59ac1aa3b6c6555e7de2116be590b7f28f6e8af75c5127650093a70b0d3274b1

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8fb561572a8646924cd77fde398022_JaffaCakes118.html
Size

39KB
MD5

3b8fb561572a8646924cd77fde398022
SHA1

d9ae9dbfadc58fb79c3fb9f86c67aedb6c4a851e
SHA256

59ac1aa3b6c6555e7de2116be590b7f28f6e8af75c5127650093a70b0d3274b1
SHA512

8767e19fca0ec38154476c4f39a32665cfe6756a9d3bcee2921a65e32708e2fd8b557c2a76901736145827ff879000f3f1ce843f7b581b34cbc1db681137518d
SSDEEP

768:no8fZA17xbCEEAo0maLzj5w6WvsMme3JGIG+p:no8fZA17xGE5o3aLzj5w6WvsMme3JGIT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ef439ecaa845f5e74e9a6ec70b331492cf8342d77c71ea3cf1d7743a1d560857000000000e8000000002000020000000fe4583ae255e86bfe17ad0d845f8487f85e28d1abd922c28a1e0397a65dc964890000000c34a46a1a0b34d1a591bae3e99ac9dc8a971ca4ffc05dd1b7dbd597d728a9a74f4583b9149ff428cddb9dad5c0751b85d469a858036bd9022c2f441b8a523c6a9f86c04be12721bc76d434087756e340b016d3772716a06d0fa5347fe50dd6edd5fbd679aea226631317a068a9f46f9af3dc1f499f0dd27a87a48ec71235e5a28f7d630d9b8ad0277633a68213a2cbdb40000000d6d082d7650d48493a3a64c472829eef4fffa9a5cdbbe30f475329eeed68e4309a112df5f8d89fe18930328efd408f27ac448e5bbb32631d400c63cb78e7eaeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01d35ef9ca4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421701524"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17DAFF91-1090-11EF-A585-5A451966104F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004306b81adca67fe9fc3755bffc3af5132d8e9cf3c4ea933da4b013d57ba39135000000000e800000000200002000000085b98ed91c682ec4d35e9803fd70ef2ab58b0fd603dfa061ebdd33cec68e3cf520000000358e81fe725b456cf812165074bb597f87cfc146fd4b5fe1264b0eb931ed782540000000f6b2a57e71e12da892879abbedcda4be0eff27b103c445144fb18de658be1aec7c79cd5fad0a9558226d4d24712dd66583a9b58d4bac1bffa5f165fefb39e581	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2608	1916	iexplore.exe	28
PID 1916 wrote to memory of 2608	1916	iexplore.exe	28
PID 1916 wrote to memory of 2608	1916	iexplore.exe	28
PID 1916 wrote to memory of 2608	1916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b8fb561572a8646924cd77fde398022_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f5eafb8263167a1923c47e76a40c31

SHA1
f5bebbaf5bed009e69ce8e0a7b28d0f7f1b97338

SHA256
11e32af1fff5cdcdb4030026586091bd1068a8c57645bffe872ae789e1724c49

SHA512
6371a17a88cced88a6575a503bd2fb700fec71772d079f57d73af065c70fac921cd691ee52f9a30b0a58334dc588970a2226ff66a88c800b64003653891ad5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
301da78aefd646bfd6ddb57a584142eb

SHA1
438d91417522823a478677f7a70d982ebf18e47c

SHA256
9b70cc5508c01f41e4dbc54c68b92b18aac8fbf81affcf81e567de618739272e

SHA512
6840ac6932ff9193703e9de9ef2cf3f4e98cfe23122e8cbb8a027336cdafbf9476e1a3378df827168178b67784e28fa565ecb9b43d5b57521f779153699ff9d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
070e38b3107381e5e625255a843572c8

SHA1
b65318aa0a99228926bdb9f3d75fb99e8c57669e

SHA256
99d16709d3fd1f7a0a6867ad29bc71546f9659c75c72cc3780e0ebec334b153f

SHA512
84aa0a0affed4b81ed9ed3c4ffbe614bf94c899cf959a330c25c0b723b13c4175c775673d5cf67a22defcdc156b5e528c03c39cd0bd53c4492898ba1986564df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da34edffe4cf6e4bd2db81b958d8881

SHA1
94cb0c52be544b46d99951bd30ea78152c16665d

SHA256
201cf36314619aade39629758741da64f5a0b9a1b735183c24c6f6b86de27d62

SHA512
622c8c28cd9313d468bb6925d61953a58bd2e5550b56c189cec1b4bf1e48a4050b325909791e377cee52bf973ca5705901a3b7412031eaa16b3aecaf60eed87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6c77b7b798f08e868f4846ba18ab6b

SHA1
784897a5b9172995a384eb9c320923455e5881b4

SHA256
8327d52b7858731b801eaa4b2f146ef3c6099823e453aa686047ec19e6781b35

SHA512
c3f63600f98543d519d5cd2582007ea9441b304dc17f52c4e694b95999663cea56749ec6c509306c08e43ecc8646d54722dd42f64e8d2f83cdd40314ab4238ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4cada942eed35cc11899b43f8ce5a5

SHA1
c71a8278c032b8360170c4193bc27b768570742f

SHA256
4fae4b8aea13c499327e474476a7b21b0510c0a4eb6bae8cc2f0e172a5e817d2

SHA512
b5eb79b17f6fe8627415cc8976f55f690390c2dbd5757730dbf919a27107ffc950c1e6a5662c6d85240ba5d2605153da58a243383494ca1c83b7ef09e7b38804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabc5f4508d62a8f8b77961a37291c66

SHA1
b12066f8dfb7a734fadedb594a1b1611ed0921be

SHA256
0d8e6f350d1bab8d83b6af74f586f3b54dc153a277d093071d3eb9326c56a37f

SHA512
65ab9e322c7e39780d032df87596e44eed8e8912b199f78aa95a22eeb99b15eac658dbeff3fd3df2ec681fc38570ff91d5d26ba542f48e0bd1fc0d58d993eb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5850.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5863.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit