1e54365e1b0f2b5fc373fd3a46391eb009762e497ed31b9c4f3142a4af48d578

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35ea78f021d57024893dcccda04b49d4_JaffaCakes118.html
Size

461KB
MD5

35ea78f021d57024893dcccda04b49d4
SHA1

2c4d9a6ca1c9bde92c3b472fbdb5febd6f961f66
SHA256

1e54365e1b0f2b5fc373fd3a46391eb009762e497ed31b9c4f3142a4af48d578
SHA512

44b5656538dde761f1dc20b1e99cca44f1a8d074298b54d012fa781f031388ffa049abc6b74bec8d216b456055d8a10814df9c533616be1bc03030806ace29b3
SSDEEP

6144:SSsMYod+X3oI+YMsMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:H5d+X3M5d+X355d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E467E971-0FC2-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402858bdcfa3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f9c66543d19952c99d72d87db81f76755b63c1687cea8919ec5e97baaf25dbe7000000000e80000000020000200000009fb2392ecba768e1ff3c8af8cfc53edb8700182982f758f484dff949a686a15e900000005e99bead065e8802e56bc3af24f924397e869df678ac0d75bd1a95209cef423bd1206aeac1649c2ab3b8013503932ee08c718494ad97d079a7e29704d329d0c6e8cf3e4142e1f150e09fd04503494bcab06b58bb92387d6a4646ccd7ae85a501f3cacbb7131e57093059d47d36203b62d3f66910ac7f3f61f299369cf7f3c0512f321cdbf89beb5937b0e3f2a837efe44000000040b6ab6877e9d7a629efd62db648ccd0159ceeac5c1a243ade16ee4dd3d314188433c3236c49bcb0eb623aabe3cdcf1ac3ee32dd3bcd0b51ec7c20b7af1101e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000677cc36a988f3f22c1435a9499ae7ba2fa4767cdc7bdcd57bfe63a617e86f781000000000e800000000200002000000074f35987e6fa1103ae8c51cf7fea6ceb3898bd2cf1354246da2a0dc9ac165dd520000000b5db4e9fd7a5f8d018d9e0e2a6bce12884d770adc4efa9fffe8ee1110d0d13eb4000000073c40c85772373b5e4fd08583ad3a3745983dad6a12db5bce081c987fce6ccf597a36657bd44b469d903ab0cf402d391f9d39ccd80a7ba05848fd830a399bc3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421613396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3004	1284	iexplore.exe	28
PID 1284 wrote to memory of 3004	1284	iexplore.exe	28
PID 1284 wrote to memory of 3004	1284	iexplore.exe	28
PID 1284 wrote to memory of 3004	1284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35ea78f021d57024893dcccda04b49d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8a9feefa9ed1cfc86ecb08d78ef3c2

SHA1
a409796f7c061eda6a34bf50607eb8c92688d629

SHA256
b22d62898d1a5163953f00035b21ba0e54164877370d79daeab8ca9a72ae006d

SHA512
314a2726b449ac774c00624b95eb78c601fdb0cd719ac21d6492e25812c395186b40045a0ded25489f19492e4b2ca4d2ffff72b281638825320bc16d9f4a49d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7d48fff0871318fd94c55c76947f8c

SHA1
81a7c0d02c92c32c198907fdea2741d51fd5449e

SHA256
ab04073f18facee0453fbe46f5d3965ef7d66e11c5006a0e6fa78bd9c2c46f0c

SHA512
f1ebfc55c58c7f20c7bd840b5436bd1e88a4943eadafd5b2998c30ce71fd99daa321590addb3257b8424dd65ae4181dc3b924d70cfa40d2d8a38915cd148c705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf671a39658fa4b87ad29d75712f1fbf

SHA1
e88934b6d38ad4afee8aebc06a863dfc98015be6

SHA256
406a4bf4fd5cd2e699927e083c5eff69827a95e3a506645804e24f8c0872f6a1

SHA512
b0863dcbf4372f59f594d34e341f6700875b7d3486127e09fb999655217b9f04dfd859cb191c9e1f93e99ff0ab78f0b142acbfc143483574cce3de05392cdb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181bbfd303fb718e7d3ec5b5e3c68e5d

SHA1
64eb3ff1afa4c0d2f091a9dfca156fdda6c03d06

SHA256
f2d4ab9d56cfca82ea34410165b9deb6e97461dfdb824bb8a4666812dec2ea1f

SHA512
4c4c858bd8e9f24ba1dd1222d5dfdf3e995b8fdb6978059c56ed37614f3cf0da931bfa4dae416b63bf3235172aadc354976a0431b1aad600c4d93e42df9c16fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9234f0e93434e533d5a5d538c4bf0aa9

SHA1
b2899bf666310e146bc637cce5ae32fc111d1fb5

SHA256
ffd3b806eb08c8e854102c85bd19ee805fac9f6a3d52ca778b5daf484a897448

SHA512
bcd5aa570ee6a2f36ad4f86dc1d02e4d2bc254d45730305fa32044d86ff23c6a38644e81a5e5cf38819e8c9f1697b1f66ecf2629e38c6bcdeae6c843fa7c352f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
221ec081dda39a4455851918ca11dee2

SHA1
719dd3da94976515a4f02143d78df4571fdd3eeb

SHA256
ab131cdad9e70a8e8c63c9c5f980d6d8736b5c1369c68f511f483b88b075c4c1

SHA512
0b1b6131344ca71e872530162ff26c8de0e8e6bb2a272546285ce3b9d386f5c44b47fe658e5e3a82f52455e4bfb85f571ec7f72c6b4a482bc24c1290952ce300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec88022c7a5a300ff2aa0e1aff0acc2

SHA1
10e2d044737d7011c9170f262a45876517a96556

SHA256
c76223a90fc2eb010892ca942d9ac2e096c90f6d471a3fc38ba83a5acd8a05e6

SHA512
73f867fd5e0c1a40b8ea4309750a74b5e5b99201e1b690fe28119374887bdcb902674486e07f1ba802e036338f65ee3a9f5b33a377312ab764dcdc29793cead3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beec95e1b4fa51e11f32477241820efb

SHA1
be83554d96ffb6c312f659db029d425ce8385f1f

SHA256
624700fb43a9153e7ab68e0f7673d5122474c1ec5034e57202c629a54c84afba

SHA512
e763b7c36f783dcd8a540b043f93bc19ae41e15cf0c7e1e14754c6637fa75c7a1679e64d38d5d0a3b0228392af52ca228e88781588d1796a87cf96a2b28c1d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e45eac346c3d0cc15d6ea8f0b05fa0

SHA1
79a9dfff17cbb67cf912ef235ca752af41d793ce

SHA256
8500378ca3cd8d72ee06f671e02d59194b32623883603e0ecc36922a46de62ec

SHA512
4f85b62f43e1f723e9b85b81ca3f527f0508089be1437a14566151deb5d74074d6f7f09db1a97ce61c89727e171abdeea40ce3626655202643db5a6816ccf732

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC1CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2DC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit