c32c046a4ce7ee86bfb353f8aa688b00558ce60961a1ed4a6272e62084ac43a4

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b387c6e24797deb233db505a77d24050_JaffaCakes118.html
Size

82KB
MD5

b387c6e24797deb233db505a77d24050
SHA1

df2f9e4811b1178a5c2aeac3239903551272e531
SHA256

c32c046a4ce7ee86bfb353f8aa688b00558ce60961a1ed4a6272e62084ac43a4
SHA512

9b371b2635be645673bdaa5ba35bf1bd924623f0b811501bc9dcd9de704fa7a35b1ca6f90a04915569d9fb0770e4d2117e6e683e4edeadf7734d24cec70608f3
SSDEEP

1536:ArG/lZ+6waGi67UFroE9MSh9MveMa6buEr8W9TZJewWgTyz7bOAlLGDCquA5HDg1:N/lZ+4IuEr8W9TZJewWgTynbOALGDCq+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405466cae9bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000051182b952fa5b0ebad4ac46120bd6a1bfa6028b94ed2f61656df75c2219201ca000000000e80000000020000200000007aa35722dfa5135183b4cf164f4da66084295611744e4e6c4215e5f0d38dd028200000006539c853fee665576433a15ba89680a25d5477c88f5676dcb161aa4e4e61019b400000003da6c709adf09c646a80b3378209edf757214e1a1ed123bdb200713264a462a3bf6a4e2bc364c1cd262810646641bc820d64220f54c68b3668ef6c2281cf0be9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000f25df6d0cef9fe97b18718123d65313f2a05cddeb9d93acd2e83ec9a7d83e1be000000000e8000000002000020000000b58bdc3143cb3bbaf96424214b73cdf52dcffc94c05b39a26d87ca79f19872eb90000000bce36a6be99a2e8ca2e95990bc1de0a0b0ac0a3c4aeba40a2f6fae02a87273d948504b559484d630772a21fdac7f7b196a3bc847bf4f2bd2596733411f38301199e60805b3ff35540fbb3eec3a965d61f3abd6525aa2c6ad046d17a9c1ec755e76d943bf10c82a5185dda3330c8ad76c59a1572567c690a54b0e3ad475f736170d3ff40d093715463254f7b2cc8677794000000004424dcb18e6d74b8a786a78de10291645f09f0a6f90f92a6ddfd5100d353651915e99b7f86b635439533cc379aad932ea52b30487fc1bb01819337477633932	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C37E9111-2BDC-11EF-820E-FE0070C7CB2B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424703139"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1448	2432	iexplore.exe	28
PID 2432 wrote to memory of 1448	2432	iexplore.exe	28
PID 2432 wrote to memory of 1448	2432	iexplore.exe	28
PID 2432 wrote to memory of 1448	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b387c6e24797deb233db505a77d24050_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
018980e7fdae44456761f325b3cdb962

SHA1
5112585ffb120d83f158dd586d4b91a863333c73

SHA256
68d16847e225a84de3ab897d39427c4bb2524581f6e9b256512c2b069ff9ef37

SHA512
a96528296b9a2a8ed132a2935cc81e0136cc95093079460c99ed980a0c2d363c85c50b7aba5d46c4a5eccde4c161491f31f6f7ad152b2b28be0278ce5f559e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
960d311e5991b8cb5e5f9d4b37979ad4

SHA1
d4c6e33ab2ae7892fe130d6bc21d2765aad93d21

SHA256
5f8bb65d82147095635b45569e97d3aee0b94fbcf986208c2d92452584c34df4

SHA512
80f022fefd58f4fa3fe37a36d3f833f326c8d285539452cf771e76a1ae08ddd7aaec917310e48a4a8c50e4e96b2b0f7e415a30b445c192f6eada782db4b2af28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7dced5f2a70d576b4093d1e78db5177

SHA1
db052a298c7120d1eff62aef687024ec0e75c21c

SHA256
dc367da5ee59b964561648d52cafe9f82c5e3775b47baff4c862b57dd627e80d

SHA512
a718b1451df09b35a6ff2a0f7d5815183d58d0046733fe09ce62337e5863093d5eda0fbb5741e580ef38b869d9e1f280ec806e2957c4ce2205b1fe99207c918d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc3c31efc29595fb3711170d93f97c1e

SHA1
41f69f21b2b28cbff4a29fc120ac810c7c10ffe1

SHA256
70b3f91e104293971b63246b7a66f625a7f00ee3a48f606ef397c0137f162d52

SHA512
17834775b95824f9ec22df5dababa6a1081f6977638c2dcdd008d68eacffc3cf4a7d2b5ccec7ace9596d9e928fdc677a0fc3e59ab66b4025f7aa46718922c266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ae771902fc70f4121d42f627553e23

SHA1
6c37f9df73fa57718e12f60b2d87bdf548ed79b3

SHA256
540c6532d75d08c20df0d98d7815a2d66e323494cbd975e58f7523b54d3b7c9c

SHA512
c7f01469084c5646dc07fa4078a52ee9f83ba2a01b93356d90ea243f06949737d377ee2e4a6bd2683155c3a1f41b2924f969dc01d653cea92238f74f4d266250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca10fc24d8a27cd46d8ffb296bb50bee

SHA1
ba108a98a5796a284b95fff1615b574709523490

SHA256
b67762567adc0fc805ab4cdfd3a708615467ca37a79bc4b031ae3f48d59b070d

SHA512
4d8345eb3877c003c3ce9887860caac89489ad661dbe8b9bd16060e02095e3411643edf6303714f1fb8fc35cdca6d41c871ee9bec8c00709e6b61b4767cd8ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f5d7c6b80518cd8de032b2a11cf68c

SHA1
1a482b9a59667c297aef3b72b5b331c553503622

SHA256
006d43899a68305c9f31adf0f7919e0e30e96c6decfff0c6a4482df75d1d34ba

SHA512
9da9cc4f05a0ca66d40c2ee24af6f9f4eae965be569544b1f263d0db85104d39d48701fb3a9296bd26d5d84d724524c521f5e2324c7744865959f6107e769428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebb7a45c3ff771f160b9d70caae8bef2

SHA1
5bbfb5be94d9e4ed2f4f4fdb82bf83c2934c1e5b

SHA256
7de37b9d87ebb1178bb0236f5a97f618c9a5e945e4d952f1678141dc8d890033

SHA512
e4d910727b52d91278dbcdc7c246a05d39da0ed23b4486bf7d6d570513bb2c437c87cbdd2fa42d40eb0ae96947ced54702163ee03c6a02593062d09f35f6a944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf16dfacc1b165d8d3beec5ebac20d31

SHA1
cf3e2383cab82361119902bb66bcb0ef8a3a45d6

SHA256
55f3aad6a0c885f5606f9e950176098fecbb6b59657fb3a10257dc9d82d53944

SHA512
407dd333e6c405289e6b969070de5f10b2713ae24c7a29261ca9cea23ba594ff865ff40202f710af10124a9d5e6cc1999e3fe23f3d091d567c3b7189c05514ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
866a01ef4d05bef441ed4c952780f800

SHA1
f06a40244d9668c9926286d0d41f26984037aecc

SHA256
5b72e3269926d9751839485b88238bb98b903f106a1f1d776d7cb65da3b91400

SHA512
a9eb30697f69fe045a000a991609feb7ca18efd59311fc4a76468fefd396bdb9c5843f6a5c4186c8946c23d2073eb740962d6e8c7b1336fd636bf25ea1b71930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63f102ae92b3f03693dae8c462037cb9

SHA1
00e21d31e82dad712aaa05fb2bbb9349f80a7471

SHA256
f62a8365b72120a70ecc799b78ae596a20a2d7bd4e47dfdc8e42c69f58f74e3c

SHA512
be53174eedfc5bae8aa0119e0452840bdd00673d2f8ad469f8c3669ba7c4ff1ba31d835e2452c6ddf68be252e29d5574f99e1a0bb190e4d65f76fff6d0deddb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e770406d84295232dbd922059d515fb7

SHA1
ff69a46a476cc60f78bb5d0c5f7e0721f98dea10

SHA256
078d9ad574dd747d438d697e061c4f3e8f50ef9897dc5aae2c71c6bef9a6d4c4

SHA512
a247b1ff04d8afd388a53c4dd170907ba88e0e1e37b542ef2553a30fbfbdbbdbfefa5fc4be5ec4890e3542ba7d9be15d124063a112e7a4ecdbbe8579c98b0f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2378.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25A1.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit