ae7d1d44fa5640b5f12b033dd2c90f70d382e3d7c8bf89a1db26076ddf04688d

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d5db687759fcdeccee483d1f628ade_JaffaCakes118.html
Size

460KB
MD5

35d5db687759fcdeccee483d1f628ade
SHA1

e4c9cf18a56f804edcbc7e8339320cce65f89332
SHA256

ae7d1d44fa5640b5f12b033dd2c90f70d382e3d7c8bf89a1db26076ddf04688d
SHA512

0bebf0bd8bfe1034f0d28de0cd3ca1cf4bfecb8e672a22689a2eb3325f0fcd09fb4931552392180506871abde046c9c4c6a1e4b7d5d8439f8b864d8f57727a68
SSDEEP

6144:S0sMYod+X3oI+Y+sMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3W5d+X3p5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b9860bd38c69218aedbf7216f05f8c487a03cb8effbd891b01f53a724de2f2c6000000000e80000000020000200000006a391e5545fb6b772f97168799cb553bc2a2b9ce375292f609c5b47b97c27593900000007201b91bb41a71d7abe34ff21b469def8d1258ab8f1f52f1c66b19880f500fddc7a9ada3a88915d99e655736af6b2817b9962f0c1bb4bf84383b8012584ea622d3e78477f13155afa324ab2bbda464f6e6e9c0110c756648ceaa04afafc26261a631eadee931e8bea276b501d0b8d1683122e36156ead83f1a58e7d54c7e03bfc8f1c354eb4be7e9f709867b8aefda9a40000000d52c06df72e2ec71977c9c4c23d116c258a06102ef3153215f630680a5e228f7734429e9bfc9d963e35601841588925554d47060731dddd8ebfa36c78aba1bff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06f49c9cca3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421612120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0B93B01-0FBF-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000eb568f4a1daebebfd49e7c0ca94a441e3bc4c628ab100bb9ab374e19af2568df000000000e8000000002000020000000a4c2023aa149d2829eafcead3f47c4d921fd6b77e2c02ec14314209e48b5c1d720000000733612b8be1b002bad9f67a0540c00807b007c817837d00f5506d97d523595ab400000005eda16c291edbaa828a76a7eea7c4a21d449a3e6190d58404c47e437fd4a706bd423ba33da506f917c150947e6ebc787ffe7c60fbc3f4ea980157bcc6f78ad6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1888	1276	iexplore.exe	28
PID 1276 wrote to memory of 1888	1276	iexplore.exe	28
PID 1276 wrote to memory of 1888	1276	iexplore.exe	28
PID 1276 wrote to memory of 1888	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35d5db687759fcdeccee483d1f628ade_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc2ea58b6326d33ac921f0a5a59603c

SHA1
25929157c8e77c2bfc939315466c82866a6dd2bd

SHA256
c27a804b516b9dda511dabbd17092f1a5ba5913e9914b7d9ab9d159378199ceb

SHA512
9475285754c9dc5acdb23a01bfc1c459e0853110b26de2c3d7f838ebeb9720ca3353ae3d3303f6308104e2db5d3c4cd9e386a829abbd9b4d4ebbe41b0159f887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdde9a68b2ec7e20960db7265105aae9

SHA1
3273ba92efd6984f0bd0c6c03802b4e8e69a6d2d

SHA256
45bec74d2b668ddecb0897b5916ae58d1add0e0cf4a8d96d0ed7e77841cab21f

SHA512
d4d95ae920ce7aa1e93a507092d6123c35faa9362d766195150d7fee5238fbe2d1edce89c1ac19614da49fd7b7971e82133bec18aca2790894e6fd5ad1974b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90befa2158b7f5eb467365afd0a814c

SHA1
7d8cdc1929c5873f79e211455263d13f9d6513e1

SHA256
12b2f13dd7a9139cc21464518831fabafd1ae9ebe73b6023902c61fcaa75ea3e

SHA512
eeb44fd86ffcbfffffcf7a0cde6228301ee114bda9f4f5668e194355c524488a41890b08a9f9704b02efa478be6a2ceb4fd0fa7dc67c0e1b107b0b0161293af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512da758183a7bb0dce96fd7b7d887b3

SHA1
5020a167517ac3d58c230fd02257f94726ee54d6

SHA256
2ede7fdc4bae795344f8df3cca0041a047eab0352aafe2a8a8aac44071a65a60

SHA512
8f8cd3c5498ca75b8a997743ab6b1b09373f691735636aa6195553d8af52cd4708b4e1738a8fe9c03300d75acd86bebc0237e865fa120eb9b042f64c418dda46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d4dc13806c8b78ffe82e5d3e071a8c9

SHA1
62a9547096f31963252d62d7840c94e237a2a204

SHA256
a58ceaebfc396b4de87458ba2eb91c4afa02faba16e4eaced56058881e549979

SHA512
c1ee6bf79e784499cf5fe103f1a01808186e80c5e384837b19f305418d1a277c8b52fe48d1b3969a01bfff5dde607bf7cc1b9bb6eac1c702234a7e03e34d6180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594ef4db0c4426fbe99c311e7ea90583

SHA1
9fe1325671940dafa3c668d6d515f6cfc8ad1443

SHA256
0f4ec79befa9a635d7128e575625c88125c1b4d8b0f7098704d53a41b3d33b67

SHA512
7d79b371e671613f6ca18bace57b31d30cbedeb8f6e26b762dc6f7dcb67cb8a8d5eb9b4712368a6a0cee28711eb4466e9f5fc770f28352959432ee8b82f9e7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ad9ccdb9253316362bd57e54df5b84

SHA1
b22c361b074f7216fea1f54c93cf6291a95e9336

SHA256
710f6eb0e22f132f8258110eeadde911cab249df027d1d3d9e839bf4f840245d

SHA512
fec5e24099704a60ba066b791ea92c2994e9f7468b8850691e74f0fe3d4091be0beb2814f699096780bded12ce8b368d765edd7c65adc76877ea985feb9950a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5040c1772a4356040189fe0c46f53e7e

SHA1
4905d2f64d4c9fac303ed5cb62f70467f47ac180

SHA256
58a311f470eb2210d85f88a08628a13f3ac15a6f1188bead545db935899a11c0

SHA512
0823e19090be84b45203ec200d3990c0de33d38f7f2642e0d47f8b5518640cc8e7bed4aaa19df0d215e7793a394785d6650c2bd991dd607eabf6550d286f08f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460c93eb0a5404454b9578af0d3b4a24

SHA1
4e1bc654790dab016bb5b060e8cdb24e605ae6a4

SHA256
4cded05102d2cc3a1f84130585edd1ddd54ef18040a681eb39d800d5f5fa44b4

SHA512
d81f69fb6a61feb0c3b803c99e7bf64dbbbbc4fbfe0375c5e24648b87e4135d5a1fad2781559dd5a9c39efce7c68b3c93f4f5a324148b72ef7ace3741bfb6e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31ac177255101cbbd9971fcd4443a92c

SHA1
c2e86afc34cd8470c19ea02cec3799486cf23010

SHA256
45ca74342055540979c401a16016c7c9068434873386c760be888deb23919e55

SHA512
ae01f02913c529c3e46b51cddbbe2e28e1d8aabc7db78d471b589c60ffd160bdf4298b633b77c76bc658b3cc76ed9b4db29fd7fcfbf8bd6a93f9def04a05f2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb699b827d9cb2e7f59f68a161a44e3

SHA1
b8d8addbf1bf843c84ce6645ca439bf736c4bdda

SHA256
cee781ab30c417039a433dd915d5ad4d17a5f5c9adac51990ebf8e6ac3bbf8ea

SHA512
2d0fc857a1f058b9ca5d4c52543fb744e1ea710003d3e856d252051ff7411f1095fd16412e46887e0f91179d60c825022e216a53a57b88f2b3800e2cc53ece89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93483fe6c3e4428ebb7944bbdac22f7d

SHA1
5bd3410aa6e9a56439a82c899d6ebcb3038f7ef1

SHA256
1700a0ab3732f9646496f8ed12de4c6cce5dac6d8d5d071a73e417437ac99943

SHA512
3b13c90c8c9c1beecd8b79285a3afc46f676686c251520de9a3cba65fa200ea8e59f290105cc170284da8f7338c74771fb195654f9158517ece9407a2257408a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c136f936689b9bf271971f37f58bb89

SHA1
f43cc3c1bb17c5c977767f73ed440bb5dd71d30a

SHA256
a97df76857acad4774b8f9c68bf31236a1c9ff483ed3e2ac507cc8ec00653a93

SHA512
5a94d2796f88cfe127264a8f8b67aa709470f9c15434ddf1a0b3f40f82fb444572195a61d201de4c15faa25f727e4ca692e3bca49b6e889cd6d09d92a33cdd2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab28b9a886a9b542a8a705610fc08caf

SHA1
99c6dbe9dd5656a08fa7927581d3c1d1ce3a281b

SHA256
83fc8de43a5b8657a08dcb87e7e5ad9a410f3a2ec89d7c0778409c382f680d22

SHA512
cf35289adb550029ade103e0fce778ac7d998097875085c33f489a31d3a715c91f2a7c3128af47aeb77895265c4cb48547af059c17d787a88d727aaadcc08d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e0b3b11698d35b22be28c6cb0033318

SHA1
6488d3d0d411a5c50e5c62bdcc592d0ed8114efe

SHA256
cc4374304509a9ef9626247fbc6fb647845489dcee2f4b3eeffe1661069289a9

SHA512
f444ce9ccad839c22fca083ca110c76fb0faf433d74b57a8cd4e7afcc34812df39f54f72dcc1120283f24216b9145f091529886a4b9e844b7eae2a3f8cecfef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EE7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F48.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit