e0db6473df059b2355975b4931eca5219556ac6e0532f497debaf571f6006593

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

35d015ecd458f2c6e06170f33230e988_JaffaCakes118.html
Size

23KB
MD5

35d015ecd458f2c6e06170f33230e988
SHA1

b2fe38e37b18b56892f744ce841858fa0e317ce6
SHA256

e0db6473df059b2355975b4931eca5219556ac6e0532f497debaf571f6006593
SHA512

89bc499bd2693a37bf46b388d7a818fc99700ba411248dd75bca26adcf4347c8542bc1891a496b3935ea9176fccf258d5de2919c7ec613956c09222dc8d48a92
SSDEEP

192:uwrob5nR+nQjxn5Q/cnQienNnPnQOkEntQSnQTbnhnQKdjPvMBHqnYnQ7tnYYRgM:QQ/cwBWn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C819031-0FBF-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60283af1cba3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421611763"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008c66bcfe80d2db3bf081ed8c050213d9512d632b6bb4429377063ea8f10f47ac000000000e80000000020000200000004e84fefdf629d7105ca8b09ce6169aa362817c16536428b254393da495fbd26f2000000033da54441de49dee34aa291d458aa1f53b725302bb06fb6b16cf0951b8fcf73840000000196f6f697b812e5d2c137d16e01c0f9cd248abb7e9c7e15fab4e267c321169332ef1b9c1119dcda8011468285a3c3e8b4d94b1b99c8bb04abfb277fa513169a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a3c056f969009e01e3389ec673479cbf1c1251b8d1ac87809c4053089f6aab9f000000000e8000000002000020000000d34aa3b56f2e5ae01a3395897adfbcbab16b7b64321033774ee8c798ec408a0490000000d1db86ac9faf6bf4fa28d74f3d8f13a1e6be4cb407aed77975ded62520374e4247839006e5577669f25c4400105cca89a4a3f164393534afb58338145ced5ade3ce7c7f2254efbdce9657009eb547602fad47f5213d8b289e5b68c768e3edc882440e77209d19f57fa0dba8b610512334c69fb55ddeb38d1d149a831e72cf5ffe964a6c21b058b81e69bd2228f6f7c42400000004a9d4bbefdc7e67353195f9d4a447f91f72a1f6ae578ce21d029aaabafeccf06a145408bee27444476a621ae350f3f44632ac0c080f5a4ef8f54f5b2528f6bb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28
PID 1752 wrote to memory of 2480	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35d015ecd458f2c6e06170f33230e988_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8cac3bfc297cbc347da31394d46e02

SHA1
653e4cb580e611cae1da93eeffd7da62cbce024d

SHA256
d911fb2b785faa987b7c3957aa9761db682514e677481d0b8d3c39aa9a07f89d

SHA512
a21df94d5fdf2e864d7f28af44f4632b0f2a1cb809011d07129bacd2a280579335ef6a99fab95c678c534350f7147536773bf314f03aab01359f8a45849ee544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6728e6a68f586c534264747c75b2294

SHA1
598dc30b72e0007ab71607c1afd9d4258e5d30b2

SHA256
bc92a4a0fb572d73fef4ff7c70e378fbf09bebe42f0d56b0a829f842f41b12b2

SHA512
efda9e43bf3b96cf8cdd599c1d47b9848a5333816a357a68e6d028b96ebcb56266a31729a67bf82f8ab41488c5c044448120100abec95b3a74fa7c40874e72a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15d0eb433a89563d74cb860df422d8aa

SHA1
5aae808bc54215fad3dda38c5f2b857d3159a401

SHA256
04b89d29f852d6306497a1cc4b88f490bcdb604cdd0f1bd58c62b486cd5505fc

SHA512
177b68805c6eb3d5f26236c68f3b5e6f58b3b9876d6b1d4b24742e0e0cd6884b74cf6c2cfd5867062e526bf62dc7902ad6e36848f48789cef5e865b22436aa65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfad6330c9cca69288cc59da98508b49

SHA1
38608464d4df5ec65c9759c2445fae4294b9a04d

SHA256
6e27820140215b90ef6e7075d77bebc46338cd105aca3a9d2808c9b01da5ec73

SHA512
cfe17704bd99216388c1a54f4707915859e6ceea0635c9aefe70760241c9b549a50ab3c3d74ffddf3076af53655669b657904c7e22b4ced64a84477b522278fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12beac29b839d9657c462d11f59d45ad

SHA1
0e4ddd8be0bd4bda7b1dbb0c6fb113d1e3375acb

SHA256
f38fdb086e700a548a5f7d938c266fd0e5cf07da4d541e35f74aa108aae6a052

SHA512
7381bfdd11074c2dccc4eb94b14da93cde3713e228132bc22491178fd8dfbf42fe5f56472e8b3bd5aca5490ccfa1094b7984a185fb8534d0999c3a171106da0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c505196771554d7b86e7e2fd69e409b

SHA1
55113bc86fef7a9542f82aabd2f62ba3eb5600fc

SHA256
74c492b359bca5b842524471ee77da29b480a0043c3c09833c30f1c0b89ed546

SHA512
ea443dea180bc4128e1b6d24f7300c8e669dd42a0e2519e88a381365ac4ebe3eeacf7d20221a1ecf84fb8df64760ae1b8f0ecd7d1a756aea2c979df6ef148ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d712f94d3f9f95ec7062eea2f80c5e1

SHA1
20046f60741056ea8389d9aa6ec484eb0315df58

SHA256
f92ee64619e1c74835bd63445ec5722acb8cb020130eae4d8b8d4df614923ef4

SHA512
8b01ac1faf6da114fbf2bc8ac9214ca854a64061d807c9a0ff8471b5d576eb27bb9c2ffd120c2c0baafa91d0fe5c64fb4739fd85f8c3bb7b245a8401cf7e6a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7f895727b7f4918cfbb73b81ea8ede

SHA1
7c873e6925a5ab608410fdd902911580abd60703

SHA256
bc56c358c70e01d24d5a5add417457699e0c4f0f6e1849669346dcbadf31c084

SHA512
afd4a774cac1ccdd940bde41874a2981fcbc0801f6a8452f2060e33ef7883377e07b99cde30a64835d0d0f7726b6b8b4277128b25c128ecedb41430d3d20c705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f492acf33f3d7da5e75f3d05d2fffe8

SHA1
06ba6cc427157d2a4d73aad0cd91bcc33799d394

SHA256
682c262d21f4b53e64c287b3fa3fea3a8acac82f71c08706700b0e878fea1be4

SHA512
94497678623c16480c34bc8a0cd94e857fb776db8edce4955b54ac8aff895f8cc176157aec3f5e41ab628bd1e4d3654cdf9621219b9fda5bcd3afe152906aa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49b17eb4fe3956e8425c89b2ed4c327f

SHA1
31b71441ad1f075eb3ab520d4292fc8be67c464f

SHA256
0b12903f48bcefc6d6eb8b0e0db91d27deb71d456949b6c4d13becf4cb12bd41

SHA512
761e3fdf8113c7f3f903d47f8b418594cf7f1d37ac64febc3b94e2b3a9f160795fdfe442f05f30827ff8354473d3b36095beadf15c3c2872618a3667be96a64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fdeed966a51db27e6fa3e2036a8ec8e

SHA1
9d83a97fd386f9b03d5b0b2b228819a8276336cd

SHA256
cc770167eaf2aafccf078f23c18ec9bc36a187bbd406489442bd2183d0a00ac3

SHA512
b7cb238261916dab055f4ec8922ae40feaabb3c16192da727612e85365e1fef223551cfea086b9f07d139220f8018ee4041c46d2fe4aaf9980e78f703b5bdf92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32805587ea7424eb9a7bc6fb30c5d985

SHA1
bde5074c52344650c9cdf77291e29598d38f929a

SHA256
fb1bcac25154df90929d7c8c06461b450b124ed87819eeea32837f1734a05358

SHA512
c5009fda0160693e2376dc193af80bae1be5eb52e6b3e8cf98b0b2163684791ee127dc50c4f62d04cf8f28d8d2e51dddc144a4f4d6cbb2188cc7d1a247af4643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d94993edd12abec33732365ed381acac

SHA1
c0d0c11dd22ec49243331659f7728008388b76cd

SHA256
3a14e71fea5466ef438413e706892457d4b756a419c391fd57a053b80f297ec9

SHA512
d3c913479ab18e8f5a8a6df3a8497691b6c5ab970d104cdf7ba0daf619a33010bb5a6f7b2a0d72e72892cedbf5548fbd00faa4ed9fdc67217f6900c0d8ab9684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a5fff51dbd7d0da2bea109606aac17e

SHA1
c6c3447294544cb821c1a1175d300f6d00436b85

SHA256
1a959e67fd9e64e87d1a4b27503ce7fd629531d3b54cf936a0b01caf97e40867

SHA512
f67aae6e3ccadd092e8ab77f3d31e9e135f2101be24c16fadd19381700e8b03810f099d80219125829b50a3ac5371f888b3a2a36ffd5ce30d7ac82ef36128de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7684ea3d608e0cd1c8bd0aff215ec64

SHA1
c8233fd367462c801418eb09cd337c346df168ac

SHA256
fafde76f5ccfe8f9cc4ed3b4c06cd60e207668fe6aea333df1b0fd5e37a7283e

SHA512
cab3fc95238ac33f71f687abc101d3a39fd4b1a05c51a464f05eca9e0ec3378f3904db39d1ce76da14c79c538141d85e5b84e369e86b536840cfaa544e4ba2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2436.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2458.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit