77e26b96a949f8b3bd1991a

SHA256
bc40bcdf13c1838f4371ee6a67d57a68f3b62c28e44376426a632066cad358ee

SHA512
65e714680737253aa41bc796e9a9bfadbd46718895571db8fc2a4ce0720af529e55776a111613627f2bdd4dc53e84b9c0be126215474e5a0a21fe0d454c3eb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aad465265885cd10cc06d2eff10b702

SHA1
44b15c2f1573f6ec917d5e918494bcaf281694c7

SHA256
96d61e9449f5303850bdd18344dba06b5728256beb277e210771fe257abbd9ad

SHA512
1c0f03e4d678af975ec95d2630fd54e715cd5f2b8b6d3a5fb343f6611fd8716e0de26dea44ffe5301cd65ad28d43cae32b38606c56c4b02df58e706d8655b68e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c5177dfa4badc648f6e141ee97101cf

SHA1
81d997213c8fa40c8052f738b827f7838ff98611

SHA256
25d3e181005e13e975bcea47ab5177b98bdeb0016c6bb244ccd211645ae209f8

SHA512
86cb1edbc44d8ddcfb6822345c5b390ba6c17f067fd5eaceff805b6f72efaeb0fafa8c417a9118286114f3c423bf01aea27402e40ae1ce03fe7afeb1da23474e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b59c30096c70f61e7f6a84f4e71c375

SHA1
0d000bc2b3d4d00d4ee4f7224450dafd013b5245

SHA256
9c96f99da24e1438d0d774780d538e69e3022f7e6ea9078f974fc604d83a8cf6

SHA512
28eaabde9c38e3b896d9165b090fd5bc3f73a9793bbac94835e87e621021bf578c9285fb3492acbbe14961ff4c6e4654754f01d62385f126be82b03b43892278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5508b4720c207365635e0af13c972733

SHA1
5914a40af43f087dfc43bc0bd694eb6d4805019f

SHA256
7a06b724873ccf1e3d62fd5e025c05f0371779f3c99ac167543ff6be966fc52f

SHA512
730d1e96d6a6cd66defecaa1c5b5cd3b14767eef9fc200d7d6a464617c59d32c06712a5625b50723f1ddd3f3365622c3d8dc413f6c19b2e8303d7647054bd468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc49111fe6c895c03f393cfee6f9980f

SHA1
2b66265acd50b89d10b6667a4d7c51eaadbb0538

SHA256
bc4e48890509254b8c4bb6f26eb4da3368d68aa313d6229dbee08cae1ea1755f

SHA512
afec3a3a6dc2f8baab382ef11172c9361d6f80d8a0275cd99aeee1b6b576c43e87b2f1956813a1541d3a15d39f2de2c12860a27686444eab0b30bb27c5334e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab9ff36d2d58fbb29ecebe20cf37cb4d

SHA1
d52bd33160b09a3d32d23ad0fa2a49e98d767993

SHA256
752095e5862b8d62d51916a762db7a28c8491c67e192fce0981fc8b45b1d0af5

SHA512
4224c80d6197695bf6ed00f4b02e931db675eeb33389412f88e3d45eab296aff19d328c9a953afbda2378261d6da8fcde72eb89ac2f819e5e88cc136ca4cd2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81466d66c7bfe924544e9d396e64a66

SHA1
b5665f8630ea0ec977dbe2e348df9ae155eaf54f

SHA256
994abd6096a28033053455363d7f3190e1e7a10b75f250789f7a8afe67373a32

SHA512
3333c1588ab26406710843a255c48c076bd53bc8a5849eede7048d83c7457f7bab0e05b6f4b817742f30669669e45d9c2b486768ef5a82e439fd08d8b6a83080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0e95486b88e7bad5cec8ec0f87738b

SHA1
85b28b491636ef3405ac6dbf143b8a23920dddf9

SHA256
f5357c7b2ed3b116a6c8df0467c5e2fbe33747c2f13f7c3cd77d3ffc49afa61a

SHA512
7ef1bc1d0c4a7e876a01b10890e1b2cfa1dc2e57d38e75b90f32f8bad9638f76bda8994d256eeafb70251787df7b1e3afc21d374038f2a22fbdba5157ccac706

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit