826c93bc44fd1179b5d11f622f0f47b1e88976285527302cc8e5a95b7467f274

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html
Size

58KB
MD5

31bdc4dd751f96bb51192542cd7cf6a1
SHA1

cd05993cb4911a1b569d45e56cc798a518e9aa07
SHA256

826c93bc44fd1179b5d11f622f0f47b1e88976285527302cc8e5a95b7467f274
SHA512

f879f467a84b13eb30244c7e719abf242c4a2ce7b4d709abf3070c2ca2c757f4a51a0b4770f0d461a9bd2b6cee40ca89d8bb37688faa0935b1f860fe60778e40
SSDEEP

1536:gQZBCCOdE0IxCQNzvf3fIfnfkfCfnfxfuafXfyf2fMfGfJfrfFfufufufPUfmfrn:gk2C0Ix5PAvM6PJrP6uUuRTdmm2nUOjn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403fc87a3ed2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c43695d0aa4678c9808086aacdc0c6f9bfdc40a87f14a4637685c1d19305d811000000000e80000000020000200000003e61c5f150173da5d95110e0e713defbf0d0c0b0eeaa1f10fed939d77f08e8c190000000c0073e9d050d1f221bd1e16feb5fd34bcb7f4ad43e0f4f15218918229d95b601723f80ac9235445fea689989f89edd77fc022138430562299fe7ff32661bac0ce584d09248b90f36493b901729068645427b1935e0c9cca5ab9611f2a2026d062941b76835f6d63d3003fd3f65d36e26d4e759ccf635e80eeb58a22a2e666344836a6732418a6beeb94e613f1bbf886240000000eb2db369d37dec1dda2b69e4a09df1bb6b8e20d981433b7e5bec7fb737ef743b9f17169703d4124b6b6c4be289bf21af8cecf05989a661f16a8e791ba6188b9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3C7BAB1-3E31-11EF-B707-6AA0EDE5A32F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000001ca677ebb7e7c2b8fe44e428f7805ca471a4819a08925c01eb3f8724c692286d000000000e8000000002000020000000bcf9fc450b8e1675a0b15be24c0e0ce399c05fc18faae290fcb2648049423bc3200000009fa0baa99df2cf13d986cc76ac12114205d676e0c454da1094dd77a85f41efda40000000e132c642ffc659ca0b01ad371bb044a5e6cb4a2166d2168f7617fc1abdafc1a1b504ec70aaf92d7243f1f8ca2545ad58886c9bf0364fbec670b300f04500bbd2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426718707"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2436	2416	iexplore.exe	31
PID 2416 wrote to memory of 2436	2416	iexplore.exe	31
PID 2416 wrote to memory of 2436	2416	iexplore.exe	31
PID 2416 wrote to memory of 2436	2416	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18a091938cbffcb88a9325d32b6a96ca

SHA1
78dffd6138f88d76277b05f0449a5ac158f8f281

SHA256
c90645701703499b31664e1b7cf83eb9066fdfddc5769712c221bf929f8692ed

SHA512
86726ce345f81a7ef1654398f725e6b2987d149fd7fa0400b85d9b2dd53b0ae2344f96a85fccedde6afd7f3abe637aeaceccc4ec91ae038bacf5b643a6cf0e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
658f5e0128698b3a6725d350f9aeafae

SHA1
46b4f6ac5893b12c58f483fd80b72c9daf698fd8

SHA256
045dd8b331aff9b0f18339b94254ff1ea0af711e648842bf3d631765b5318e5c

SHA512
036f1858343a917257bfcfdd185d2cfda9968a3e2477d9055f8599d2d19860a6d1ddff86813b8c314889340ef8b614bd0ae91a0ea5ce4c6be2a316b38a0d1e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15993dac0bc63b747b386ee0dddaefc

SHA1
d06eac5787f7dc385610582cd54e57569eb8283d

SHA256
601ce19146a0bc90a96f72fa7eedada4df48169f3fe512a08ebed81fad0b8e86

SHA512
12bd74640dc6610962a6cc0d54126362b032c59821a1e0b8e6d961c4432cbf799b7c1a8c08ee1e1f00d871856ef495cb530d3437e3dc9dd144d37171158a802f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
677e2a537510041259a44d08f7d2cf05

SHA1
99e5e4fff56cd6b137a303efe8ceaec3d90a6e23

SHA256
c624fd79a94fca9087698634590997d7877c5c760d72a8a17bcdca7fd0aaf3e1

SHA512
fdc65eec852a4c9cc5ec944979c8ed68317473d4254290b26d5f0d0675ba5fca8f4a8dffc298de244e13b103c1567d00813890c7e22449109617d3242a8c4069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d215bc8a2cfcde3fbdcdce9e8e2d757

SHA1
efc2c0170e62a46b1ffe9db6b16cb0b285ee12f2

SHA256
734e889240498fff556afae198c883e67e42f616eb5b3e3a5e12f5cbbb8c22fe

SHA512
8f872fa5c8aaa66f2c2087a1eb5ab6832fde80aa00a292c0dfb6be693d7d272ced64700f1c9417525193b062247347ba752dae6b2eabf30d6e0edc6819702cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c9b79bd0d8475249b139d2f709fdd6d

SHA1
ed9d9dd557d4a1ffeb450e96ca187910bcd97b2a

SHA256
c573b8eb7386a0c17d2486d4632364941f5bb546cd13361e8f082304cd1680ff

SHA512
67146e00c53813bd232ed12f07b4d3f4214e158dc506bf23484ed4248f5fa8fe39358110c9c90b2d600c1bce912116c3c5f50bac33bb0583df3641e18279f530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a814b33c66e33fc15ab2267e4dc9190

SHA1
f7178c5855338e9116df9d19ad0fddc9e9d42895

SHA256
c0e511d58442b7d9a79043b37f77185433f2b4aea5e235284cf62d833cf3898b

SHA512
228a760848747dcf286f96149ace561ba6f38780aa0962937187dd1ba243c78082ef0e21b2f311e0223eeceb9c1388b95576545020ff19c1dd308b90e2c458c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf9aee29040d5a46051c8eb0507b133

SHA1
6e16f5fd9e66dddbed04d3cf217b464008e713a3

SHA256
0cab793e9dea95dccbc23319e96ecf41f865d715d9e1f8483e2928f335d590e9

SHA512
66fdf946234d9a3fb77198159b4429e2399de60bf9523cc8cf1d00ea74fd6600df6bea587d290b04f3bca9da6345f570208bd310c1d1ed95842500a22e16e7be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72fdc52bd3f0a260d77c575dd4c78607

SHA1
f80a23b965b45ab882b1f03a6e466187ad1d3e66

SHA256
cc1087e3bd6c43db6c828dd6d6e298981f4983ce31f9436695c6fb471b87d352

SHA512
93648cf7c896eb88b9344618fcbd22db7beada6689562d4009231bd10c58e00eb26c49df8a717ff9d9d4b3d9928986d0f0c2a25528cd9530ef7911a633b512e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9f01b4500400b180a4d91cd79688ffe

SHA1
902c640a129021924490a88e2cb18781cac621aa

SHA256
b296b3e0b17713c1bd0823ff17107c0da1f20360e1ab3b34288f0bf9fd49d9ee

SHA512
4ed036f995630698ceaaae109e3864a36b746cae6013d376f4378fb5beb94b1f4e9de7372c4bc4878cd0ba2aac2f4be65f388a6ca6acf56429cc72626a09083c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f97a87d879fe387993b3d793799a0c1e

SHA1
2ca87c95c0bd56f566aef1b5c7cb3c8baf7c755a

SHA256
a284a67752aef6820f538b25da245fbd7ed7076090ed0f42eb1619a842df660a

SHA512
252a275c7ac543b9dbf2a1900dc1ce945290a8c594cdad8a9a78cedec59463403aa02be013d55bab8536b34389121e909928dd3f5253130a60e0f6c19c9b395d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa1a4ea4123f858b827f200bc015b668

SHA1
1d7be54c6f3c6e6df06f9e7ebe88c5fb69568cb3

SHA256
cbaa4d126910dde0dfb655949dd7a8a29f5b4415c2ecdc74652905734586734f

SHA512
d9b4b3dcae4a47ebfc16ea0d27a15db53ba277d880d356c1464e7786847126061e091e03df0992f61f0557ec71449a8c815efb1f91ca516f869701ac13ee8f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de12547ba88abc8dcb6b9fac83fa5a3a

SHA1
e6b99df3a19951b59ff612b7787ab1dd5f83c4a8

SHA256
7bf09dbb46ef9ebfbe80859d52b759c5cd182d2aed0f6fdad9160e433e8ae1ea

SHA512
dc95577c1be0ce7a172b73d3f132e70e7687da4cc12c7b1f4e220329f8562eaa951e7b1a7cf545f19cf3c2b7d77ce223665e5953f42a26fc059317e4c5323a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf17d125e60254634e13b579a5743529

SHA1
692ba296037b8fd593a0e14d161de9ee556d130f

SHA256
79f01fd09dfcfe2e8f144868745c006e87ebe072a23a5f8d3be0f7759bb47df6

SHA512
d2e8d8b47cf242a8619cd8f58ef149fad58ff8dd0e3d43b339b81e800f22153e9a5775fa9b579e1bbdda30191a99a35dadf67162c9e2bad10b71326bf791fe9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4f53dfb905efcb7ebad7c14ab5444b4

SHA1
0f630ee41d85827e32ce6242abf8b39b442eb544

SHA256
aac075cf7c99f48379023e821f09e6e1f2142aa3ad72e4e49ecf5c879a2bc3fa

SHA512
9ee517c990daf5896c1b42dd0e32bcc3a1d422dd3cf25e10c38c580cb439b6a9a3c696a4e48f29c17e86789da6692537de140f0897525afcbc85dfbf8f183dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40224772aeba2f154b832eb43a6f6c91

SHA1
62024b397d71aa3ff1c324fdd103843f0b88393e

SHA256
4c7c085cc6e9df083a2d962faf88658782644f229d7881168c2e139b49f05d85

SHA512
90daa48b6ebe519b14839d63975520f415ed1c13ee90a4de3a1465fcbea9764f8f9b070ec440ca772ce2006c51048ab91119a5def0942b535ef4b4e762c9130a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA5A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit