856dccfc8622d75d23718b309789dc6138e8e84baab49e23002eca59ad717cc9

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a69d9b59e91d0c565ff55129589c3f_JaffaCakes118.html
Size

14KB
MD5

35a69d9b59e91d0c565ff55129589c3f
SHA1

ad95f1c70625edd04c5dd4d67c15f944605e5bfd
SHA256

856dccfc8622d75d23718b309789dc6138e8e84baab49e23002eca59ad717cc9
SHA512

1323aa908e95993659f204c827b3769f4f3057a407758e6a0912d7e67b6ac904ec1137f8ad0390fd3b6d26f95fd5e38f6d42dc081e870d4aeba4b380bc5e6f74
SSDEEP

192:WRmDyQB2JZWv8NngBsErJHC3LW0JCRIHrZwCU5zgmfqyD6ZE00uyiSMKnsfN5Nt+:WRmDyFQSIvui+mFpgXyIodvZeappj9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09f9dd6c5a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B70241-0FB9-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a418d819ba1693c6474ba031a550e675dd368ed0985e4efe9784a314509267e8000000000e8000000002000020000000275b086983c9a68ed01203c66f3c25ee9636472d5da26c3fb5427d7e19acb7bf90000000391ef31a6b0116cd8efad6a0a8b2b08f397949033ccb70f22955ef4b9c96a9bf0963a6ce240571db15b9fdef061ab6f82bb69f74d8e284891ebfa55d335b6aca5b6b481ba2080b6245fe605595898cc5b38977bd3971a66de08c93f3c3e56945a89f3fbd3cff0699ba929299dc88565c17d8a35eac82fb49563c487a4512335847a5738e032d30baf671d67311fea41b4000000002de0f4dd06fa0e382381aeef2d2253f138e671fcf821ac2ad703a336ee9e393081bf03b424478d685c9305ef49cbf5f896ce7e08771ea9ce50fd1fab3e9f69a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421609141"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002e56ea5d706edf954cf1bb2c9f57295c10cd2faa65b69e5ea17254485cca4fe4000000000e80000000020000200000005906d154c7da3f59cba5cfdddc751f91586960965dcf60facf0fbbce398da1e22000000053e8e917e6d21cd8d1cf90c2f6e5c0a9c55540289010e423829c0726ff627d6440000000f700a6059827f2c1e7f19330ad3e7de1eddc700a0b4fbc9a93520c3ca5cc1fd6c59d12eb9632639d01dd2e745110eabfc448b26bdb9058c7d549341a035ad2e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35a69d9b59e91d0c565ff55129589c3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9be0975ee6fe18a0ce1c3f64e111240

SHA1
0f1e0c314043afd640e0e0a36e7080c7c84d2016

SHA256
b0c0e233a8d45f489ae0cc75ea420bf9797a0e573fdba26d5cde700f1ad6a4a2

SHA512
6e9af70961ad4aeea2594ad85af5a0f8a4e1094acf723261d940955d4a2f86763c6dca023e26462e5d915ffd1bff1691d909fecd177d63904163fd5e0f359362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ef4e568605044d6220d9189b8de89e

SHA1
9ec42fe9e7ebc787f52960df0f9eef3ed7207800

SHA256
666c22d6843f02c96305bd2681279eb5b1ab983eca2e85bac513bf2dd2047d64

SHA512
00beaf4642ad2729f526ccc18aa9d54218398e617fe45367318e62cccf98c36e3657d9cc194f2d3b432e62221485719416331a6ba5841b889df8401f4a6c396b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21037fdc5955401376b0bb40c52ff5ea

SHA1
88d58d849d9239e18ea7c500124e8e7a8711354e

SHA256
fff538a0a96d9735869d9aefc05bb87f3147e0fcacf1161e7a35ef5e7dd8c0ef

SHA512
f6c238b49fff940b7820ba5a303bb48c9f6e54e1abf396215d9125087febb939e103d23a7dd2b5b0e8c6fa419f58630925b0dd2ff574b4dbe70f56e38f38a53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2807c62c86359651967fde2be8d0513

SHA1
b02abe056068336fe8b9febf95db8ce925c9bed0

SHA256
b36997204ccf663325da3952112d30697cc7f5d86302fc39650417d7ba398908

SHA512
3b9ed07729cadf81cd48f782a606068b0d6e6d9fe6c350d913d794394bdaef14aba02e3deae205bd1330b0ce4f9248ab2d961f6217d35fc82aae1f0edb564686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13477174ab115fc9dbf18bb86de0a0a0

SHA1
c7b3bf42118eb65d68afe2ab053f479b65b93341

SHA256
0828eb608ed4f40357dc5f07f54bd271db3823429fdd7ad41cd5cc5a78b88103

SHA512
737e913be034dbd9ee336ff2a832934cc4cb528773a0cd0bc43afb4a1d4ce5c13699254609ecef8821c7c1fba15f823cec0412aea2790c91ca0a3fd79be786b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05585c30a06298234b8b349af50231bc

SHA1
d004af48c2d9ba6ea69c4391670f714b48de8bff

SHA256
a0f2bdf1f0d12462361368649df4b16c132cfd87bc80fe6e09912c005e0e4c5f

SHA512
100b26827511b146bf1ba173c036490eb1130eeecd9f76fbe42994c0dc76ee0e61db114ea65c43517ea896236e7cf94f90ccbcf0c8c1d9b4ba985aea42dee3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
951faf354c5e72fef5616571cd4da4b9

SHA1
7170609b2f2bbbb4abdb95bda409db99d49bc5f4

SHA256
d140c7eb83b5e021cca5796fcfc532259332e586d898706767ae0411e6ac95f4

SHA512
63a1f033c6ee0b67a4dd716f41a1b70741407a2c6562d91b5379f5ff5d3ba80e2c19a883dd3e4ff30e8853d9caa5478d1ff3aca98b6f1aad9ac570d2078b57ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bdd6d9c0a81c19b584a6f0888862ea7

SHA1
da1584d9da24dab3f49f3c84b729686859ea08e9

SHA256
547421b6afd26e383c8071fa6fe4c6d9f8650c8a1b3e961a7435e27ea746c0ff

SHA512
d600acb662adbd985e2ba7451bdb409a0a11d1ac17d0d3fd88b15c533b875fef363bde7af3165d273f1a47d12f18a92f64e7cd4d0dbeae5588cef662189ffee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77153aca4a1138530c7e8f5f65052ccb

SHA1
c349a5dfdcb14b5a3af5cd87a106c84b0c55c0ea

SHA256
b3eac29cc9c6176d7baa85d23f185d5e319e95cacf28cd80d2c5495d7f954490

SHA512
37bc65b01e8145b5e26e43064850640a2d4707a0a4a0488e45d44545f798b5a567efd12787e078edd4f0b1a1544d587c0dba78a1846f5d2326cf5964a2adfb53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f816b8490ce47299e035220872999f

SHA1
f72933d05a0d6184d1aa463f5f74e80dd25d7373

SHA256
d40cd2d9e0ae5b262ea427ef27a4c928747ff0f6f7132692e4fe788ff4e14fc3

SHA512
f4369ea667324d814d43d161710a3c747973857603f7e0b401a1a4805b6873eba10585163ced8639d979aaa46139f7e22beb1a50366fcec9e9762b6b8c00bd13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d51da43ddfc1a211b9e74db31a0b5d4

SHA1
9d3f24cb7f344f52176bbcd71bded55f7873c268

SHA256
fb6bbe82300325dde402038ac7466d7a3cf0e5a9502f45cf0ff84f9c3cc30cee

SHA512
5ef25f903f728a4b69a807dc68e9305f547570fc6cc95ced7a8d9a488db94b4e3dd1142c73b8f2ce4a67ef1c4714013e1c703e0b409a12cdd209fcb214041414

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AFF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B61.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit