61036bec2577eb98cdd9a33bb33b9e5a7498eeca279161d005be13b555111254

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31cf4be161510541026426e5451f9f92_JaffaCakes118.html
Size

120KB
MD5

31cf4be161510541026426e5451f9f92
SHA1

aa6bb51f5f84afef408a4ca40f4e3ead8fdb2377
SHA256

61036bec2577eb98cdd9a33bb33b9e5a7498eeca279161d005be13b555111254
SHA512

a8c41211f91ed61d417ff38189e002e8e4ca79907577a481ecfb24c5a2d5294b5c934ce7679df71afcf11e199a1b6c5fecfd423b560533322a6a7be2a2a23946
SSDEEP

1536:YPP0nrVp0el3S0pjk5054mwuH+iqrHwzpsw6F:ZoQS0SS5qbyM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cb11eb41d2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000905e4683c9597ac2a70909281df0f6578f1b028eb058ef7efbfc8b32b8ffe48c000000000e80000000020000200000002b8c7d150c436a4f8c30a0e77b797800619ff88ff922c27a5b3a28fe3daa904b90000000d6b49e28b611ec23bd00f0d4f4daa33002e1415197f9c0d01dc77ae0ddbf8035d836ab626673a163f72534d8b3930badd799dd715dc8c76883f0cac03b8923e0a3b87b81ca8da3b4202a726b4a30f8f89da845470a241a976e0dbb016caa3cfe8fda4d8fe1680f92b94e70d8aca7e84d9bf97330ef8c8000714ace2e00fa29fe74825bcc8cc7b0f39bdb5ada5db1de2c40000000296207270a605ec6a754ba342c4acaabd050b0ba8e663600f4a35493d7a4713c219e2288797f74b3a9e0f52844bb81b412f03be1e0bb016f5858ea7ffe55a47d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c12f601510c5033ea3d17e4f6e6924718ae7e7e046a78b7bae130e439554649b000000000e80000000020000200000009ba1d18a2242bef8e7276add57bd3faa06378dbdb14cf10bcbb5cae955a0263d2000000022dd8c325c9e7043f5a07e96712f8ef49011883d533d27d2240b0a61f114e4364000000072dab86b741a59486d5f5285dfe7da8fe6782b24f2b51c21f3ddea3aa8954d585d9e2474410464431678937181ba2867387ed865428073cbd7e391d330440285	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F64E5161-3E34-11EF-8893-6AA0EDE5A32F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426720136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1344	iexplore.exe
1344	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2188	1344	iexplore.exe	30
PID 1344 wrote to memory of 2188	1344	iexplore.exe	30
PID 1344 wrote to memory of 2188	1344	iexplore.exe	30
PID 1344 wrote to memory of 2188	1344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31cf4be161510541026426e5451f9f92_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
084f7c5fc08fc6f5d87debe782e6d659

SHA1
81cfb6be1ac67282736bcb55d1c81902269e55e5

SHA256
50c52e13af6358dbbd0f6a8ef9488ae1ea8624e311d90166af8809e34960606b

SHA512
ee0c1aaeca5757f51d6f0e5479a2fb7678eb9c5edfb91d9fbf772d233530d2804c6f74fc0bec8873241175cd4d5a2a110271db6fdf2c1b58ff68060a7acee33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e34d1caf93d306ff941dd29a8171030

SHA1
34c4cc27cc60b92526556380877203803210a867

SHA256
dc9ce3a2c263bae4a77db27934bf15485d60e0e241581326fa03db29f9ab2529

SHA512
3b7c7c0fa30b84e7444464a8b5a0bc08a4470a47b2dc17db7bc855881b7eff1ab93de2eea8ff424a9d80f90016fdc8052862068223eb490ee3be17362775acf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
066cfad2b1ede8e9f57826bd9af40a4d

SHA1
2d226edf78a948f7a94d64be143e591eef41ea4f

SHA256
56c441ed124518d24557864c959870fd8ead99cacb16d0d2d33762fb97f7057e

SHA512
6af139df066d940170044aa9fd47613caaf21dfd0c963e55bb4230c36aff7bd6346e518bffb2bd7d864e6aaef55798de7b55596f88c2bce2f841c6ec3c96fc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09d4b8547aa2194e080470db59dd9a13

SHA1
37f871c8d81a223d0e1a386b9d1dbee1d2ebf788

SHA256
f523f1e9eebfd291e77a90676b14ea937e4624c81fcbb618bd791fe54f13a2e2

SHA512
afd42b4f3abfe496ec0bd6e6aac8e89dff02b139037c2e9649178c323192075fd6e3c6d4dfe0821ce1c3c049e25588e2a150496831e3c5e1f745f55178b0ed7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45389ea7bcefa0ee20703e0fa9647e2c

SHA1
71a7f58826c0274601154f8760278f3f59491b34

SHA256
0ce05f42406e6dc7bd5bb1912177babca1e2c94f8365dc6c10b7778102464bc0

SHA512
67bf7a8b84f254e74ff5529f2b52697d3485dfaee4ec2dd1add2727dd9b3006e5e80b1e04bddc124cf533523f261d4ae87fe6d5613e1606217e2f5358ae98e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
feca913ff100dd5e7c9a9a090ca07278

SHA1
22a597555dbbb7fd9e497ea56138aeb2f37f83fd

SHA256
2ea60ba6c8ca36e61bfd8c07f73caae2fe5128ee715336d9e2f96093eea061a6

SHA512
c2ab53ad3a9c141179285a85e5e570c678a5a88eca1849274ef6048dfec5240cfb68bf23622c4e99c4c234a94350ea5b8ea90826ecea91ce90cadd50a5493425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
120d7c35896e8258b957cf71d73896f8

SHA1
fd365b4429b14f86c76da9118153736c60571783

SHA256
65fe1b6bd1e993c88199a72efb9b4c2477a2257edbdcf687da8e32cd01dc6639

SHA512
a9e8c2e258fd7120c490ffe0365a023c60d4dbadef49248d2e603600f069bea88a05ae197fde9e5fc92429af46bfbf29984800b8b68e3a1ae3c921609b1dc2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5773040afb95b3c560840edd5d2c072

SHA1
12ba369b610ec982960ba368689ec9565fa0d3f2

SHA256
527d94a86dfe5253dd5806df0cb407f56a773ea9bb7dd287852c1f74f358c646

SHA512
edc1c28676061745ef4cf71f9a35e64740e85bb2c68afd5dc1a256dd4da4f290259140edae0f7a501eb2c0d38aaafc966752cf79797b7a831f896da618d2bcf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1fc4a4652613affd40bc3581f70383a

SHA1
7a1b2c1d416b990996e8d844e83d5507039b0007

SHA256
8fad6ede887d466a4c18c6e1981f2f3f7c27c8c1604d7e3769e7a7ae89d2fe40

SHA512
f97a3f910a1ae02ccd2db02594d65823d2fa8a492c7f3acb9f53c0af3bc80383f3bf646d6647580cdbfc2713c54a14053315776fb1f3099e8c0336f22da9bde2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3e19b9b5f542fd198f60aff9a0194e6

SHA1
918bfd6c57d44de0c3bc3c802bc2dd836b457a8b

SHA256
0e37411fcbb2e0d2b60b05f5d0e6d16bf0017b10a8e6b004f5053efb49635220

SHA512
a82ae24f5dcf01b590220d616d24089f783a93ba22db985cd20b77056d10f89974363f3e45bc4babdaf4114f1a18f2f4546ea24ff362cf79db71b1036925d22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4004dbf51def4bd43cd55fbc93c9a425

SHA1
7e08c7873efd2cedf57d7b112d7b6ff85cfd4119

SHA256
b5e8888d36a1e5af306a9aeda9f382e7804d85f309ad35db872368425fcb2ec6

SHA512
13a54beb117488ebf61c77da5c4ef76e0563e42d28100990f6994777d4ba64835a7258376aa3f33d91545582d0eb0a12851badddef92c499365e97119ab31a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9973.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99F3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit