c09e38836ed2728edba56b20e897b1733e70211d3675752a2c9915e1e343631f

Analysis

max time kernel
117s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

318c8af2c61493ba2bf56e2c36e13c2d_JaffaCakes118.html
Size

53KB
MD5

318c8af2c61493ba2bf56e2c36e13c2d
SHA1

17db185002b47334321633c7f6ade786ebf7d775
SHA256

c09e38836ed2728edba56b20e897b1733e70211d3675752a2c9915e1e343631f
SHA512

24d62a0b8d2e25bd688c71908b36004a65dac0876b8d9fed5fd9d08c9aad2046e60e320cc5ec584f654dcea6691b0c283c5a7ac34e47bcd0f0c1ffb76428efa3
SSDEEP

1536:9kgUiIakTqGivi+PyUErunlY463Nj+q5VyvR0w2AzTICbb2oh/t9M/dNwIUTDmDX:9kgUiIakTqGivi+PyUErunlY463Nj+qZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000009f259e8296ff31300b93ecd7ed71b072f0471c1848be9709558dfc397320f12000000000e8000000002000020000000dade2d734da11b3b4237001da549f79441d80a7c46b42ff5e465b4f4ebf893cd20000000eb643085fb67c0e7c1791fa5ef005c337cd9a3bec0f0fd89cba318e7346c3fdf40000000e6e732fb63d54e0ad100781841340c14972126af12056e9e538b72e8f3b0c5eb1d91d135c3b5344a92bdd5900733bcfd7b0818e989c8bfce004434cc4c62a4df	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a48f9eae89e74136e27961178bfcd29e90d859b95de1687adb9c87a2b75ac87f000000000e80000000020000200000007f1a53cf122eeee61590c9514929b4081c511d19c9ba11d4a68808ec1864423290000000f27093ef44df337e7be8dba5c88f50f12e5f9b9a328a7bdff9e93620080ea962cf41aa3f566246a99673f5016de00038f386384bc65ef9fe98664e619c8308c987ae2faa499c635c2eeae96f733eddf65ec58681ea0d2ae324447d6dbd125e0c6b28e43dfaf106e58cfcb6d6e15947edc94cf12a54c026847ee47642552cecf1ed0995e88911e8b8275d20584cb2fafb40000000bc71e54952ff131808c57818f555e1ff9e57ab41bd19a5cf57ab3b60b3b692d3d11e8020c8980ab6b1cc4523c9a59da6bb85e34ad17e2f355ed144ed4c838c17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426715308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0670f8436d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC276961-3E29-11EF-AEC5-4605CC5911A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2360	1876	iexplore.exe	31
PID 1876 wrote to memory of 2360	1876	iexplore.exe	31
PID 1876 wrote to memory of 2360	1876	iexplore.exe	31
PID 1876 wrote to memory of 2360	1876	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\318c8af2c61493ba2bf56e2c36e13c2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5767dde30898282525e1899126ae87c2

SHA1
dfe94c2fe5227deb9e8c254ae40c76e746c8a309

SHA256
a93fb528e57ebae3de3822531b43ca63afaf7a7528a52a3bc02e33e5ddc5f1e0

SHA512
6617c54742d2dba8a010ce83394b5bfe27524f87b18ea28613c006f91b136fa80f7936540c1068e2c98dd85c276d01206f6ca8f74879ef6211b4093f4ce8e211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd7e6135f6b930a68a87160e62c03cc2

SHA1
0c70e5d1228246c722797d47aaf82680a950f7ce

SHA256
3ac15be599b50d979981c997400340c5052bb79d846907e112d960397981f31b

SHA512
6511314848d04aeb707d97e0b4eba525028aa2c024cec8e255cfbb78cf903a8f0d48e7e9d4b270f31bfaa97593c25c535a15ac17b9a99d067732e7470dbdb59e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2548e68de2f93eadac35a0e1aaba2f3

SHA1
4d6a8bb5da8f7558072ee034426b02a5ea3d98cc

SHA256
3002ff43e64c46a622b02dbdc07196cfc4ac96103f05155d3989ac0b44fa734a

SHA512
87e46fb0e9a30d2d7c1bcfbc09bc65e5dcd05670cfd70388007c9baff1655dda3f7027f9dac5c12451a7baba5378a7c8d3b84b6a1f51221037e75c259355bb19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f9ee67d4dabe017a9ca54c09ff293e0

SHA1
7d017d05ff2674e522f1dbbc7c08c359ae3677bc

SHA256
b31daa99262ec6680aa1c2becc4170add72cb124fac2e70856a8ac767f51a311

SHA512
25c8ade273ba581bb52c420afbe6b6bb0a97cf228bd850780bae791d6604027deadec5b33db4631b89ba42cc40be1d43f3e9b9509694e2495744a8e51e53b5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1088847656b802c0d38b9c255743ba0

SHA1
30621fa1b4357f4e82e4d3d80a2a8e157d4019df

SHA256
0d43f2a460c6b16b080bea9070e1f2fb40a4c9baa140152e1375f1588be53c4a

SHA512
b291847346cb1524ef544e0c63e4bf86326fb6422371333effe1954b9f4fa9f8fa8754ba0bc48e96955a792e2853d67f4ddbc5a449382b3e319230744011827a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45406fe52bacb02a746813913e7261bd

SHA1
a9deadf80e235136e8f3a1ac2abd6ae490c69c16

SHA256
e559d118a68e7ab4e9e49ee55a2de16704fb682da57bbf415479e17a40144459

SHA512
a5cedfa88b73b9637ef1f16d9ca7a54244136fca13a90a6a14ac6df2ae3ca7ca29922b4a19f70c4d9bc8eeb7dfd67be5d12b3823b852d889fc2ad567fae6f196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
511b05e5ddc7a8d91d3dc13fa5073cd4

SHA1
1c9ecb80e76a8fb75944e405ef28de04cdcbfcd7

SHA256
5c29c91fd10a4514dd2452a3310c7daa8f3dad6f1548437b0db7b34034367d04

SHA512
fb34c765d37be2c905e30b1ec9a08e426aed9cb67c020630e5566f742964ccf02bab6d862d51383f14c55f987a77cab6a8d444ffe04d55307d51e36c0d74c4e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4e58ffb0a5632265d6bf1ed72eec360

SHA1
44653d2138e7fbcf198ac2dc0e7f9f3c5230ef95

SHA256
e2a217f8f6be879663d81ce66387974959b59ed967d9e832595c7a4e1981fcca

SHA512
16b4b5cbd58ca772132ac250ac30dce938745b8f5ce5aee873557edbb2a390d9fceef41dd0426ea8b33822a8871be20bd610ee3cfe23c9e4e3068060afaeb074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab539F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit