ec9c05586ea9a00361982602406b15e7bc7640d4c4686620e4f15ca42d0e3b96

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b4973682c23e54d5c704b611b114e93_JaffaCakes118.html
Size

4KB
MD5

3b4973682c23e54d5c704b611b114e93
SHA1

d145eeb78b8723b485c048c0604d55642834c34c
SHA256

ec9c05586ea9a00361982602406b15e7bc7640d4c4686620e4f15ca42d0e3b96
SHA512

faefad2fa5cad4fb738917a2b03c63f3c537238e46f76fe2f0dc4ddae9e20c5a3b11c7c0c0945a6ac3537b4be21737489b2cbb8b8cacfa3c3e7865e73023765b
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8os0Xd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9DDF6C1-1085-11EF-9B71-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206b71ae92a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006181d27bf0662ee981dbd128fdbb4719fc0891158e60bd4d8a00f34baa4cd5a3000000000e800000000200002000000048d980fc3cd5bd439ff8a802e5c15eb44259abaf81fd1d852a31b2887f41281890000000bc3a7ead0eaa1570fb7a6388d41b4b3f8acba2018169b9cf129dec2bb85d7803fb78974e786ce02f111ef7f16aae9e52916ceb6ea4a83df9922dc2d4b5c709ed3cac37b2c11d16700d9139feb5b1a743aef60674afd9153c9a3d1b3b709b93b1608ef147404545352a047f39eb7b926f1670c2d9cc08cf91daa3374d2eafcf74e7432e09ab47f7c267c13146adfbec49400000003bfb95b6481dcd7d04bc3650cf70845d07288627830346d96884452b41066c4016fbd2b6c9bb6d69883a0a37461315f9d31d30c95122e53104c87c18c2928348	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421697122"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000958e6e0089dd168e121ff4f7bb5b015a1eb796a1b4fac593aca5b49b74ede094000000000e8000000002000020000000277103fa6ff793c0b8ceffde258fab01551760024243a87134b4e12b1845daf7200000004d4bee74c42eeb3500e846982370cd8dfcf51e92b86031380a6556c496cda40f40000000e0bcbc76c78ed1f57fc4e71fbea2a36ec44607056a9264c2edc6068b3172bfb92d14d8bebda1b09091d5453686e9bc0ab252952e79a2c8c462f99f448d73a0a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2936	1956	iexplore.exe	28
PID 1956 wrote to memory of 2936	1956	iexplore.exe	28
PID 1956 wrote to memory of 2936	1956	iexplore.exe	28
PID 1956 wrote to memory of 2936	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b4973682c23e54d5c704b611b114e93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7034ea212a421f950918f9a1d2d29b

SHA1
abc891b287bb53301af277fffb078a3cbb05b84a

SHA256
842aa5d5fc82057b953789b04ee4fd671230557b86f6f2e79dbb1d36de610714

SHA512
2d390544d2d8d272c6b43212f4b7abe4fada4e95db003629f84047c31118fb4232d3c8b470b9d5d28bd6e16f542e2a7e2c14d18321c21fe742dbb6501ed83f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
979ee8bd04b47279aa74e02eacb3e313

SHA1
380feb84e6e701ad1022eb426404208e36523746

SHA256
044e43997e920a580225c2b158601bb9d7a444e8cb00383d4095b3985c1ce414

SHA512
befd2fe1c740a93fc6acd1e9ef06064e460aa6b690358166b67ed33b7caa5a089ff8aa7ef7da57c93fdfd9fbcb68553c94f30978cd678d319c943c60966e972b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005a3c5a19d243e5b9661cefef4ced7d

SHA1
dc410abf8323fc7d27210ba8a00a16a6413667ac

SHA256
934d19efb8ff18096cee5a4dc490dfbd1755d4eb976ce5b781ca054f84bce23d

SHA512
b9274a1ef5e5b754bb219c4ff3298c0675c8ff5c4bc2f5767d79cfc9bf23e2894d2501d139b5659e25d2c151745017f7b3fd36a818c5c14e118c48f4c7527919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
354f03bb214881dd785bbacfeae85c91

SHA1
05c3eb66900a0ff78a9ee0768752164be30fc974

SHA256
5de98dfeb647b82122e4c255039f51e6344e6fce6b0846415ef7a95dd5a57d7d

SHA512
86cb7f71a8e0458ac25dc22d4f770111ee1975419469b46496306b601aeee1276b0424d28e2a9b45328b823a7991db8c3fdc6afde155ca49381eedca94db50a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2023dd16ccf58145af4e988b83c68169

SHA1
c59f410b55a5b361abdab10e07c1196226600b30

SHA256
b66b91bffdd3d91c5f6e8f3dfd6c6d84532166b6d9280e5800e1489901bc197f

SHA512
cd19a97b9cc07ed929f1ff0c7f3daf715115fdd65d539ecc3b0c22abfdcea58884382f7c9fccdf53c603c756b128073bee34d0f4d78579e55a3d17d30a18e220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ab552be09eaf55d249016a632c8f76

SHA1
79b920f314d5bf4319ba44d3bab2b9fed98ee46f

SHA256
1d422165302481ea3614413cad02cced637d0d3b1f79a46df08d94c35000024e

SHA512
8690ade43e894077989906c9fcca44e09f501f22ef9a33a5ff32f396efb8c26feb63dad67d35637865ce65c113a5e315f167e18ee6875663b743db0711ae905f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d27c9da41a79f0371f5fc3841a5a0a41

SHA1
b296c979a011550cfc31531996585c8f24067a07

SHA256
8d1375687bbe88dd819fee04129f5f63382dfb4a5480c8ff262dcf994e67977b

SHA512
e7208b9ed2c50d6cf949deea5b4f34f6768db6d1a6045c345dc33de2ad585702f4f9565f63953c4ed4bdce49a931123eb5311a452922599daeadd54398646de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93518820c9af3d247bee11cc41dbcc17

SHA1
5a9a175032a507fd9a7bae20f7de8259d14da617

SHA256
0574da4b493f2654ade284d4d6ca4a06466c0193578d37260133668dfce9a2d6

SHA512
098c4c074c54458ddc1c4f394762b662d4594272c3d141141c9d0b4a6517f516aef6b73473582bf7512fbcee1c72611e156faff5ed3c7538ecc31e76628c1756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d353588cd1a13254003cb2b10aec0d66

SHA1
52e19ec18f78a22457038af6e24d4ec12e2df27a

SHA256
d1f6917b2a9a17ceaf26116553d6540151aa55994961fff7d70a51279ef4b6d8

SHA512
616e98712b971362b99dd6c0e37c9455667174cf034c6302a732dabb52b78e0d3dc725ef0dff6f984aeee57bf87da48347dba6c160eacd61348789b8935a758d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0f95297c828a7f35d30bbdc515a7ad

SHA1
f009744052ddea02f4bddfdd2ace496d2709ed97

SHA256
4ca8e7bc87c95d688f9126772b47d44261dc3e790fbc1d4c656a335bbfbfc407

SHA512
42c4c974000d5e03a335522da8e09632fa6c10596bcea0bc630387235e9b9663d39208b9400013f89348689ade19f8b7d04764cc355a8470e7362f8191ba4bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e835753133e00e1469bb1f5e3afc11

SHA1
b0b47d70e31985b0c2cc0060dca0c016e84fa8ac

SHA256
8d36f2076072ef76c8e169aa903f8e105ae48da9071fdd03c204ed3b1c3074e7

SHA512
420c30ba4c3e5811572f3bb328f87128a8d8fcc6da756b55e7da5324bbcdbf6ff4b50a42c16918373a4749d1bbcd0fbd5fa811acfb77556bfc4e0cdfdb039ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33DF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar346F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit