552c055b2ea45a19c4bc52e62a78f00640394b5ad1143070947113530657fdee

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

35cb3d083f61e2a1e91298f7217ee20e_JaffaCakes118.html
Size

61KB
MD5

35cb3d083f61e2a1e91298f7217ee20e
SHA1

0a6735eff5d5a1d69ff278b832eaa29ab876ff36
SHA256

552c055b2ea45a19c4bc52e62a78f00640394b5ad1143070947113530657fdee
SHA512

3c3659b27e24c829e74f2fb51b80f5d1c1bb4ead74c62c4db5ed40bc5707836ba5b6932b5d44040c9224091d513659e7560b22a906b9c9421b187d12f9621675
SSDEEP

768:JiegcMYUcXGeCSXuhDmDaoTyZCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5nnt:Jg2RtTbec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C78C201-0FBE-11EF-AF55-CE46FB5C4681} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f72d21cba3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ca8478c373e06a348dc0b57ba4dcb90aa99693496d06fadbbef24113426792db000000000e8000000002000020000000d75e4c1a6869e5e97a18f63ef2183c484972fbce50082ab6f63b07009a37603a20000000ea9869f71fe72d046e4d6e9be6dd335d5f9d0ab024f0dc90482a23ba958627f440000000fe03b18acaea3fd2dc3504bae7cad8d0174b9934d50ee9c2e72a24d4ca6c303bf044f6e92212d719a0d2d27862d3dece7604e98ce1b27dee78ca41aed083e0e1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000cf42b2f9c2237d1cdf86ef245959e64c19a05c77f7c7afa4bc76f643fb969409000000000e800000000200002000000046898b06e98fb4e18e63b8595f854758ddd85ca4bd6b57911e801515b7ec00bc90000000d94f1cbf7eb2b581daf8090c65eb23fb185c9afd3cdd4cc987e1ff34924a4daf246eb69fb3423ef7458f412c943c023d8b7f392bc98f2b2549ece0f60d28e7a6a1720376bd59777f63fbdc562bf77574b5e9591a53fe0209f3da8bf113e6db658fc5e2ee0f1f9e66c44059df6bef58954702dae05fbfb60030ec51b72c8fe12914283396e3819376defdf8e0279a7db54000000050642e6c6e72ae79fe1daed0d62e5729f4a32c733ddc1b520ecbac66f8767f6120ffc7bed9ffd31aaf0198ddd02e8d5188f181af2fd131c7c4431c167f0e60fd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421611415"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28
PID 2984 wrote to memory of 2660	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35cb3d083f61e2a1e91298f7217ee20e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7094db6075e167a116c4b01c37250524

SHA1
40074cdf79bbddf849b12cdc9c18d5a00992d302

SHA256
014c4789a18b384d1fa68b3cc04b4fadbe8e888eb2880f5fdeb3fb458b877f8d

SHA512
1f973bedde5a602ec4eaac6dccbe64e01c7b5029ea81b8c8fb881104943de20872ff6b446c346e06ab1b0871fa6ae982ec10635d7fb01019ab40260d9cf78aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad14bcadbace642b52ce1d6eda7714af

SHA1
a1d618dbd7fd308aff543b80b9badb7344901380

SHA256
512b9534e8f5d48704e932e626fa89fda88f8672deaadaab6f12a232d89246c1

SHA512
0f322c8bd03be2681ddcc76636b015fc51de04f4d4b75ab0c9205459ec51b7ec7428a2567bade3f302b7f43a3d26edaeb1c25c720cf60b47be74a1ddd7d86eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3f02763734ff2a59a31f3b9e59efa68

SHA1
d2b0556c572aa9190a7f66621cbbe758cbf9865c

SHA256
aa83f78c8fa7757ade2e8de239aa6d229fc1085f7bbb230b30dc7f98dc3ee084

SHA512
acd6364a96fa81a00887525056bef0645128f124d47be3458d79c1941f4e7f68d79c8e0ebb49f4f50825e9090537bf2396fdab06c58659c92b53f02731a57ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92a0a6dcb796d5a6c349145ae5ee9b81

SHA1
f599259e2a8b9d31ee533025ffda348829a0271e

SHA256
82067199843b69e2b198e604d0363be42c89fd39f8684895fd17eab32faaaa61

SHA512
1df703a779c76a2353957136b158de5d28d88b6313989a83f34494479b807b739af80e8cd486782efd4cc358fca28b7f45b35a9a39918beb5c971408cf706b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e05f26d3ea248b77820c4842cf9fa7d

SHA1
9c908d6260b353be8ebb19d4d9b959a42b8aabe6

SHA256
7cd9d3391e89e5e7af000a6e64099ddca824b836bc006f2d960e987e2e8d0672

SHA512
9663d31b4324a207636c7f217bc1d7034cea2ce85feba118114f620d094b9ae5be142ccf0d98b81bdf1cd45e68593b8ae3153e4813827a4905f4602bc8f46702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d0c32f38fbe2053efb6f7c186cbd2e1

SHA1
cf19a70a052946c440b946479ec68c5d9e5eedf6

SHA256
146e9d854fb8bb885aaadd41e5b5aafeeebbd33e8716e9c828d742dba0bf625d

SHA512
31c8a446f0657c2ad1fbd8daa0dca8b7f8cb72953530a0252b3e634acce83137b3a23679eac851568b537cf1f334c3caa87f6b304886824d9d1a7d3d877ccdf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19005c09b4b2a2da9a88dbaf1c11544

SHA1
89f36d40fef19c55cbda2730151870f14bbeebe6

SHA256
1d2f0fb22397e008b65a111deea1a042079bf1fcbda1cbb8dcda104614a2b04b

SHA512
7e6d0ff0ba995c9ec4ee9a283761ca6e0e98e21b6a653b9e61ec17eb73bad7e113d80051963942cef6ec8868236a5f1c363f360267d1022bc76f0ce68abaf10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15128fd9fbb5e49c0a4ee316e6f2f6e1

SHA1
063f6702b1e5380427d63c29f4c941b343b47142

SHA256
6da1a86cba0974cde60ce939af1f7fad01f16343e10f3d725bc235b67b21bfbd

SHA512
af7fdd2cec45373beabce852668c1f043b4eb8fa80a0cad5c03944a755fcf53479a1ef58d6dd62c850b4d02ea6960ba59dd2f85e6fb1046e2ce5a7af12407d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30e314baa0aa0d50f0d1cece008d13f

SHA1
9fbdc050a8ba107c9bb8e5fd54057a523ddd8f1c

SHA256
b3520f1cddd0dde493152f5c285b9751902982664ef34e9e888b42dd5c1456f4

SHA512
c871419789027d8332c83de097e1a4d990a6e518767205bdcd3b8f21b53571d9a3d617b2f87119a740e6f3ac8077a1dbe9a3f8f2a355a92329e9780916ce8ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8c91287b1cb500a1f7984ca9da297d

SHA1
1280de3b422454b081756c2b2179bd72b029eb7e

SHA256
1815dd486231e9068fcb2f3be8a7af2dcdc1a51e260bed1e8ba193db8dd028af

SHA512
03d99a633e072b4749b50e7ec17bc9d61bbbe5f2c64f3359303975d4e2a337883f9cba7c2ad33ab650c6205f4dfadcee9adcf1308ab975378b9ed4e9eadf1419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f4ea885d131e4bddacebde64f0ddc10

SHA1
d6c00ebd8f1dae1d6c4774c03baa991abd5b6fe8

SHA256
e27aa9c222bb65dd2067b7cdc798c94b38273435647c6824db4e3c2d2eaf53d2

SHA512
c8adf8b7903ba1e78b9ded68822b1d3168a851183a17179270629afddebcb5e2e1dbce2512d56152cf28964308dead71ac97c6a202e86b5178ca87777a314664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e57b00844fdf689084f0e04c7313106d

SHA1
401ec3147a3dfa7b2abf0dff2c4d4ce2e89e3fd7

SHA256
c04a6c96a1cdd5ef5dbbb19a9b5ab0c688c61063ad953edad1cb9aa4a463bf4a

SHA512
43dd9453bad8bf674fe8e17a7c962b74348573ba4ab7d05a571461492b00f8e07f819a7eb71e1a9660661f21cd278dbc4bca0833e755332070b1afa24b4a66ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a35a8effc6f3776cf92f5db5f3740212

SHA1
c42c80faebb0c494fee44d2f6c24f877286c1d5a

SHA256
c0e7f07eeea0c6912666679cb5fb736905708a154410e1ca60cdb3c31f5ce002

SHA512
9e7aacd41c2a6a1e234e0379f9249e05c8eafa2467767b6144ab75aa5dd97fcc39780d3db9e728c7e510669fe1946fcff46e366feb88166db697441a73f82eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a1f057eeb9cb59a7faf325b9ba7f662

SHA1
58b112405a326e6f4ea21ed5f9fd4463808e345e

SHA256
1dfc92508bbd97152db2183f4256d38f07dbaafbc099421151986f37a7383f15

SHA512
c78d89bf98500826b390128eb9d6f52eb611192bf5c16a19c9f52622d229801dfd78dfb9c9bec35d2d444258c649a8a486bf3117bbc20904544ac4061fb6cd0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fef2aab60bcac65e18308290a50557a

SHA1
dc441c925f207e6825191896cb305f578e0ff423

SHA256
02a3c96bd3e44c51a1d8200335622a0abfcc8f127241871fe20bf9357e5c0ad3

SHA512
51355a1b0a98a597df4c61005cd950b283d0e3cf49ea2e1c1e064dadebd2540184df1243b69a1fd9ff59a263660f486f6a2167a7d4435dabdd1cbd735696dd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22EF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit