988c42bb024702e8aa13579ec41af1ed630eaa8cf02c74951a28840974392898

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3665095473c8c5e5c2660b475deac773_JaffaCakes118.html
Size

6KB
MD5

3665095473c8c5e5c2660b475deac773
SHA1

889e8231c662aeca636d1f3c96fa6d70b7d2aaaa
SHA256

988c42bb024702e8aa13579ec41af1ed630eaa8cf02c74951a28840974392898
SHA512

92f27a3687d7ec805f777ea789692565b688c62f4f8c9e5454b9df491fe957fe7bf67171400594fd397f522b5db78af520773a2b367cc3f5466ace5dfbbc161e
SSDEEP

96:uzVs+ux7IjLLY1k9o84d12ef7CSTUWbca1sLiVcYR16cEZ7ru7f:csz7IjAYS/T3R4b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCF93241-3F00-11EF-9BD3-424588269AE0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e8c1f2eb548d4a4c07f39e4ac0eb7520fc4fb76819e64a38014ea461010954ac000000000e800000000200002000000028e7e31f4f6f63df63a449813af543caf4d1d598bfdde63e367e55e9fbedfe7920000000a881159ce42aa5b12ade0603cb4d43e2809aecf07d7edf14e4bec47bda672d6240000000ee49202ad41804c0f776631992b1e9363345c0217d32b1d6e1e70b70385fbaf27b4c4e1881a9c9cddd88d1984fd3ace93157dba545b661dde603d96acbe966b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807684"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102f83a30dd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000559ef6bef80b30b0993e19d901db2e421094af5c90d6121fff4410a6dce90400000000000e800000000200002000000058908d3591608782c3b5a8ed49da38ecb4d32d1aefa340f7a1ad3a3111ae0f1790000000b3269cfeca5b1fc12574dcd17b34e3b2acdc3441ee9a9ab87827e4d4e69aa1749eabb9f516809f7eab9820ba065b338cdf24bc4a7688c312ff172bc3acb7324fb68ec4d904d535bf150365b1586b229664d311f4f9abc739d63075ac5e8c375d50b8f6a044d6ccecbd4581452b493562d3c3e14762ab5584c19b9421d2ae3479f7b7aa97cb5b636f5b70495c126c4fa7400000000d54469128bf0a2b4c5dcf0590a65d369ca794cacc4f77f90a66f8aa8fae0dcf7726c44a3769b60a3763eff8e09dba6afc4bfaa319478ee1c936407f26794dc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3032 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3032 iexplore.exe
3032 iexplore.exe
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE

pid	process
3032	iexplore.exe

pid	process
3032	iexplore.exe
3032	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3032 wrote to memory of 2552	3032	iexplore.exe	IEXPLORE.EXE
PID 3032 wrote to memory of 2552	3032	iexplore.exe	IEXPLORE.EXE
PID 3032 wrote to memory of 2552	3032	iexplore.exe	IEXPLORE.EXE
PID 3032 wrote to memory of 2552	3032	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3665095473c8c5e5c2660b475deac773_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87602201c930b2a6eded7960bff14cc0

SHA1
cff4c1da14f7c36ccc6f7970eff8e6029a7a658d

SHA256
0b9bb1c3f59dfb95071afa8147e41ead7f78d97ca8d700963904ad9f0a5f7169

SHA512
94ccaf1d5951c7b0aa34d294457399d7838e934e517195eb6f44488ed6cb955ba58735d0a6a2723eab4a67b5635797092b2c2afdd39f09c038bee4be2ad06fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aca4e63b3831a4ae0227f4e94d7bfb10

SHA1
b81bd7049eb127885461043b9f6cca0f49ff97ab

SHA256
a316c32c657b6ef334e95f09322516d0afbe796f4dab23a0195612de992697c7

SHA512
c0906a1fc96aee55d48c8cddaecf5c4826e90cd964d74614a9d22cff9a3d903caf845f52380ca2ac73b20f724760ee9de596ad6e97573c24b9ea9ea97f433641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
980826a12ac9f14616128a67b0b22fe7

SHA1
2133996a586e2f6e6f2ec2d7b5f359f60924183e

SHA256
4304a42058f02c7bd155f3244826b87a3aea15473fa57213e02029e75d59b2e0

SHA512
7254cbc94b8fb0a886f34245f5fce154253d51c5aa032a8852c742d4d677e9e748ecc573c11f19423f55732ff38def726dce9d23169b1998291331c05417a514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80737aa4ff5fe899cb95227c23f68ae1

SHA1
e9c63c17ee39e509055561d4c4c2b27fdceed9a5

SHA256
c766796f4d0fcf5b2f97488e32a08593b9922fa9f29ce942cc7b595362f72668

SHA512
5c433d548fe8e558192baa1d8adbdd5da92ff98f8a08597523bbabfc4eb43c9fcd3b452552e8598533aa5b3e5ff3b159f50a0d94b58b38fd70044e73f026da4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2af122d195cba097f59981aab25d2f7

SHA1
4a0f15160e214200d5eeed89af65c0c87b38175f

SHA256
3839c6fcb947dd6a46287526b2e96ab63eaaea30540bbafe025568af65c97800

SHA512
1e464aa7043f5b357710fdc8cc163412bda4e0603ffb57d02e4d121eb5d5acfbab9e1d627862f885ac13066434f73cb2e13671c1c8fdceefd0e5cef80187fc0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de1638317796783df587847e65d0f419

SHA1
eef263a06b3935f0e5ac763d2f57dd82fe97234d

SHA256
29a20ba4312a1a6193b86afc7abdfd68a14fe2e194e6d45ec993e7219dafd2bc

SHA512
ef272575fe62058557489276e095f57b8dc2be833d99d142afd4f61bfcb5af1cf4be27584452a4b52c9b6d74220cb059f664ba11b024b8898f4634fd0c4b9cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085370edb6579ecfb94ffe2af306794f

SHA1
5ce40985907a12b1a17afbb121e78fe002ee68dd

SHA256
158a54156414f2d174419a49c8fbd81395627895a4c0f29ebc7b3efac8cb4fa8

SHA512
178206154c67e6d87ed7b270f2f4ab3902ff20b992ece066590ac1e84155f56675a6bbf06abee6cc875837adc43d4b84c2a824b9036bc08284eef63dcfc93029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b2742863d5790fdc03aa99a2432e863

SHA1
69321f276ac88a72d8ce2b7dffb82b8d6b161c55

SHA256
8379b71449450ff602223941a340f911f588b4fc70013d02332ea725a162d159

SHA512
4294425ed463a857774ef56e2d9618fa17e81df8269b9e42073d473e3279c78a653a610ea4fa4ddd519e1ac32c3de37b0a79cb709b5c45783a68b231d47724b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
795ca88f24411248c7f6f81e29f88375

SHA1
d1b34ececab81b75b247c3e01a7d1bd783c4c8bb

SHA256
9dcdf7b94a55c0d6d53bdecf9f297170c27c74f5139a730f557f395e9ba64b5e

SHA512
9252da2b3bf4ef9116c0e70425627de375fb1e84716e76487ced7205d58fb59ea09dc2877adad0d7b7275ebbe02676f6bb50d9cad759b8757b5cb02ee5208cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a79f7e5badc4c33b30d52899496e6ed

SHA1
277f1a695fccebb24f640d397ef2837b0fb3dba1

SHA256
97c074b9091079c9c08eff35ab8aaef560707b10f2198fa18ab76496b50b4b4c

SHA512
2fbf590de65118935734539b37fd6e58c8b13645d5afb38e73578f50d1ea09fd9b65d6cab4676daa16498dbc2e3fa3fd90cd93d80adace385996c2174d13eec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaf01343020aa11de67f54dda0f9d24f

SHA1
754733c9feb890fed018d01cca385ddc449a5618

SHA256
7c82276f2a0cf3ba3e23ca348220f9b4c5d1a2bc6b416b5c928be5277153ace9

SHA512
b82dcfa00936965f6c6554705601565eade9fe766d548c4bfafb96d64a2833a68db7ae0cade3cdfcee060ef086bd9ae1e1281aa5790b4a5bacc67f9c6a6851f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d6d32b3a8a2792bb2e7aff464adde90

SHA1
ce2e66c392cd0184ef557e48db606d39dd5c7023

SHA256
017a2881b11044b2c80fc10d832327eff58cfd7429405eee0cc30319ad69b8fe

SHA512
4c4034ffcfd100fb64616661aabd8182232d4e24ff198bc121849645a7323fc3f0b4cdd66ea9ab3629ccf7f0247a412e08207c39c9e9dfa9a8af92295ce863a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE12C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit