36fbb9ae6a39bee3cb6e7d63669f2b1653673f1350ffc86b087db8ccf57e37a7

Analysis

max time kernel
137s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85a5cd9b1b6ea5afd94da2559ff86f51_JaffaCakes118.html
Size

36KB
MD5

85a5cd9b1b6ea5afd94da2559ff86f51
SHA1

87487e779a8db1eccebf68261fcf32d20293478a
SHA256

36fbb9ae6a39bee3cb6e7d63669f2b1653673f1350ffc86b087db8ccf57e37a7
SHA512

73a856196615a56f68de4f46ac5b065fb8510b1f01425f17b74081fe195db8abf0eafb2f728ec52f2a534570ad72164f8ed199ea50f3629d351cb043768754d5
SSDEEP

768:YSe3A4mIHV3/33zX/2jIiCqZhIA9EZ4q8xZFE6XB6uM:YVA4mI13/33z+jIiPZhIASZWxZFE6XBu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003b8a55dfe97524495a9d9b5f4fdd5c900000000020000000000106600000001000020000000aca9a4a127e52528e51293fad4357c381af84689e3e0f31dd0dbc0cebae9a6ac000000000e800000000200002000000003c941789269fbf75baf90cfd27ccbf26ca3aab086aaf3e83032a30bc9feb518900000000f12180031e0cd68abb525422129df1fb06139cbd95b9b71cc713cb6feb75a1c65f93aa166b45abdf3765ec0e1683eb18255f02161d7ef793a405487e24aae90a8fbf0ddcaf09187936c3f3a82992ebebbcc76005b40c2dad5541186b95b71719e88bce52d0266a9343e7ec644f05c79b4388d6b0e1222d71c31cb6f21f1888ded275131a8b58a74eaa1e609a917a7d8400000000cb582fbf50f673e842f4bfdee292e89368609d31ba356257b092f85645de71605d9229a2fc4fdd37b6d60ec784dc78f729ed0d6362476a2c394127ced9af0dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003b8a55dfe97524495a9d9b5f4fdd5c900000000020000000000106600000001000020000000cf4e68743687db2995d5c94dd06a7c286311e166d695d3eb93bb75b0e62ab643000000000e80000000020000200000001fd1a693de6e7165436764856747ede823f38e91e63ad2bf3a9e6bb7785cee27200000009ccd69fd100c921e8ea0c2e3d6310f63d60814dd3848efa2e4b59ae79d40575840000000531385d014816afff8843ecb64e92a39575a258e3f0534cd1d83706638a04bfd4af2de1300636eb3b14a02342b8e95a4d6da959e9069ebf953a03d707d417bf4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9022dcf8fcb2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423282089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{220ABC81-1EF0-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85a5cd9b1b6ea5afd94da2559ff86f51_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dca2adb21deb9d906c023b6880eeb1ca

SHA1
73e05ac1508dc3af90de88998e32d2ca85222551

SHA256
a3564da56019fdc8c5ade257dc6e88b0f6ec42290255c8fa585200aa8b9d0482

SHA512
f1167f00d1f8ef5f2a20823b5b9eb135fa0b076916ba9f1ac04bcad601007f3872de5c6e67000a0f050d81116d6bd6980d43794344c4946db83b33ab3120ad0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
954a72df9673c669b543779802305ce3

SHA1
64e6b24ee831b2bd998a34746e029da74fb6745b

SHA256
7ccf3772b89aed442f86f8fcca9197d9876d6b06a2fcd18ddf3fa9c63052f1a3

SHA512
20709936aff64eea21baf16c045ad7872bf0a80733cde497c083b9b4bc21dc7e09e7441204651697c66c8bcf61d0517678c993e0dc833fe60adb9543dec74b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f1347a04efa7ec253b42a20cec755db

SHA1
74cadd98ead1139ce991ecd91cedbaf47a4a9d0e

SHA256
9c1eeb5a6ab0b2821c81e8be0a708f8a2599fc6fc98950113b222df264e4331a

SHA512
2e18ff321012303d129aef9a9ed0e895e6852f8980bd533dd0cbbdffce72a49a291621209adcdee3c815fd459f72ef3165715c0e066a752e63b808724107a971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a14fc1ef781c06e03e27f10f5ea66264

SHA1
12f193d66110aa7a15b29527dfc40218f9f2813e

SHA256
eac4dd10057e6b54cb092b1ae2ddfd631e6be45cc80822748fcb1a6886d977af

SHA512
b7082e0a09bdd11c2c8feb62a3ef2c8097eab7f1f75db393177c05e70142947d32837c7f501d5d18149fd7c1980070f22161e750eaddbac85732bb3e2ed4f412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b3ce865aef9aefc5476f87c5f7cc482

SHA1
944d97b1d2b602b427ace212b07b8c0e421bcefe

SHA256
44ee546253c9a21c7a1909db734641d83585c85e50700304ea7946c3a0d07946

SHA512
04364266539555b08a06006b82092548324eaf176c3cb458dcd78d145b1768bd17ac706968516f413ff8fded24034cf9e39759db70a07db5ef401c94b03f432e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1df53315a86457eb23f15af92a4ed9

SHA1
59c732ad46640b526a1a459155a01f1fcfd053a4

SHA256
b41600e46e7cb12864aeebb6a7bc7daee37022823f1a02ae0875769a596c9c07

SHA512
662cf797bc3d06c0d079eb2cbb6f41236929b62d9cb690af32be890253faf3d3d674841881cb4cf003b93e253a636d5e9e6a71b8aa1bb43e557800c8328021f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2352faca88a866b342c28ffa4e286ac0

SHA1
8c830245c0a28ba835c38e76cfcfaaa0b239380f

SHA256
87fdaf2358971edc22ecf2eeb7dee96e913121117178f9e3835c06f25df29393

SHA512
bb042302472b643d51eb8a99e47278b1507ce65186a7d6b508a6ffff8c657bf9877a907c907a091079b452c5c188ed5921cbf8d681684d446a4a418b0297952b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d84a93212b4b5d3d756c50bdb2e5ae

SHA1
4183c23fa4c61e4a608d9f40d658132d112b55f2

SHA256
6e8a566a2b5ba3bc9605e0ee65e0666f089e4bb042c673f721cff02253832801

SHA512
66358cb631ddf3831f705825bcc8774802ae7c16912cbd96d695473c2991b1a2d0efa513b5a4aed45cfe1a81c0db1dd8bc570763bb0036d39de960e3b6ca3d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f89ee3e5c405f66ea0727f23c73794b5

SHA1
bad215864f851f21e1f678050272a825b6d5f632

SHA256
3d683c763c0c6e7192845798f27ce412c620953033f107b8584e421ebdeb7096

SHA512
ecbff6f8ed6816d583ad6ce1e64c03a9c6415d17165991e96d27622d40a08547f7057a6fbebb7393c4441ee8d5f4bb8dae40f5d8807c355b1aa7c7d3bae922c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab541A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar552C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit