1b663a32a458260aef73f4d955db9c0a78b536128b951966de865be5865d39f2

Analysis

max time kernel
134s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31c357e91b09f42aa10baf244c999806_JaffaCakes118.html
Size

53KB
MD5

31c357e91b09f42aa10baf244c999806
SHA1

b45a53ec84010d5bb2797c28f2db1f58d1174552
SHA256

1b663a32a458260aef73f4d955db9c0a78b536128b951966de865be5865d39f2
SHA512

aecb4cebc0705e8508aa6bd9ce382ee37547141e27d6e67f8b2a381944a362f416fb6475940d063d79fed4ce42451d9ecaba7b4ad27fff3a87278303f577f102
SSDEEP

1536:CkgUiIakTqGivi+PyUWrunlY163Nj+q5Vy0R0w2AzTICbbcoi/t9M/dNwIUTDmDL:CkgUiIakTqGivi+PyUWrunlY163Nj+qL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FA560C1-3E36-11EF-84F4-428107983482} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000084eb44c5574f013002930c72a9306d082f2388432894e559c46b7426609f73b1000000000e80000000020000200000002a52755cac9057d6107c50ddff3d6c44eeedaf071f4ab2d7173325adf8697ed6200000001e0eeeff2c6531b48be791529cf7f39c5186a220a2da208b96a8c997313ddfb440000000e848bc9c05ad318313c144279d176de96b30efd7ca3a90df48116f0032e236da17c3a674ac131af4e1abdcd14cec46a928a7dec8f9e761fd68d16f699af67a3b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003f0b9d911d27338967ba764f9548bddcb50e0774a8529ee85739f7f11f78ec80000000000e800000000200002000000045954a27a7e21e19aaa73a00f72293616f1d93feee754fd29bc4c65a58be98c19000000046bb14b76d96c59217c5d872ba0b225a7b7471f761302cb7bbc5a455e39d0ef74468d0a1f7dbec2f26d4ff766e2273101f059e852a61bbfd64237efa153b57211c4367802eb77adec450cb2c395665d9c0edab9e45ee33261463cb38c2fa48b92d3c8154eae6be9ae640b1b04e1a5e0b9e07c0007e4e2aa8ac3da7bab5f332cda78398c7841c57c879efb00f4ae6e0c04000000058e1cbb3aa7a4611d93d9829c0a69a0a9be9f3578deb623a10a07227ea194236bf3f7bb93dd65ceb3c765bffecb7c244b2a081726be3eea027032abd447e9c24	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426720767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809eff5843d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3064	2076	iexplore.exe	30
PID 2076 wrote to memory of 3064	2076	iexplore.exe	30
PID 2076 wrote to memory of 3064	2076	iexplore.exe	30
PID 2076 wrote to memory of 3064	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31c357e91b09f42aa10baf244c999806_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6114e7fa18dffc7a6a53d78be47e1dd4

SHA1
27f9eef06aacbcaa0211499ef608b0728f9b20de

SHA256
2d37b3dca28bf030d134ac5cfcff32db204c555caee623cebba119cd2f88fb47

SHA512
01866d35aad6d3fd57877496b72f40b2607d37dd1d1e61147beea44f56f117a28cd92951cc294a659f3506d70afaadef0814b8b0ce1efb19fbe29836081f0db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd0c416c61e2059d77562e386e63b2b

SHA1
8962512116b3e5b3a500da718fbf322c4d0c8433

SHA256
05add13baa9b020411075f28c0c65574c901c83679cbd9a828f2f453828a8366

SHA512
0a6bea7f918ac85c88109fadd874cbd4e5b2f3c8dcf41428a14b4d2a5b24ee1791a9aca95e5e7a9bf9cbb6fa53c3f2b7a109d524a86535e4921da93e018d86e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d63aebae6bd65f53acc2f6933399ba9b

SHA1
0c4c27904ad065b2d19451592b39d244430d8c76

SHA256
6cf08b9aec33c472055061cefe3d5061aa206439be28b25d9270e0d800bb1a95

SHA512
695b36d2e14a852289df4fc7b78e4b08dd4c263693f862406044a6cbf004cc5697b8884472a11adfc167798e450398705f20da272f09d93dc892579e03c25db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
916824d1977e5d9eea8cb01769b2ccfd

SHA1
1ef59a6b3c6cb219fa3fcfc2898969df34146db1

SHA256
e69d4cc4d0d75e349840ee8c2febd9dd231594277f6b738273845cf67009fece

SHA512
34b8bd94313f76516e0fd451792b4a5023ba0d3913f48d91d1fdcdc2d6905ed0362340d622b73e328da6863360ab239338e534942b207c7dfdf932f65179aeb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2891f3055e692c6240548cf593eaa55

SHA1
f9a24e66f663d1b98002113ee832e9b2ed8ed9f6

SHA256
42cbf7228d2ec2a8c663510e425dc766edc582137dd11a5b76a720ad0d09b08b

SHA512
19461d4b1a02c65601d84aeeeaa3377f24efb26053736abcc7ad1a165b7aabaded7ee6b4d3145cb0cd59a712c0299d60797c557aa82cba70d72e24d8f67aaa8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595af0c1ee19020c6e8d1a20d546baf1

SHA1
cacf2025b5d7d68e03bec1d946ee81b19ec57dda

SHA256
6d61de9b33c97447129fb148a7427e7588378ea7004e423f2b6238840b8c8a64

SHA512
c77ffdcbd584d2ee6e685e37e77ddcf3065e1544c7e499b72842f69675631dab7c3afe5b4821b6580b0ba7ff5bf696fcd6c856cdcd3136f3d38feb4c6d59c8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f0bbf70eeaba17ae04d67a82664375a

SHA1
43b192ad7303339a6ae100b52a719b80925594d9

SHA256
5c4704facf438fca22d9f8accdbdd5beab9cd42be2cad1c009fb866ce068927b

SHA512
60d299e224dcdbed86dc065bfd142c317ab8992f1432f613d1316fb0e016c72312c1dba848a7268101cadcc49a74d0718e48e3e32130e920c9cb897983675ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96c58a46361d31522cdeb336cbab6e2f

SHA1
6b056bf9ac1d2424a03cc1eb71eed9b7e7339f4b

SHA256
744443c7815f02dabcc7ebba96d2353177c9828eb74358cb46c88e8718f5ef26

SHA512
956c99bfc94b33e8dfbb82be372c723ed9290985a127cc9510a06c0a673dd4ba94699e792d0fef96640904e507a09c9a0a5b2f3186d11e196430ccfa39d86327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a99092570454551b628df80c6475d3f5

SHA1
258b32681c81fdbc0d6c098b6e1a2e6859fda9d3

SHA256
bb85572b324c01f0f7f9d2bb31a64363598bdd98cca699ebc33883a814fa64be

SHA512
24bb30e98b11a1170de0eb50f490545363e1b2358aeef4a812ed61955a3eb310f0ab1b11baa0f54448f829a7c1c5d654295b9e2ec4aea70a7b5255f23d0e965c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F33.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F55.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit