88f75e4c0a0e6df324332aa79b715c9886c6eef2d7b6f87d327b4d73b4e31867

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3be43832e4a347a1ed366b4600d67748_JaffaCakes118.html
Size

68KB
MD5

3be43832e4a347a1ed366b4600d67748
SHA1

3a8d9af54229b72895a2ebc604737e09a0e2cacd
SHA256

88f75e4c0a0e6df324332aa79b715c9886c6eef2d7b6f87d327b4d73b4e31867
SHA512

010354c0e5983d735e8fe6b0e3fadb65f69694013dc6739e636b372a72bdef19bb7786c8eec7fc5583e0ba2c639242540ca8f0e198c56dd888572de84812de9d
SSDEEP

768:JiygcMsSZ8tN99OIsCwdypmyQHclfy5oT2fQCZkoTnMdtbBnfBgN8/oygcRWQFVc:JkW7HzKOT6Pec0tbrga6crNnz8PJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a90c0ea9a4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000002a9e22fa29d4192017bbe68f44fa65746a2d5f7ff67a1e1d45e9a8ac9d49224e000000000e80000000020000200000008522e6e4a112a9b35ed6191400790e66486c0371a5db364ed428b109712281069000000024cdbeacf7eefefe4c384841e197ad976b4f4a1c861f5763a499eecb04605e581105d50d49e3ff3a4ca8591a1082040c028c6aa17b8d006737cecc3597a75a92432b16b80732879cc698e83f027bb2d745a3a495832099735bce9d768ba6114449982354bb61b50471919f9c0a0637adc0002dbf14cf427379ec8498f4f8c278c3be8f741abb4ffe7d87453fb7573cc940000000746a4452fcaceeeef3126feea398dd33c49e0f0c99332349bfbd61544e72732cf17dcfc64e64ab5a9ec7be50688f159ba501a1a3968d5b089414705853ebe89f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{394B27C1-109C-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421706730"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e61646dc509580dda2f840146009d3f617f0f5c36ec7e0f0e255307e2c6bd7f8000000000e80000000020000200000007f9c900194903b11452eae895b45b4699f55b58b3e49d74221bde9d0a155fc2020000000a0cb791768eeb484380237816f19707bf398e2dfaa20174b4d78b41696e6a3be400000001575a0f88873c963432537501b5686affcb775d823b37369f65a7a8374cbe42e0549814789a6d0200d9791ab6609ac60de7c86bc742163a9e8dd943d89545212	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2364	1740	iexplore.exe	28
PID 1740 wrote to memory of 2364	1740	iexplore.exe	28
PID 1740 wrote to memory of 2364	1740	iexplore.exe	28
PID 1740 wrote to memory of 2364	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3be43832e4a347a1ed366b4600d67748_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db8d676ad4c50b1dd074aa7492a94f23

SHA1
82b4bf57e4a7edca9f5ae38d0912cf8db8750baf

SHA256
c486bfc2d4d30fba4aeefec25cd999761e7df53e7653e32042f612bd091b62dd

SHA512
b942169760e6aa60957cadd7a35c65aedb3e40b7404ad81aea31f162d06f906b7b138ef383efbbe922f0bdf39a2b2b373e9abd65f8381cbf0fb96e290598d7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b43ac7ab86185241411eac5d5d82f3

SHA1
cb467e1b1288c7803ef1bcc7d05d1ae557ecde71

SHA256
bab191246c88b6699102261e7f5ea2e249b6417f7374596f100e3b2423a6c155

SHA512
e22fed6b80f6eb8db032be999b3d4ba1cda11214029489a3e87196bca084953a82a04e5b4207aef4383ad48e0b7fa6402da876b835a8f05cc4b3e273c4beff65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6cc54f5b382478be116f0659cce66a3

SHA1
d242620fbb4d5dbd3c04c28e177bcc9abaaf7d86

SHA256
3dc9d720e5508dd0c11033808cb80ec1a8de32d53bdb65e2d0f4e1d1a216b9ee

SHA512
984073d72e7915ca3cfb08341192aa40d198db1d5fccba48a6817ad2d169b3f18fe0b5c7aad3bfdc8e57fdae079ae29cb28529bcc4d816ae6179b13e73a79c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07d12a62f2a1a5381e9c8731bcf89b1e

SHA1
1c0dff81210b7883470072ebf226dd608b85456d

SHA256
df138d393bbe70a76864df6b97f24199f05b323aa4dcbb988f3a4266d419d396

SHA512
1f45e0822f2a3e920fc3c47c9f2b92c69acf7550d08f26be9ae5289cbce2ab1ff3e241b09c22c9a0176af6bdcd451df4f67ba6be2b8b812eee47b21ddca06407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ed2146a0a93530009cb647df628c94

SHA1
39e1d14a1ce1c2191dda7a3c3364109f9aeab113

SHA256
dd9693c2587a565c3e793e0bb56af7008945be91abebab49a0d11e4bd5cfd0ee

SHA512
0d0f2ce9141af38fa8b0b8008954cfe951f3d6a7ec5dc33822e127153e9e697ac55dc88868b6790b7bcffa8244803f2be25d943df208090be669a7dedd212f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309ab08f2e97188c44c8b88be65b2fe1

SHA1
07be3735ba5e77bfa8edc1eb691a567ce9fe6c99

SHA256
7c3a82f272f29cdad34d4ce07efd2a618f90b834fff33075bb6245fdc6b280b3

SHA512
7622b9fc273bce012f3383df7cb9dee255be5cb7d6126ed286de775ef91e6222c0a943cd139d0678a68d0fdea55a2105ff6f452122be707838337fa35542bb93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9df233253dfbe6f8133f6a30b8ebc8c

SHA1
d5026d678e61e1c029082287da5bfb557bc8e1ab

SHA256
37b16c7fec9a8f3aabe7e4e6b044fdd38e5ec7e6fc1ff40e740b956637844c1c

SHA512
c2979335241a6b36bf50e47de0b20d44866d7c1eb38612b3938a9afad16e75ab817dd2d661e6de72bbf03deac3f3c4a1b2f423d64b6e170b39a5b96779b1bb79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f7a74b72ac4c35629d4fd98cd2cff4b

SHA1
436a0dde119d882581138366c99a7b655f5734cd

SHA256
05c3f5cc6400c7bbe8a6a0b0110c54ec105452da49966ca6b17f8519c56394ec

SHA512
bb91453ba9d8800e42f19e2f92c29a292f385492bed271c266b8a8e19e2554a1b94e4e6dae3d6b0eac13b26a37317f77ff8b46a8f26b2f5a3da255fa816342fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f6911048f50c55e84cde1ad9a3ee69

SHA1
977af3a15ea7380524b9dd380be637c811b8fec9

SHA256
78d421f8961548ead1b782b409b4aab8fb1bfe55d7de866f265078c03c6f5983

SHA512
b4783f237cbc7322b8967c65734fa0b14c6a0361fa6aed8a0271c6d37904f6bcfdb13385d4af640e4f3e04e92b82919084dfa9372cdc44e77d886003c5489c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404009d137f783d9cd192e272a1848df

SHA1
a8fb05f91058742d10bca070cafe52e47de98667

SHA256
d9550ff7815bfbe1a5dcf5cc6185ee0fd7a71c6e86849f8695df52caec3cb884

SHA512
785113ece3665f64e2e77170bae2e42affb72370594b907f6c1228d6b0f5310bd262d7496e1dfd8a994c48a171f3873db34ce1bc47d9b1d038b32339c1ae796e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0584c548e5f8ba20b64f31c6f300a274

SHA1
84e63942c537e306a417ecd850c478cda6d5c660

SHA256
0531506ad2712d7dc045cfde0f8e4ce25570b8e93659060d52e4373aacd44c6e

SHA512
46226b34cc4b163804a6d369f708ba37a0602c9e641023654a909ff486707a158c3ebd312d5358c73baf89e3672789c374607e76518df84bac731234f0484a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab450F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49A4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit