5d9d45654294605b7583dcf9a8bb67bc80708469746cab4e006e25c942439423

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad0fe4e7011bf870751cc9f29958a63_JaffaCakes118.html
Size

353KB
MD5

3ad0fe4e7011bf870751cc9f29958a63
SHA1

1056a6c0e590234642269d4486e9299fe9efcfdc
SHA256

5d9d45654294605b7583dcf9a8bb67bc80708469746cab4e006e25c942439423
SHA512

be388a58071ba0cb78e06a1e514953315487f3b8a8f0436f37d3ea060834f5493696753926c2f2363fae44245ad40d6ad7597657caba9afbfcc946d6d05fdceb
SSDEEP

6144:IsMYod+X3oI+YN7susMYod+X3oI+YZsMYod+X3oI+YQ:W5d+X3f75d+X3f5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004dce993f335f50502f4eeb791b05ea29477f5f6820e2da7b82edfde9f68c0308000000000e8000000002000020000000feb200873517da6e26d6a77d6f7fec42d8464cc56283e8f72d5e73e98d1a5cf820000000ec6aee2d5004a55d6171ab74bcd77fe90377414f2b5b785be045feb72196a130400000001495ffe8cbeccce14a4d208a1bfd0ca9c82af840f9bc7ba03224595bc481486975ccff4f232a840a34b417b36f242a824553b82df6a123dedd208e58d18274a3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004aa16748ff24288910abc82e34846e9060fb76f202439f9abb3c764f6a6fbc1b000000000e80000000020000200000007689d073a21a040fa14bf61d3c8f564444492f2823c7812f28e84552546ead2d90000000a32046d1e18fbd601d7efdcbcc0098eb295b60996069d91f105029742e8906cd795b5de23ace72167f776371a219dc77d6324c7b6c7c0da92a7c0cc00a2026b03410f10faf5ab6ed8ec13254d926ae5658c2a97f59ada0250ddb4f0d7944f225328fd9fc4d1b29168347b587cd0a56eaa879e5cf81efccce1bf0e920329a3797a9e293f72575fbb18a29482e40048582400000002b88eb95afbe1a26a32ed59c32a15f367be8d4800f873a57f852a5677ea4f105386b864d7e89e48d40c0542532d5e1f12df4dbdc44dbc3d86c574f7bab7ef669	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421689682"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{873CC421-1074-11EF-9034-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e0cb9a81a4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	iexplore.exe
1316	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28
PID 1316 wrote to memory of 2096	1316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ad0fe4e7011bf870751cc9f29958a63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea31aa8de6baec09a296998da6e0afe

SHA1
c242153b04f1ffd19938744c4a7651cee2f9458a

SHA256
8b941f30cbcf75cfc2efd7faa6fefef1b4f8d0a7b531728a15536347e60f3e49

SHA512
77503cc9d5a26660ec4450d6f860639adbd1b61eb77b395c060c0ec50cdd4598c653f253ce93930b6b2c9217570d4707dde72347de1c23a292e0a5316766c036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c27ea81528885e642bae73d33aa9446

SHA1
da03a2221516b46820015b090e59ef1749c39a10

SHA256
4f2bd4472a200ed499e6d3bd808d97068b0cfd2b7a41c512177d172d527f08d4

SHA512
9c808db712073a2ce9d2e718522ce5535930eac36ac9467fe8bc0e2f45a39d83b080eee7a8dafbd4e8243679cb9b02703ba4b02be96c368b6818371bfc41ba8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
924bc3ac5924e93a08baa33a7aa6d98f

SHA1
a9ecfc36a11b39b1b886f1f8233f4b393154d092

SHA256
941c54dee32e66946d369966132ce8dd62e7f3f191516ddcdf6eae0bfcd11dc0

SHA512
554b2723616253735fae7de881f0919b424bf86b29064822e732c3232f1336a470747740f076fe4bc63abe4c3bee4db9fd73a77468531204bf9f519e19fd7a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f79161f18d776036862c0a51ba9035ed

SHA1
9e63475ece10eefdf4c234f96d1dab883f82dc45

SHA256
e2a095db981c0e8dfe85a73bf8a319334967ca3aeec0457ccb796c91c9b3a195

SHA512
ce9cf936f99e8af06c3847d6153740ddbd3c42b65d33f2ab51aa4f6d8c1580877e5d8bba4b6aedca10097ed5c2acedc52ea503fc2e8686aa594b4acd08d9e3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3fadaa5ed3954158c228cb02ef3d3a

SHA1
5bc2ac25e35798bf366abe842978333eeb86d696

SHA256
309b176a0dea4177aece5858a1e0daeca9c45a5f5d681048915a866a7f6a6704

SHA512
8105556902f43aeb578510469db212e8ea755ff0b87dec84d129103d8b3b68b54cf03f8bf27d1a9b295313fc850807b1b750e95006eac79f231a52b75d4a74c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae917f38d4765ef43f2b709eb96603e0

SHA1
31e0d43766bc78c76e6c4c224040b42095ca77e7

SHA256
816be143c1c1267da7f00ddfdb7aa49965769b965312f6804425f4cdf82af7db

SHA512
d0cc0c6b012dad663f075291ba2160fe41ad3e22d96bbe0e642122ebf4d888313a306ec8df0e3197375d2ff93cb3b483493be47222c6499e7575240668d0c854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8078ffad4a5f08af44e3a2dbb57ad49

SHA1
9ce082385f03bd924b90cef4f3d901fe9bbec820

SHA256
074ef5455e0bbf9ef587832c50adef70dcc4ef500e33e139e80a3cbd32922231

SHA512
12852429f1c2f77435e6dea99853990109249f7b105b4d5709ae368a0c4c69d462559bd52512ea0b3a5131361dec2bb987ddc7211fc8c8bad507230624150b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52e2e5511265d90eb8eed07479baf875

SHA1
723512c27dce7afe427218368d5ad473b07011eb

SHA256
86960a0be7cbc9361f95c6ecaff0ce362efc18f0aa65963401f1a24b9c638ef1

SHA512
65206868d97839427af3a743fdfd495774ffef517e1998df1b4b67412f684052ec7ef0a8dbc08a3bb87873a93c86a685978008443b3c1de0231af973bd925ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf825e655982d9e00f5b176db5e5fc9

SHA1
f3f0b1ce9a008fe687a3011eea6eef3ec9609f9a

SHA256
9a3a064afd2e81317c86744c6e25f7a4ee60bb1a3f1c3db2d53d56c23c8fbbfb

SHA512
866b778a5ad4b8b7b0da1fb9fbb4bc219c760594942a3af19b7f1ffff45747a545661eecd1ac75f3662d0cc56b1c34fec42a596749ba1bf3cb2af3abbb8dd2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7d8f23341b3bb1ef66420d7feef2d46

SHA1
c6051f664d41725f50b244fdb6fe152a4c410854

SHA256
904488db5ee36ebcae6529c20781b13d454ac0b5727ce7381e4053130f6068c3

SHA512
f0c41e365f687ca4503017217338949d99cf0a0d5cc1c56f17be64da9e54199589fae378bfadd776254a0b852830c606bea8a47c582e0ee1a09e002ffcce4e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0664e467b481896f4eaa7ff5b3571210

SHA1
8dae2b56451f29a907e567bc39eedf1cb2262524

SHA256
ce7278033f0e853c855dd6408279ab04f40494bfc27f64174a5f82bceab33d93

SHA512
582ef5f32833b0d2e7b6396e0b9a1b553da871fee7b5f23125c3b81a0b2bd10cabb99a663a2f8b80641996b84c6b4b0d734b1316ec00fe5a29c29dfeef579842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d835393bd49ae4eef4934535b208477f

SHA1
bb20c2abe76a3e9b68ca0968956534ff45aa13a8

SHA256
9d8f03b471ea55522fa7124f26b60fa3dec6388cdd081250d1bc5f8d20df7b07

SHA512
cd2efef6b71004f9c5642a2b9c8c423bab2165cefa8dd1d6ed09b67f35510bd4a5fa7a8b781d2ca6a3153013f0b98c492684c6fc8dde0e1be68519dd88c93ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b467aceaf68a9f9cd3a6380723bed0af

SHA1
01cc9f09f5a6e722b1cc2714a4777c8932451ff0

SHA256
c935191898293c7b9b63f208ea249d516a49676379ad5027d226f5a610716ec8

SHA512
68bd5c7a653c7cd8bcef89e3a8dd204e35a4fa49e483c2a57e3a096877cfb4e775bd346902fd436c09d53a555eeedbc2b747b611e7b2588912c43d4b864580a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7b0408f7f20bbfc5954cf1f319d55fc

SHA1
93ab6a328ef150f5f90187fe5be6824246f02557

SHA256
37b9fca807fb6269b637564d197ee8a3131aa56916e45f07560609aedaa57f1e

SHA512
97fbbdff632b9e26e1aeee1b3cc672e63b4d8ffbd0560134ba14bf62ddc5d20abded2563a2c1190b2b05101c0ed94c7efa6612d6c2f956d2947eeede1ab5f782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf22ac87949eaef2b51164864ac91621

SHA1
7f52c32eef791e193df3105b35ecb79ac84eaf5d

SHA256
18c19c03ee8382ce829989c790286f64230dea5b119dea75221f8375eb11e3f1

SHA512
9d07ebb304168796e1a3140a6859a7fcef108eece9665f49ba8014de477d6d24622b8b120f2357bcb4ead472d4c84ce560c5a60e268bf441c2fdf18753c9d43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1304.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit