ce4857f2650a3ce2a8ff1c4ae7b8531d40d6b4f6c0b0905bb84c4eae7efca5d0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30a9fadf6d72d111e6b10a08d363c37e_JaffaCakes118.html
Size

24KB
MD5

30a9fadf6d72d111e6b10a08d363c37e
SHA1

9b7d5a17fa05b5360513d42472cc2212de820d5b
SHA256

ce4857f2650a3ce2a8ff1c4ae7b8531d40d6b4f6c0b0905bb84c4eae7efca5d0
SHA512

8ee2ca49427a226dc3ae98e4aeac908f0418b1d671bd5206a3e95cca28e98f27ced8c7a4fc86b16f9ca79c102808a2524d1c49e04d849fb5dec05f041c564b5a
SSDEEP

384:DGvREQrf+o93DqIijAp5D4d/E9O/2872RxyAC4nAu0wUABSIDDfNCWGsfnmv7Idd:6p3fD30z/36TAfj41ZxoBNdDY3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307ca1f210d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14E6AD61-3E04-11EF-98E7-76B5B9884319} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426699139"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007787d5d9dfb476fe20f844a68dd10cf8275262d42773bc56346e972fa75e35ab000000000e8000000002000020000000aa3b469cbd8ab0bf8dfd78a7441fef2fa3a95b86d7884127454dcb66f0adf9f820000000ee43e5b7ba925378088f1f616bc81eaaf4f084d74bbd89ae0228d8b28bfe268b4000000017a1264c722ad95ac5619353241ebe74d71eda5def9f2650d88c19705807bd484cb6da1dccf4bb3363450fc86fc7708a9d6aafba9a3fa15ff054cfb0c5f3f952	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000005e4ae11b36d2edcb72143c41c64e3e98ed6a3a4bcd96749675048b70fae90eee000000000e80000000020000200000005b3cf108b3815c519676f2f2d075b88b151a0232d46d6741389edf22aa4adeb290000000c05935e77a721804d66ae4caf3f9dd99caa00f6f6f2816888382f04a876a99e783fb756138d7bb5b13b754452121009c10ad0bbd0a589cc98b23595fe81e9cf12ede42ff359ecee37ce281a1111b87b2e0ddd15115a2df6d82a3c06061c103b8b9d3a034a59bc56f2a46fb9e7996127c4a8487d29ba37b8602c9dcefc0be93a7dd55f24e1e3e2394e0657ae506f01a9340000000b7d59dae4183589568c2c5c1a08fc12dece9a8d2a98fe848f68ae56e94af0607064b9437dec5be7b2105c152fcfae006f61628b1c447c2a898b7a851e81b91ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE
2044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2044	1368	iexplore.exe	28
PID 1368 wrote to memory of 2044	1368	iexplore.exe	28
PID 1368 wrote to memory of 2044	1368	iexplore.exe	28
PID 1368 wrote to memory of 2044	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30a9fadf6d72d111e6b10a08d363c37e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13cfe3e09ee8a9e043a78dd2843b253

SHA1
e028f9fcc4c4e71cab5048348f9a236716925eae

SHA256
f00912462e8601310a1242d20b27104846ee4167d5dca0ff96b997f572f04118

SHA512
ba6b375f917bbb86c95264ee438e04461dfa6a71fa4936e68a49f48cc1d8f44882d3cf3bd5664f8ec8d5a4d9e7bad32f9aba797cb66d62737461502978672215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7f55a475f9873436e7d6156e18a9646

SHA1
aa859efbb07ec4da3307a8f9cca63d3f317ffa3c

SHA256
7e5c570b33495034f15227252184aaef835387d3635963458fc3ec4753e425a0

SHA512
bbdc2b6b7bca0061a182f0d3ea69716b8f2e3caa483949cfaa795192add93a6c55c2a615b480caaafffaf8b851b78ce3b2e491f87b0b93eb0519571f4be5e339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a980874bf1a2355bfbe545d6fd9b3972

SHA1
3bc8d45e9ba1dcb18021323c1e80e7fe535354bc

SHA256
9243b0b053df01d411edfe4a9df7a0082bb132017bd02706a52b31f43f6a0738

SHA512
bb2d9df8ec1bf9d9e106eb8d12f666bb170c92d16690efb65dce4e8acad51c5adddc0d19045bb0f4e9b4bbd5649d1d31df3ea887046dda44eec5e55deef85113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a54dbacf7801e002c8ab174b06b5d0d6

SHA1
b69852a2507d8d274d88184b3c8fbe90037947b5

SHA256
1e5e4230b1dcceed1e5c5b64e04349546cc727630a77b118ed52e73856be5588

SHA512
1daeeb76359dfd58dde0cdb288c48e52e98aaab2b6fc71b3457d87747e92cf2c5f5000823dbb1da49350251f5ddf7817eb23428a727cce2f6bbc77795e963002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4710a644be114fc7e942d891f283e955

SHA1
f5aa57bdfa00d37e2e16f15f2e46eb8e34cb888d

SHA256
62c6911f6ef41100989417f087beff2e97fa3bf4885274fcefcd3a579c10284b

SHA512
cb6b4a725844d4630f470e9b9b346719daf5a7ef0e1528a3b28e79d5fc8f7e7c9fe0ccf55a12dd537bf850115057429e1b469a3a6511ae399f919460165276fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8838bceb9288dbcf5c443f1d4c3d1f8e

SHA1
84462be5e6455fa5a6ca94f16b3a62af1fa2a701

SHA256
c2f4c577da02700c6d52bc544dc4c589072a69eccf69bf918188a14aaaa5fe03

SHA512
b4ed20faa9105e3a6b10342db4d22d4ed401d61dc7983ac3e83a00344f859be6529552d2fef421a805d6ca06c138375d213db0f25b2c4ee36c09976e6f8231ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
842d9040c069a493f18de21c1ac57785

SHA1
bcb73c083d3d52bcc35f0ad4f9ae39c3feec7fb2

SHA256
e762695b00db60ad3513916f92d9f2d009ef9cacb2bd42457d887abe3d97b9e5

SHA512
6981ae1893b381129d1777e7ce6e32c7bdd1cf3125b575090c66e220b415757952a09336aba36f59f1ec0a71c0d894b574440bd7d096900f5ca0290509804ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2db03f1db003f6e12e361d8f48abf7ca

SHA1
ded9bb886a60911521aaf047a5f8b12280bd93f2

SHA256
0e4870e451147ad789f14e539218ca451266a829a7597b8f5957fb159caa6afb

SHA512
dd8b2db31c5358358e733c34b917edc2ae56d7ed5797229a80b32ba4f6a1062cb2e31cdef2071c2f81b5e2f80c3cccf4c03aa3c05dcc5b912f22f4061630726d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08cd948f33854bcdfae8270439f06398

SHA1
ffbcfb43cb7bb75e9b237606dfe69f49e806a06c

SHA256
f604fa5ecd3a1c95ea34ac417c6a9368e3f5296684adf39e01812b9051258ec2

SHA512
f4132babca44e5363ecc725ebed2247655a43b6ce4db4b6c3ab939cd65c678254687256fc683fff5301863d370d8e788f88fabcda2b3bebe265db60beba29154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a8e8f248b6fb717df302620f150857d

SHA1
ed543c807509e6f0f4ea2e10c22261f58c44400c

SHA256
efad3cecc4b9a7fccc64403c19410a76e51aa9110f6fd30300246b251794d54e

SHA512
f09205ff837022cbfc4678afead94682e8367ff7b6241787c4f9bac2c17d1514d96208e9770419c77c87187ab8a500699208adc7b560be5e6b842ceb715eb756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e82ac9f9bb80856f133e1efa196b6cd0

SHA1
fe505d40eb21a55d2c3b4e7f6a58b3d9cc0b2e6e

SHA256
4550dfd7022e851ae67924ab2875e2319de4647b6ae844a9542b249fa45c64c8

SHA512
19a60f7be4aa7b71dd1b1f9d93998e881d8b9189227f88ac0d6b3979fed22764bf123943043363af261c849e2b56f7b65afc8ef4c85e584dc11b454b3f9139af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9EC1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EE3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit