1b47c37894a9ef4294922260e87e5aa20210b6e5ff0fb4b424bfe872167a0dee

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31038d09c27eafb0fce85c1d9217602a_JaffaCakes118.html
Size

21KB
MD5

31038d09c27eafb0fce85c1d9217602a
SHA1

d94cc5ab99b7323f5c5f8fd0ddc09c6e73f44f69
SHA256

1b47c37894a9ef4294922260e87e5aa20210b6e5ff0fb4b424bfe872167a0dee
SHA512

7fa40324a725cb533dbb0118af924116e29d1a2c68b8d074b67b2786e222716cd6ab61f3efb94387375144553361d459deb3ae2889c4c5a77619a33d8c67c020
SSDEEP

384:Wu6GK7o0lBHsdglQ9SK9IbK+jaITHRb9wibxxLEajkwEwyTTYwxRsxCTUnO/MeAr:+lzlQ9R16b9wibjLEajkHvTTYSRsxCTo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35B8D3A1-3E14-11EF-ABC7-72E825B5BD5B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426706068"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000092ec0f44014517395af1538f437885c4a6a249c4d220f7b441bf0800cd54e3d7000000000e8000000002000020000000b0457dfba0ee79c577ca7a7eead0ff3cfce1cb583da417e0513e5aee38ca1ba690000000668a2fdf29353c5599332062d84b72f66b5bf5e9b1f77643482b9206a1e5c58dde218fb47de368c7ca7aa28e477a0e9a4108570743d3ff192cb40dce16e2f98bd8edd740da19d071440ac894151ba15b62d7655cb56f45a4fee3c741c12543dbad812afcc5d7fae24ed0c88db98aa3bdd0d152d87008884d17e4a859e4de2b40e2edadd48a224bb389f58d67724462844000000043a2fe0e0d2f7d23aaed77e405af32220397d6f7378c1672398412534c3652320b060a95dd21eba2455a66e3ea1fd2da82b2b2ce155a51e109d0f7e27fee3271	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d71b3221d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007a7fbcdb8a669350e45d66b35922555610ee54e07ebbc98397bdd81aeb11b6bd000000000e8000000002000020000000d08a891659be00c3d980a063f485be4cbfc763d7ea3788f80319b60c5fd80bde20000000ee720db484b0181e8b0d69ff58c5c18f6aedd0a4bda0d3b301440feb07ccfbb740000000d1192b0efb0dc203b20a6b5e3055ccdf6a1fe928d14d1a34f7dc4e263202ef6436e44d48afc2abd7a940ad522cd27a196580c0e4a963b85d2a0d3148a036e73b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2528	2304	iexplore.exe	30
PID 2304 wrote to memory of 2528	2304	iexplore.exe	30
PID 2304 wrote to memory of 2528	2304	iexplore.exe	30
PID 2304 wrote to memory of 2528	2304	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31038d09c27eafb0fce85c1d9217602a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a84f28316c67db1d639c1a18bc07d40

SHA1
bfa4caa949c5a1630914fce6cfcdba1df402aa6e

SHA256
c282348df032b87e66794664bf1d94ae74e375b4c77c2b261a305133409c8690

SHA512
e9f3f19c2dc82cf2e0b39abba0b15b3383ab8b2f1fec7d6fe94465601285b608aeb489c878c060398357359d9e3a43b1b81b6c8ed027d249416c76518b0063d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6f1db243058b4af783187b20a0aacf2

SHA1
46a981be2bcc527862638cfe53bd0c5c149d0972

SHA256
5510dc29df803dd8afbc95b1a3bee38e589bdaffebf9f381a8cb5d5699139d44

SHA512
bf48784b7fe4cd6574e88be2be12333265a4f0fabd0fb911dcbfcb4b9d71b107796a98fe24144b660497df838ad738d21004cb2e301e72e9106304022969f1aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b983221f5bc55f7954068eb283c088dc

SHA1
45e67a7fe7c9e98fc904a033457becb9e220aa06

SHA256
5c2120f3a51fe11482f3ab621fa14101d2658780d55612a7e7708a0208c7f5f5

SHA512
5a0da87a747b6a2646df05ba03de92b5c946581eb9af09d1e3b6d26c242bac5850fd041a4927b4c6796517cb91c5f796ce3ad940672961d3379896a629b5edd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f507db8527c0fa92dac73b62a148d9e

SHA1
3269ba7537d598cb03e79b6b3471286512dfdd2d

SHA256
64048f9325722b2662bff807f1b857907cfe0d99176ab0a26a16dca0f4c3ddac

SHA512
345fc624f9527a16ace3c62b7969bcbab4f8c3a54f3081453e7bcf82e7a4f9da9e9cea5915e04d7e1435dbf1f995300b819d72191d5e5a225259eb0da62aeef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd09eab0903053901798d5f79c481ee

SHA1
949ccd1514ab5ce21997d58c7180648be29fc077

SHA256
2a00b62b364bff35b0d3d19c925c5c054b526fd86d4c7043d6483409d0f75874

SHA512
4e2d552c215da5e73c028fb64eefafadd724a5de99e62d863f5be83f561dc182ebc961e7af32ccbf20dc23ba01100e87a280e2c55700ccc74d667e68de998a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00e153c08a75e51616c47069b06e065b

SHA1
d4276199cb8b90459bf716c485034cd94fb87e8e

SHA256
990d6a5f82af8f2f8a4a4280f593a6345b4c786d6c3e8469fbbc76c6ed06164e

SHA512
47919a18b3b020d0a5dbdd5a6e0426369be4fedb72f91e05d0ff022e6d931acf75c001220088f9fdd95121bb38338f7e429800ca92502b13378b6d48d6646b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f41509c2779334f00dbb4d20ff175e

SHA1
30812fe7323efe0a7b0e778e9669d0da7a4092ba

SHA256
cf5d0495322812fe68e43dce399d2e4e70ceb797dabf8b025b34830cff5b7fef

SHA512
f1f57a7893e7f9b9c83bb7812128d049549fed8b2ca1f64b5f444a876b435c47e646f105af54bbe3495a0adf909abd3c1a1281c886e51d419ea208b77b378bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5cc4e9dfdf81a19a3a2fffdbb5f130c

SHA1
453a2c0c12f3cf3539aeba56c7153b9b2becd5b9

SHA256
f329d252c88a48cb790441c9a1a45c0f81db5ed3431dea978b23e427bd2f97b0

SHA512
71706d0cae2e63f174778d7eb12a1c8d073a8a548ea44033c0b3ee50c8214a120cec3fe33d59b4b1ee2d4a469878122c7d9570b12e758ce750bb6175e41b03d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ebf6836a71e2f3593c2a79aeaa67f99

SHA1
94d6e5ba082723b7a17f3c73aec212f3e1728570

SHA256
df2f8e1aa7e52e795d9da55e583f06fe1fbfa1e16e47f227378b522ca2b87a97

SHA512
3ce5b74e04a206443274a32696727f76ee78a10567732de5e1a4a54d86532b31b57759da93302d07c5f6bd9dfe28343ee2dfda6c13bea994c0e72e2e990b3b65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3b212175d827a5b2c40f3f25d78c216

SHA1
2798be83b3cee3e22c4e7147ef1b93b4cb658887

SHA256
b6653527cf3ef7e7cad36b940b13b5df8f937d9da0baa8370631fdbab8cec646

SHA512
396be755b2b149263308e5dc59e372873a6d1fa2f7e20e0d31e59fe87355c5b82059860af8c132ac3846aa86086a3cdde25e97aacf176b65993f6f8d204616e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2a88b76c95e10d829076d9e57334d05

SHA1
68d2328b4843da8d068c1dccd30936b63e0f113c

SHA256
65a1c0aaa774d2a5ede80adf9341e8102c5cf944a4f96069095353f78cc2e655

SHA512
252c9015f76f47260c6f6e15b3420bbdd2cff4b5f44c5dd76afc453788054b13beffb16e2214b7aa933e39c8251973b6055afbd336f0c6868d1fce03d7c7d543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5c0c637e5d73607ca9883b160d3310

SHA1
b5825ad2944563ed26d0a0f0ad25df3d7b1bab72

SHA256
ec26c05be28bf032950e04edbf845d1e030da72452839dba69cee99ad38b2a76

SHA512
884d8855016e38026e6b69e3119680e5e7f21684b7014ccb27ef29fc0660af89f8e9bcde37e80cbe51f33537c89b132b7c655e8a92a6da72ef2e917a48959245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b97b60ac7fbef092d9c7d7c43ea0a5

SHA1
d2de8e7a407d2edc77f9af6f0b15aa1336bacab7

SHA256
695a433e53644026fb52a8818c7c29e5ee589bc7e31c0f4d093552f691943cd6

SHA512
48cef1f296c214f7b0678a6762d769a312f55312b353c5ac78ac0a174ddc3e47a60d15493aabb423c45b2443f6fd2d8695fc6daef8811f9c7ccc4515a3ed4243

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADAE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit