6b4e2aeff4ed2c9a5a74a17b2f01dc074d601cf2a293f3f40e472b4e4ffe8844

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b56eefafa9e747566a3e47adcf9cdcf_JaffaCakes118.html
Size

7KB
MD5

3b56eefafa9e747566a3e47adcf9cdcf
SHA1

d557ca4678653bd2b5d22a7edb480ac2753438c3
SHA256

6b4e2aeff4ed2c9a5a74a17b2f01dc074d601cf2a293f3f40e472b4e4ffe8844
SHA512

7706677be4eccf34082c80f096109b0c7be886c7245135d93d6133e6f77c5b400e32f60f26d02a694da542ad10b81a048516660e30c0000fb72f3436b3785fb8
SSDEEP

192:Kj39P/p/6/VYCmm9a4Anz0su5sosM3H+YMoiAURXHj7hc7jHhSjLlj+jlxjtR:/YoWnz0su5sosM3rhi3RT7hgHh2Ld6vj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4021adb894a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000837d4eeaba5cecfa4e32eef98061f7a36c146337df55f571803d7dd9519444b9000000000e8000000002000020000000d61edbafc1b7a5cd51b6bfb30c3add788234d0aa554294750ded5045ea59780920000000bc0b1c62bf63399d4d8612d25b1288826799d5bed4e324dbd4814eb774775f5640000000c9ee22529c862c12b908b06dd744e4e049b846f8a1734a15da6dca497e02268c74ed897a18c8c7467e25d3aba7e327f17d4b3c10d371ece48b96d914a7d9c9b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE866611-1087-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000081a5c2be93adf7961f6adf8c79fa07791edd5cf5c53b503b6d956fe9bc14daa3000000000e8000000002000020000000ef970302f2754e045787e5f34f9a978ee2eab21a0be1112690a1744abed5ab939000000040159ca398f93b71b30f292b541eaf2cb5f1f51479a985cb251ff1d88a8020ea74bdf14439494a88987d49ca9b6c8d53671ae495afebf207ec9bdea06786d2696cc4943967a4bbbf73e8b5a42db43ef76809c7397dce08fb18c21a6ad10624538f8c71711b05ad2a5343b75db1d37da224f31e0aa173ac6e7c4ffac21daccd0fae65029c5bfca17b1fb78ef7c083014d40000000a3e9dcdefd436e4cbcb1e347f4e50ba5bb71b740b3f45e017ba5bf4ed603313eb2faf5f7a47367e8b91344d01004b763c9b6b6535d44fa201053a25a65de9418	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421697993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1400	iexplore.exe
1400	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2616	1400	iexplore.exe	28
PID 1400 wrote to memory of 2616	1400	iexplore.exe	28
PID 1400 wrote to memory of 2616	1400	iexplore.exe	28
PID 1400 wrote to memory of 2616	1400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b56eefafa9e747566a3e47adcf9cdcf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6de0ab2693489cc99816b799d4cc72f

SHA1
4fe11ed0af6f60e669b5c8a03d703b76d5f727e2

SHA256
37e7d961b3ef9860fba7eac63bed5e9b59436fd8a3fc5a711a711224f6321315

SHA512
acde1a1a20f6f5f838e7820f6e47c21e485f7409d97fb8e2922f7a363b70672d2b2aa0472e531af7636d5a1ae3276a1520513b8ba268fd8c2dbe636319267029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fde75090a71d1573dbe51813e49e63e3

SHA1
a6c208de0b89ff0172e8ca993e0fe898cf7c5b1a

SHA256
7cb7d40670c952e3d815869b537b0e9265846ffb915af6422a2adb82b32bbd19

SHA512
ccd15773eebc0c50c21a39d7d25d9411db478174d0bcff8ad11b6c13cdd353990e01ed76cfb907c55581ce7c7dc0f56b15611f77134c3ab3f0d3bd67074a1578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586615265f7d9f46da0a50094d8852a7

SHA1
14bf2b833685fc1489ee39a83b5ac0e564ee7b9a

SHA256
07049fbb76e1ba7ddbbffa6678d118b845e95b0ed360525e7937178af9fab06b

SHA512
d1d7e183c03190c3f76dc2114396539a9798a88554e04cd65ea864f84f2da7727fdbaf87353c99bb92c261fe1f8dc4fec5dfeccd99952cde4655d293744a50c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72e68a221bfb26ac0a920fe2a52cafc4

SHA1
1cb27ef4972c4fcfb9f49ab7e3e95cf10511374a

SHA256
44966ebb312f2c3d9976df24ebfa2f64548caf1eeb7a0cf49ce9e0e74e7a6938

SHA512
0f64812351071cf3762493b3259f103b3cbda89d2b50fd5f227e241961daaf7669c84fca40433af40621b0626c8c989afc14fc5ac03d628597bc05b622303c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1d0753caaee9c88c5295c0c13deb0a7

SHA1
b57880c26d6f482fb28e56538c3989f17e837f27

SHA256
82bf92325348bbdf89bc805c1ee7cda01cdddc96ced86266064069f1722792f9

SHA512
5eb034df89eb33749f1d2c8e128922918c66bbdc7f111c8242a8b35a571ed9b17029f9c586949da1c7700bb2a1d6eb598d446d3e944327cfc110c1945ea2f173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30c1ce15f49f14bc44a35e498e94325

SHA1
cf101f5bd6f3392c6400bf6223def27142f7b7b4

SHA256
ecbde1c52b5008b369b351000dc22ed44ef9b1c58ddd81bf27a12120327705f7

SHA512
acb36b4784e504856b700c4e6494ec92ea9596cc7c990969db78af5dfc31ca2b5ef8314664a4c7a99cf8be16e7a6197750885336e9c22562b4da7e9929a3a95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003bef6957dd0e00e8b634da5ccac974

SHA1
25f54485a79904861d85fdde6a2d4b2b327d3d6c

SHA256
93bec5d8b6df8e8835d30eb98aea0e874c2840b934bde7c834bc4c957fbe4868

SHA512
11eb4b435b1df22905d252b438fbca1de58dbd40b5d80ec254a9ba00baeb52b78aa72c3fa14162e0be956b6337c15ffe07a1a2dc6fdd035231ff224cd768254a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7394a2d30e975002737a65db2a39e161

SHA1
4b4cf4f5c9594547016f673aa0b097b6d48efa98

SHA256
74e5b085f2c0092242aab9f371cac223fb864c114e03e0f73a3bfabca950ce3b

SHA512
b8f52261e136feb379780914fe1c83214c85dcaa31a9ddc6564c6569b62a39cf6acca32547111bb4500128c01c35ec44966c5d7ff5c4ecbc31c80992678e7e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE28A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit