d35825c8755e0f1c0ad4c859c01bb50daaf238220dc9f4beccee5da3efded1d3

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a0a9f87dab6a29bad8dde798b1fb58_JaffaCakes118.html
Size

6KB
MD5

31a0a9f87dab6a29bad8dde798b1fb58
SHA1

7cedd1d22ee9766163d62dd53b33a5f50b324b8a
SHA256

d35825c8755e0f1c0ad4c859c01bb50daaf238220dc9f4beccee5da3efded1d3
SHA512

defb8d7316b344e510efe7d4a1c61ff9b392195d254520db47e7fc0ca12ba800e0fdc8368eecff33c30789d5052572da849d8040c318fe861c3939592aae2c92
SSDEEP

96:uzVs+ux7ftbLLY1k9o84d12ef7CSTU8ZcEZ7ru7f:csz7FbAYS/zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000505d917f7296b8bcd98eff9f83f5363696f33109d87a61cb7ea92258f6d71051000000000e80000000020000200000000aae690cff755e975d71ab836d049d34703c48d763eb06d450f123bc048f046e9000000054e679000d8532bc5d64eb81457e6b9391f4d807be9e2c7b073d89141782424e35aa3a44b606c5f21f1338b3374e60329927c5a00ec14dfadd0c3872b0cca7eb70b8a669a30d51f93a46b8d560f342c1987648e85c91c35a51b51691948677d49214641f7e26abe3598e6cb90903a8001f5482baac9eed3016ff5808d2868ec2e29f6311866e2f7e21525e74ade513ae4000000017fac1b7b7319138ad91a7c4e648d2fb4c7b1b54e3659078d5949955e21685455cc571b6fc6f6a9fecca0a9622e7b73a10c021d8e364fb4aa79506de635c6262	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000dfeda2e4c88423db207ae7a445f20b91ab7bb92a10fef5cb62c0782ebff41033000000000e80000000020000200000009961c7f3dbbf4e0754737912d01b6324430ea7616a4261071a60cc3ccd071aeb20000000e96db88322ed57260dd1172e214e0a74d0f84bcbd2af473c31eea968ec6cf24d40000000d43d141dbbf4c19a9327da9610bded400f2f0b93ed58fb51c3b590f34476c1a28bc479adbabd631fc5b25f6d2e1193cbfe525bbdb409c2b3e9a410de384f1e2a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426717991"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F904FF31-3E2F-11EF-B36A-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401cf7cf3cd2da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31a0a9f87dab6a29bad8dde798b1fb58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eb0890f7da1ecfc0933107df6cd272a

SHA1
39f986dfc8844ed187e94635af7b546f843d506f

SHA256
209e1ed3b39efecf138c7ece78c2b639b3f37dfee48a24042b6d9f7d6454ac5a

SHA512
8861585898797153cb643a4dabb454c1372e8f78eff9947c0c7e8ed189e6fdffcc580a1856bd99e52cf8e92b0efd5e157c5b624bae724ebe1bbdde7839c5a5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e00a449e6c6e347ff891ad98e447ee3

SHA1
713bfbb81d9bbb42aee19ff1003fb87d38b17082

SHA256
9955180ab13a82b3a872f2c19f915aa2b6d862d8982eef3f14d7a34aeb211843

SHA512
0933e97532b560c09548f5ad406353bb6daa4ec85fcb339d4d1eb32cd1afd6a78f43af1f93340b975f674da06a810619987e17fa4b6a4e7e05ec7a0eca880baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8470ba7c66834d25980178c4ea9729d

SHA1
18d8dfcfd18e0272b498769636d2271c9ccd5cf5

SHA256
4a460ab99de85e2c4e72a4c76d83226bcd0285864c03ac840fa5370cc040f601

SHA512
66383a28ab95e8cc7f61aec6be8d9084e68120d13dae1af13f29cb4c3914b493b760cdfedda4d345f54ece713f954f88eb7c2f3d88c789c28e206547ced0fa26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bcf7029b5bc5ca046f37c7ad381a156

SHA1
600beba5b0320aee60b6c6034e73c03f3b66606b

SHA256
6561164583ea0b4a0ccaceaf85aeddfc2eda2a852342227bfdb4d3da9d1aa768

SHA512
9b4c542d295afebb3bec9396917f0af983a680607de02c3d273c1d015b7131f4673d1e78918048ccade7273e3a01dee6a0f864e14982dd313dd72edc59ec4dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27b9110eade1639a02d04c249d4271e9

SHA1
acef0f6ec4d9fb9c685418d23c24a2cb68757d8f

SHA256
baddebb8d1b020e4f58c602a42f57587eab3e78e0031ab45df25fe1d8de3d7d3

SHA512
e0a607f8b9fb8d84005b356953fda4db1f421faf5d61e420ec4df392c59b4a049961f7ab55eaa0d470bf41eb8f580d2d0a926ea0c33de5b35af2be7fb9f2e308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18451f63368e7fb07729c40b365b7660

SHA1
8bd4b0ec14c1b1e5622540ad9ac93421c3a21821

SHA256
31be6810375e27b5d27412b447989e12ebfc7807056d556c0d28fd064f42372e

SHA512
4e61ac09a8b0f4de13b852bc6916c39b0194db43bc8743ce82fcf276494ea5e40be231b1ef4eabf01c8579bc30f9635ee24b9418399eb800203fa3c2808a46b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8590f0187a645c16b9ea95340b91d4c6

SHA1
4290a034c3f5f58c6d1aa540bb64983441a4372f

SHA256
0a1b5f0a4a9894e4c103cd0d635c782c1790d02c5d59b1edd20e03d18d1bdfa3

SHA512
6db114ee986bb3b832eca8869579a7ca52df4d7fef7b199a472d50784fd18991081832ccd1adc0e23dad219bbacd9ef94a5c5d2c971b73a2f11c4fc2c9bc5b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cddc8a46a178203d655406ff3763be5f

SHA1
3b9466e60547429fdbbcb06c1933d9d4f460f0ab

SHA256
2e36a1ebd86c08f3645509ee5a08ef51d980055cda1d8f7906ba2f90fc55fd72

SHA512
397ddfc22d984b77c5760c29f616686f4682648c57211d1b0c8083d78eecec8dc7f53866945f20ce96bfc47c8b78ecb688d4b7fa39b9e2385e12d8bedd5f342c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
258aa229821d379a484912c447979db6

SHA1
4be1e6b3fd5423ceb009987014d848d4542b41e0

SHA256
9e2bfff98723ff0d745190f21498dc4849e116cc2deded38f759546be6fca3b5

SHA512
7a7d80422ca3c010b0be17f2b1529f54116d8b2363c6369c130911ee32c23a54414b1fdb0c91a0da81bd220613e06dba3d2df94a8233350542736403074a0221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f835da39e8c8ad5b61001b0ce0ecfb9

SHA1
790a22f6b76afa46c89adf207d196945d08ee98c

SHA256
55d320e3a19ff035b634ffe11d8aeb4edb021a9e42c050cbce25a3c9d739a817

SHA512
c8db831cce946931c454c252b94a86d8978815a6137c34a1f332fa4b3a38552d82a5e49b3ae9f080da59a5b142da240971a5bbc35f2aaf88a7d13e3882d325e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c94384e960fcd305ef14db0748d6d785

SHA1
e9daee6a9542998bd23b378aea5ab3e425a3d82e

SHA256
e7564a74f131806a3dae39f227b9dbb16c58ba2beb5d2ebcb7c79aba6fd74635

SHA512
98815191c81d71fc5c19975b887075063128e90a5d64bb4bbcd615c71b5e8b912cf8b5b9f83ed49c69ca4943a5d7c794a12675e66d16e2a2c2f193c5ae8006a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5027a15c2485c24d58c96aef4a909f2f

SHA1
7db000108b58e4dc4d7768d367689147077dea0f

SHA256
bf5fd91de4421ff42f7ff78aa4902c6632b94d6f6abe6da2e6d7192b66b361c5

SHA512
3e27f7ea65a5affa03205e5ef0ff5d573c2818d13f52c98162877ad8c20fe09060d27addfeb8c3f0f8353f92655e190be94d71c222eb3af1b6afeee5fa79dea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ce65853f5428c3f96e4d4f27363aa5b

SHA1
d9464814a61e7d7ca4ce96616a681602246ab717

SHA256
081c88d69b95ed40f9003df307968ce6003c52da55d6cba39f13e130a00ddfb7

SHA512
505e39b711939e05d3fdacaf395104efbaf5287749f308117819258e3f3f9dbb988ba67071e8c15fbc83ddd1bd815ad66a1bbfe817f8bff150cd8a973f26a05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e23e7723d01f42b981a6547b288c46cc

SHA1
33a9855126f74c0ffd0dde8894fc9cdb8736a801

SHA256
9b4345b31be93a0640a5383afc0dcb20bf468b3125675bd379f4f73ee311782e

SHA512
297e0f5ce9509558c7de3828752a6766779251acc82bf0605233be9400edf776284efb1eb1abc33c58cb702d09b3c35638cbe9fcee1b73d12bc170b67f863667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e279e2acaf52a4b903ccac978acd14a

SHA1
260cdfedc0ff13e1f5d0102a49d2f8064802dd7d

SHA256
30001f3cb29f4a79bd72cf63f51f73eab80f29e1a99df61421d0b1923e536799

SHA512
88da30c5f9aa13725436fe3372f4bc1038e4a93725432bd5483c73f7ca7e4ea84158d814804ff5b0ed9fcde5472d9dfff9b3af60741d5849568befaaeca28c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d04e2cdedbfaf01db8c7883f59d0311

SHA1
41e08525d976d0d46a5829ee0984831dd038232b

SHA256
be10a420b2566f1b9828dc153e067f92752d9110c8238f74541c3b0fb3d132b5

SHA512
067df1e5b688a6a6cfd4baac9152fbdce5577d2de7b6c73a93c47a08ff0971233db20a6dd03187b29ddc3fe497d13dd08759bcfd4f343504d6bebf99d044635c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f70adffff82913bb9e81895e401646e9

SHA1
347d596f5bb4f049ebaeaf85b154c0425ec6e0a0

SHA256
aabee650f0550b42ac43fd8b135bd4d1002a3ba4f2c9be8d796284cd864be0bf

SHA512
9c979b02e8d498d8a7b057754e71e8acfa823fc94235d4ebec8ce3065e203392727a5570a8ef39a6873cb3673722670c0d96a518e9e5f21415b6042d75f4b1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar110.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit