c32a4826bfaa0f18f122add88ce391f595ed57397793955a8509aa6b1c4aa840

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

355f24014009856d0d504c004f28439a_JaffaCakes118.html
Size

6KB
MD5

355f24014009856d0d504c004f28439a
SHA1

75cad0e3a4d934d79a467b9ef16d0f8c08d79dcf
SHA256

c32a4826bfaa0f18f122add88ce391f595ed57397793955a8509aa6b1c4aa840
SHA512

3f586cdb2d107ef49ee080d805f26847a50a6f9f7cc2d3b9c8d6ed1e350b56b5fadac5abba1412d92506545ee2e7bfb2928f13c43a549743a9d24958f5b1011c
SSDEEP

96:uzVs+ux7YGLLY1k9o84d12ef7CSTUWZcEZ7ru7f:csz7YGAYS/pb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000017f2fb3a1e708810008e18b26d4098a39a566ee1c758a9ace60cf8b625a0c082000000000e800000000200002000000065ccbdeb6e1539ad91d725d1875d740ffa525590fd4081774eb07a4216c7676c90000000718184d428ccf6932ccbe62a58058bec2aa875a6d257785a095679a1eaa3e967fb9aeead49cc9f71b82b8937afd115d53f3d6361ea58c5ca9607b090c6647449e113fbe6da62b49e2c85974e30aa2b88417805a98495a888f0c94807accf54016b2c7535f64c0b63b12a3b656e0e3957da7b30e0a911e4ac361c132655c898107f17e8080ae3a950302e15eaba31458440000000004fecd57c9d4e9c5971d34c5a2bc5e451b294d421f3b8c003a4367b5fda8a39fda7dffef92666c1ae9b0e7f4479b14ee01a9c6522c9535d7fea10adedd3bf0e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426788268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c3d714539ea8d66d032809ab7a87d3e0d741a4f8d88d52ac46dd65fdfbb48403000000000e8000000002000020000000134e2b4f02ac490120d714f65847ec08ef4d00462a0e3a9c94af286891c006782000000027e33fd85e72ef6edd0640c3e7dcff2eaa296f2d868335ec343e936e1138d7e74000000067ea5751e96ed56e41304150fdd2e6f4b28ee593e97407713dfdb2230fbcf76b5ad794658ad8cb1dcddfcef2c09b036ddb529f16af06f233c6dcdfa10ff728d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5076e56ee0d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99EE0831-3ED3-11EF-B93A-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2724	2632	iexplore.exe	30
PID 2632 wrote to memory of 2724	2632	iexplore.exe	30
PID 2632 wrote to memory of 2724	2632	iexplore.exe	30
PID 2632 wrote to memory of 2724	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\355f24014009856d0d504c004f28439a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1723b0b261f59a9d1b98256d5c6f116d

SHA1
5f517ee49cbe681020d97616396d57b53fe301df

SHA256
d76a0a2825340ef3a086e1014a4e7a84575be03466311020a662a668149758c1

SHA512
ca4d4ed4d2c7d74a45df8a0e196bab9cc181d5f99328ad4408473b9da6113ca4eb67993c61ed2d963ef5afa4519e63f9ea9d49f4b9f53fce1b956ce861af0a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4da585b609cfa02b89ed7879d9c9270c

SHA1
cd34766a97df897a1717db3fe141483f94366712

SHA256
0778c21f7985d637a61bdda7b40881f4a5a9a453b9b230d5206ce9a287c84321

SHA512
51df1c56c0ad5db02506c35784967895048f06e72b3ddb9a47438d714a5d9dc602aa22c15c94953635541dabd6f7ba1da3a9ca3328bdda84cd521b53eab4bb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7c3573bcdb79b3b58fa9a3d9373a95a

SHA1
e08c205e5ab7ce72b1a950c230d0d45c89a695c4

SHA256
c89dc580d641ce4d186c2a88f18a344e2ddce5cbbb6483cb29488eb079ca1006

SHA512
af4f66ff02cf9c39a73eb6a7e8fe84d74a23c714d427838c738f5ca4a937dcdea79e2561729c2b07e582a236bf81a5a11288dd951740cd320d08f89afb600192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ded97c6be939f47fd1e1bd3b8753f8b4

SHA1
fd2817d2176d8836d6ac1b1ddf4bba526c9950af

SHA256
792578ac4bf71e9b074ed98fca94a205922ca5a90f5f6c9899c745fcb9b86792

SHA512
017bd27d0523b629249e50aae7305b4b1f9f739cb8c7d8bfb02268105b92e3aa1418f70c521df7a393cb044aff24faf011ac237465ffa7fd02648bfa7f06256e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0df1a9b652d11151a4a216faf583a10f

SHA1
0bde1af9780403e05e0a2486dbf56b57da823ed4

SHA256
3ab8adc59c0f903ad5d1df864de16bab676490b68bc36e8530a1e6bd9061257d

SHA512
fc440f8ca6d7439553c5f66cb87b23c339db732b20c704835eb76a2ef1dcecc4d5ab0f821ae8c77c298cd73009302955c3b240d0b8344e1b3f91605b76a747d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b635070d462b135fad0170a9acdf85d5

SHA1
d01da39bcb1f681726296edfefb9fef14ceed872

SHA256
77c050ca2d1671d2b6cb4d788026de76fbbb80c982558a774294cd1f0a67e12f

SHA512
5f076efdfcc9238a491aa837f2366d8ee444aba4fcad77311811a08e32a1870e5e4070012dbc94010474440c6bceca7a94efa8963cc9a6be62ce0b29424a25f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b44ced97f73b668a59550877654442dd

SHA1
3b044cb7f22d30761fb048fee8c459a0da013a7c

SHA256
874ceb96252a6791d925ffba0f667ce90e4ed157e6ce4aa0c68509ea8c3300bb

SHA512
3d6611bdfebeb134619ff8902ced36b3d3b5285227a8c29e5cdad560ee1e6db2c9bc0edba35cf6d176d972c3f0e95fb7a0c4b48fb134dfb84c371ea7075e7c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a9436a08fdc1682b237bf39b8a2972a

SHA1
895f89fc9cca40749094172a7ba49c7dbb907aec

SHA256
f20bc28c9791b1338003f3ff9c8316aa971d5878fadebdf8b1d9c6337c88e125

SHA512
9aca55f479cc7922523d88d9aa2bc6d1d450a7463d2c28a36e8cc13888fe3ee15c70f084b5fcd410f4ec69e8ff2a4fccd32b0e97b06fd7c3666076f6643a1ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea987312fe6e30d4b6d23affe44408b

SHA1
dfca8b3ff8d2dbc01f9cc33f05bccf6cab07e0f7

SHA256
402efe5fb28bd10855a8ed1fe2c1301c343cec78fe58f9cb2b690c437129443b

SHA512
34078aa883f80a5967f716efa5a2e5eabaed6e642f2cd00bec73866a978191f0f1e2e93983cd0f5a3eb940f5f16ef87a95e996560d8701c628d3227ab453df49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c22f4ac314a1fd8e88711e29a065de

SHA1
04211d01f0f5f19bf58abde11d79ac020a0508ed

SHA256
70f7cb8e97fcde0600a7696bb10beaf398b9f57cd18d327077eac6cbf9da6e73

SHA512
6aa2f3da8db1ff1c9cb0a47e01c31179fd78acc90e58eabc0ecd6a499f6c5774b4c4a1f9b113684dfb4a19ea4ffa886470b515b2a55fa92a4b7a932d5630e621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6056c12ec251788325c032c8f063700

SHA1
c23181db6ac3206c2f98368e7b327cf2629d6205

SHA256
bcef41f77baa8819d0a7da6b361dec6d762700102852bf20e2d3f7b400fd1058

SHA512
17d5ee769b7b8dc22e62eba3f6219c3185467c3510457269f5db4a94c35c2761af474d226f7b1870a22d3140533cec5f6f490929a0bbdab88a729ccc12673e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit