31d337b99b0734c4dd626f9eabbd7e6454f076d2c4ee630305dbc7a558949d1a

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3dc71397e1da8dbe5e693fa3a11039f_JaffaCakes118.html
Size

461KB
MD5

b3dc71397e1da8dbe5e693fa3a11039f
SHA1

c808899e5ee522453426fc46ad61541748f3d9ce
SHA256

31d337b99b0734c4dd626f9eabbd7e6454f076d2c4ee630305dbc7a558949d1a
SHA512

f52c18f171e863e9c17c21352d3f897003a2c642f413da41984b5b101c697746cb42f7d8eddf4df84d4a8de227821fe4fc60ad66193070156191dee5ccc06f97
SSDEEP

6144:SvsMYod+X3oI+YTQysMYod+X3oI+YHsMYod+X3oI+YLsMYod+X3oI+YQ:U5d+X3F5d+X315d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A10C0A1-2BE8-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0641f53f5bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005113b5e25c7b9e73648512403dd4813829bb491f9eac875cbdafb0414256ecb5000000000e80000000020000200000003881a7a470b2666e6a2611348da081ab6678e94afc5ee8649062140edfc2a09e200000000ce0f11798b592b9e51ce328f0c2af9b0560a453b224c74cb6add2a5ee9c006a400000007e8009b549396494ceb743bd05c9bb215e859ad0413bceddffc2931ef7aeb24e58bdafb798a756b6302b142d96385b31b77823e70b31aa3d514a79b417d763f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000033d55f8dc24025438dc480be67e91e0139fc3d2e77561770e5c28607d29f65ad000000000e8000000002000020000000dfd0d85e14329cf254f1ebb18ed367e9d6b28b39aebb298b7a6ef2655344470d9000000023cc5ed05caed7b4132ddc850f7331698a50c57a5b9c21133d79dfcbefc982aea5a3731302a21ad9d1ed100d48b7a7f750f9a943e8f4a5b3e2d2b2ce1728a392c0c5b3842fbcfb039cbff9e22d3979124a09c22c7b881476146332298921cb78ccc7fb4d4034f498b943850d48dc34aa99c29c727b9ab81279bac4700641215745e8e56a545f051d9865e1cbaa77927440000000b8029607afd8e2052998a37926a00f9d0fd9bd7f5a2a1f9de9ef13a76199f9aedc2ffc5f4bf3d80f6481d0a91eedc6279c3989c5c112fc0afcf4464c857b6db6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424708166"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2040	1444	iexplore.exe	28
PID 1444 wrote to memory of 2040	1444	iexplore.exe	28
PID 1444 wrote to memory of 2040	1444	iexplore.exe	28
PID 1444 wrote to memory of 2040	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3dc71397e1da8dbe5e693fa3a11039f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e40dea95061262098540af6d02251f1

SHA1
a30211d0e8aac43e61e1a4231170d71bb507221b

SHA256
9ec4f9c3802882762868a8030f26c82108d34646c8688186ba11fa84e9ea0878

SHA512
5c41314e5eddda2b8ffcf3e7f4cb1fdb7504a9beccd69152ae5293ca5c2770319a289e9aedf944aa901185dc44b04075c24082e7798e070ff396974d967159af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d39d7dd0f720488ad730ceda8db0c1ac

SHA1
f9e9ecb761e68cd50c319a930e92fd39cda060b1

SHA256
47b4ad74b9bc072a18a6fe2592491e4f52365bc34b8a90eef11dc61971ef9335

SHA512
8e59e563030c027791397ccc0103eeab03a6d8dd9596e14a34a7471cba3d5f47141bb20dd4dba21a273b4c57bf41b976b50cecb5bc2cc8248361ffba4b152b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25bd351097a2a09891fa7c9a866b1079

SHA1
ea315e260c3756651d5c2e27830132b36596a3dc

SHA256
2c82f8f052b7a12878b6071ea31638d65e26cfb3f4b74317a3378e622d769430

SHA512
ed8a32b09b9edebe7a0855e21182071268994bbdc9f76fa580b1443f9adbd2578483b795f99f84b9239da4d9039e4ca8aff06222ac9aabea58b77eb9d40fa929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efed40c22f9c67be942f9bc485a37043

SHA1
0f3a999615b00fb8e29e5ea52787c77a0c72b2d2

SHA256
348305fb6060fae5e9d18d4ead217f5a9c7841eb498d41c7f979ae51f21e34fe

SHA512
90d761d37d992b037ff9ead2d7e9684e64e1310e76a648811e2d476b58bee86f19ca7ccf03bfcab9067516f2fcff4c51f41477fe855a1c738a9b6bad9e291336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15e82610f1be0b31ef2e03ab439727f

SHA1
76c6f17efaa47087f85d35c4b9ccff716e521d4d

SHA256
f5bf7b7b369fa4069630686f47f12a99bb771942b2ddcecc224da998513941d3

SHA512
bae8cc5b67c906327ff5bfc34b74206c569a879235d64926e4e9fcf7334627c3663f9470142f837ba944e24cdac5a7c68d877048427348c6894d8986603cfe9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4736b4bb44b36514a9078cd3846dc57

SHA1
5942ff018f2a9cc5adaae63a7bd84e08a18982ac

SHA256
7a88d1568c11f8d20406a7d263a95f94b2bf936d1690afb3496319ddaa5a3bc2

SHA512
bb19f4f96e5de66861c258a88b00ecd11232ad0ef8782c32bd08691ab7eb477f1ccddd034312225d0dfa04e096682352a2a68e39070e6f69689d72cfe672c494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae3e14b0b989287442ca0375ffa41648

SHA1
6c482eb06c9ee7cf8b628d3b55b6d449f15639a0

SHA256
84e4831ee3f402351d0e3f77cfd57cacbf5289302a1f96431b0bcdd20313257f

SHA512
fe817d7b22c0adef28af7596b6acb9030cbc3d9d6f5192541be7b7d6e28e399dc6f23c705f4ece7cb41bab26241229ee3592ff831e927d71097af4fe734e5aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166c08267d3518f94e102be23d17eb95

SHA1
288419c97fec31b382c877f7b093496c05ccdbaa

SHA256
2930e3754d5bb524d3da90bbc2f4b0d15c9416117c678fa415e707948c7aad6d

SHA512
00ef513d334fd765293a30ed97f9d19c3787834bd20a4878b6d28bf6ae2e5fe0212f48277792523a38d16eb23e812f8e904daaa8a7b64f1ce87c1f56e9c19adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e570361f218cd9511e2db9a23ef3f720

SHA1
3da1578d4a7d7f8ddc56a59781134793912f26df

SHA256
d1d107366f4f45df35ad445bdb55b1dba6521fd8fe47c90b7327c87f0e511f77

SHA512
4aebb93025d03214dd4f8ee10ee1501497b92a830c68a712d4252bad75166b6133ecdc0685ec591a51e22088d09deb739efb26bb2981dff7991d14fe9b846e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73618a2b0c53b00b895be6e053f0ce72

SHA1
6be071597c531618e85850f440e964e8899079f5

SHA256
4c582dda0e80cdda2ee0c27ca360d17267ada866ea3512479011c2cb8801f551

SHA512
8d69441fe1737b7073a6b1bde24fb6adb6c6eca47d8e54892a80a05fbcee2f87799f321ea8220335388a41620ab29156bc15c4f45962baded2953c89022f0b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5373957b065a55aca0ee32fb71823328

SHA1
637cd2e363f8efa88f9c848613a2e748ac876990

SHA256
f53b298c82cb497e2aa59dfa6b3bf31ce4fc016788dadff489b78d9891ea89a9

SHA512
409d4f3eca41ce7dcc1a39483bf538183c9bd57c09b5d40ac5771e570fa5839cf8071164ccfa89ce44897ecaa9e02277e34d57a3670877fdb6a0b27a4b5cbaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0b8ed950568055682faa2db9a15a379

SHA1
241114f1d4fdc40534a3c406c03e0f933acfd775

SHA256
74ac6413a39add793a7eb7bd7e5178e1fea909b825f3e450477c6ad179c735ee

SHA512
7918081338e624be576232d5106bb9297977476a51fbaf467a00741fa83f6d9edb4a0f24f330d3882583835ac14a2d646a42646b897047443dc42c67b7c13f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbd8c1134c73b3360705db1a1d04a262

SHA1
fbc1d705847c16a06b70ef7f9001b737583fc09a

SHA256
56e9b86ac2d12ee32c6965173f05513af6d227dff8621a2bc2fa47c2fd7234c6

SHA512
ae6b91bb504c1a8e3e8485bfd3ae2cb8886aa1f9497f22fe1b5e01b5a98b434b5ca0d8000a8d0c5acdef906aec6e2dafdc1f74d5f3ec2d2add4f4ed1dd37dc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADEE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit