996665d87ef5744e94b961f081a21640080c9473e9cff4fa3112a0e20f88c1b4

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b12def905a7c103d72cae3db28a7b6c_JaffaCakes118.html
Size

26KB
MD5

3b12def905a7c103d72cae3db28a7b6c
SHA1

75b02a4e8c9027d3bbb1297d371d11cf88aec56c
SHA256

996665d87ef5744e94b961f081a21640080c9473e9cff4fa3112a0e20f88c1b4
SHA512

73730952f8d407d6151dcf9d0a040383083d16613172cc7ebc01083199a098008ee58807928967467156c00b5ae6aca4e43e95e167a7e58a308a07ecdc097a75
SSDEEP

192:uqj7Tbb5nlenQjxn5Q/QnQiejNnPnQOkEntMWnQTbnZnQnCJVevo7NtaFo+NzQ41:n/Q/VygclpNy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d808c38aa4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003891bc60b3bf8a0499a078a2483fbf2ecc6b80ffbe251f319584708a967da096000000000e800000000200002000000039e2db6b1ca87ca9073d9d9d29d886f39ed84a9d4afcd3bb8b1b5d8c3c16b99b20000000605750ca9267bc812b1ab8e673c664d8d749b6f7f081c69c595ce50547df7864400000001ed56506c5ee23be63c010db33a9cbb4dd799817f51b521a903fef43cb24d96cc27192c858d4d21179a8a617fd44d26c13e476fab557d4b5501b848a468149ca	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f542f6f597f1e3638949e50636c1e212adccd430389514b255044214b1ec4c34000000000e8000000002000020000000b6607407ba684ee03ec5039c99da5fd81b311642954c9ef86fcc82e13c0ad2b19000000024fcb1afdc1f950b40b83dbd5f87f28230f6d0752b8b3b0b94d3a1d258c5c485debf9efced72dca6a8cd951a64e55c2e9f91618ae6a3d6d8c9463559405fe7133b36d8aa3b93303752c1b1f6fa28cc2ee53c49ef6eca355fd129f613cfe40eaa9a6a4aeeaa5cd3dd57174278f49a979c708920061ecff9e92b9f911b5bf58a9861888282bb1390f66ef82423c7c8aa39400000003c5d23b36640e8a28baddb1f66574e1850aeeb45da7221231af7328db78deef162a958135e113b3604efc06d0966ebd6b6401a5c8a7b2d03cedd3d82493db419	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421693721"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED984331-107D-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1212	2116	iexplore.exe	28
PID 2116 wrote to memory of 1212	2116	iexplore.exe	28
PID 2116 wrote to memory of 1212	2116	iexplore.exe	28
PID 2116 wrote to memory of 1212	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b12def905a7c103d72cae3db28a7b6c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a2a1253f47efa93b4df41fc96f1796

SHA1
644802d0abc5b40d914dc80aef24b05d518392d5

SHA256
fdfa6c0f8069af662638681a7850bfe82ef76461c3cf4b36aae6388735228ae5

SHA512
422470af79684d3d3e4d0ec111a2fb2eb872d2b90c7dc4ef8b54ec1bfb79e90be9ce251d76154a248faed8fe805aa1fd69ef5f5e5270f1de32c3186bdf72aa5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ac23ba70d215fcff56e1305f215114

SHA1
b345ff40b5630f0099a6884da0ff0c6c314be3a0

SHA256
3634c1b561664341a93fb949ca17bc7d06b620c6819d8b4cd4e6f0cdbc58c7c0

SHA512
fe6afd39ee5ce8d57bf0b54d070e117da3e64a724e1999173ac1d048dfb227e1592902a07a234f77bc6e750d99c864f84d513580183b52de17924c29fdbfe4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b179a364a5af3f6964c9b95f3c30d545

SHA1
100af292e28c8ba5bceaef58e83c6a018a4abc9f

SHA256
f1dd8589b9f675ae13ee17a9cdc132b6102daf2a1b34d14729e0711d5f9aa2b3

SHA512
8274a3b507f4131dc428dc723fd8e2ed4fb5881cbebe2e270f577ce0648b5066a8684562c13b5076d71238541831b663d2537b862dfef3545dc97104880dea7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5914c43bd42c21a65caaf1a4ca937360

SHA1
8ae024ace9d7f08ef3fbbfcb388ca790e8e17bad

SHA256
2ed9962a84a822cd1ebabc6547aeed371cfa8f055b1411c5de811c4b371340ac

SHA512
8ebb673f2bdf72a7ef3b503210c7811e38c542b7d87102a0d2b356a7c7d346f1cb777b385188c95dcbdbe5f455a6d97ef253ee26827fc211a7eed001036d8a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb27cdf0265850e46f0b0d038ad0deb9

SHA1
2b620e46323b98ac2fa7c07956f8cb6e43224124

SHA256
4d34b8f497cad61b4b2a80db0334aa729ecf4de064e420afc6a0231b39ba5806

SHA512
76d8900fd1ac05ae462e0b5f773a9d24b54e504261e5f9bd2a679848a4520240b40dc9b6cad9c3998bef3b1c930023aa606dbf6886679d37b114c7ac25d38af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8487e40637f1d6ddfee3590a24f4c3d0

SHA1
a2df2575c6f14cd9895d2a451486729812110175

SHA256
fdf3b58e76999c2b814a54f232bd9897ce88d8024d84829a08342654ef02eaa7

SHA512
fd25f0241d37adfd0a8582e0f93c67a4421263783cc19a74def95d6307461afdf5882455b5131fabf8994c9baa69d3280edc449460d0cda98dd3068bee88a139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d177c85018e5b2b306a69cb65714c88e

SHA1
77eaf7dc3c6b0ef90b2f185e72199faf2dc8a56b

SHA256
bfc06f3038c7f33c5ad4e8bf612c77b59340cb4fa9da3f90a707ffc353ccad78

SHA512
652751066154c4a36528d2ead3159c8fb36029c44b70962b663f6c1880c2c0bd0d7c273fa033f2101f4099528fa9ba8572fef19684817ffbca2501a8be9b8bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
026e61b5afa81592b6b118bda6523651

SHA1
957fce1680485a95ee7ad8de993d0869a6a5b2d8

SHA256
3936b840880bb4ef4fe1311e072061ccc09b419ba0191ccc9cd0eab28bb446b8

SHA512
7377272a4f9c628fa0a288063083852883e576dbb51c904153474d1ed802cd042079bee0b707efa62b5d7c7688b49d76a92d91216e4355545f9aecc7a00b6f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3675dc31176919cd4cf10bb0eeb37ba0

SHA1
672e4c360a10ccfdcdf78adc3c52b4fd23293717

SHA256
2bf91f68492c63f1127890a56332bce1acd72836cc50f772a5e8c305ddcb912f

SHA512
ada4c93b72e6cf16bf149bc2d1f3267e6297084d260d91deb303f933ba1d47b307dca2c54d3a000f0af084be130ab2d95d9a9bf3ccbff673ed577be7dbb1bf51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE4C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFD9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit