435459d78ddb7d257570edfc53978556bf4a4fc73d8a77748960481734ee14df

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37a022c2f55b0c42061b6b6dfa0139c8_JaffaCakes118.html
Size

90KB
MD5

37a022c2f55b0c42061b6b6dfa0139c8
SHA1

611bb13542b9856d61282c14dddfb53e97319469
SHA256

435459d78ddb7d257570edfc53978556bf4a4fc73d8a77748960481734ee14df
SHA512

adc169147270a5a6cd08fc289d92909c8b6a20173177388d07daacf7066394853c5f598df8bd8d3858818da3ebdb2c2a90ad22e9d485174979085e3bd3568caf
SSDEEP

1536:gQZBCCOdc0IxCwJ48s1W/zOXjniKTdmvCX92F/q1zpUNBshAsdMOFsWPIvwrTNKo:gk2C0IxYPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0ACFB421-3F3A-11EF-AC2A-E6BAD4272658} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c0462770146e3d0ca52761f387149d39bee5561d2e17922499b239466b9e8ecd000000000e8000000002000020000000e19fb1d1d91b59d993f56e7a74e167fdc37788bfb988ff9065fe5810653bfec4900000002d6a98014d12fad0bfc05557d7fb19c5978ccd546c531a2465449f5c85dd36d37ef9fe689316c3c6db7503e989326b4bf4a2b330e74cb363705b4ad19d952a96d614ba6574b86b86bfcd8de670d3cbd0b210bcff2705467f7a18c85d3eb8bf148af308d8cae2b97d86a77488d3e08b101d72e8792d45329090c1af6ccb964117ca3a0f85c0634057aa0a4d9dcd2694584000000036f9919afd9362ca359574fe955b41ec1497168efa0f98e28e244e2b143580eb447081de70939f0ad0d61a2e0a763ba2a1007427cfe35da95609f2c9eeaba368	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901166fc46d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426832270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003fe8651d89b04f71bb568572a302dd1198079f97971cb1993e28f4dc0e997923000000000e8000000002000020000000f20f2a69fe863d24eb3985c95b430ee8575fb8b93a46994cc67daa040ea57f9420000000660024518e3b122c1661ee1e0d76c4d40114b1ae3b040f17975a51d57944fe6540000000f548cbdf243bf76b81c85bd60341f851057935eec5a118ab2b73c4d6e434950e03ddaa2527c3868ef785b4e8922fca83c1717e50c466481e46cd3ce0c56dc5c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37a022c2f55b0c42061b6b6dfa0139c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e27d43bdffac0886b8e814e821ea5b70

SHA1
4d1a20a09b26533541dc4aa653bea4b6aaeba23c

SHA256
d05872c74c9015f774c37b6d190cea2f1a0ef1a05831eb5230866f285f4fb27f

SHA512
b991b5985ccb7b50a59e7327c35bc8c6a4e57e09481a6240818fbd389199b3a71f4dc72add9ff54c0270ba98ddde94158c89c9de57c9a4636456100a28f558b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e83238820ee611e6865c223982cfbe30

SHA1
2daddb1cdcb95758cff55432909f93de9c9b5a3b

SHA256
955861f1b583dea8af4c5220a6aa35c25ba22e1efbdb8758f76f1dffbb849d0f

SHA512
6a8c26b91d04e0bc3c5f16990c7ea6144d0a8d51bf1646085d09d3fd8b92a34d26e14a763df3166f841889bacc09a27c36841dd1a6d9d1f866cdb6a5f3ca4d8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48ecbef3c2b5bc9677e4d0dba72aaefc

SHA1
8f3527645aa7f50f151c09ae5b750fed2b764ff9

SHA256
98856bd6cddbdd9a5618361b0dc7ae830a76c9869f733576bd20add316d0cdc1

SHA512
8d028afe3dfaee44fc70f7f8863454594329f06eebc89ec4c2b7047b0bcb7abedf3613825481b6d138662c1cc07f7ff25f6ba0f4b90815b9692d598543f9ad27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7958d0f3ea57aa0cb090a296e7aab305

SHA1
68bc383ca3f9519a69e0906d24a7b9270961219b

SHA256
3a4893b4c1e464668ab108a9398bc564add162691223b9ec2449ec59e939085a

SHA512
a3f73fc103d604d4c310b40628847a2f1b4c75f06b9f9e839c20ad69fba9bce1b88e7a6c0acb3b553ff5a8f0f6ff8536ce7ec45ef39876ca77e8159083200a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d69e5167df47f576cec5f207ca40d92

SHA1
0de30e35d6ae930998ac15ea50ee4044f6ad9911

SHA256
4e24c2d262ba3ee97d389bf3a7c85840f03b7b357e86e10fff12557119a3daa3

SHA512
f0106b6825a953ba983e183537035873cdec5026fa5b3cc0fbdd8245e09ed97f5031a0b3eb3e1c6aaac085c3a5aa49d5cd8a96a7f8bbd6c2df1c0cc6191b549f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6f6a978bf1ea09cc0aeb828ef6f7db

SHA1
0db0b4ca8aa025e958bc4655ba147ba5dd02aee7

SHA256
b860d94d7065ed24558abf8a8014968d55584ce3c75f3f164cdb58984d66e0ba

SHA512
e9cd0e809dd870cabdda7f0c3c3260633668a4edf69453321d1b04776c66dd359bf004b9562ef00bf0337352aace0a5463b095fc764fa438b9d59948f1faf943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cb5445deb90837e6388f78ad8fa7a7b

SHA1
71e8f1eed05756010ad138103d0ee4e3bc7fe9eb

SHA256
f0b6756ea189ba7b8f775346f0d9899dafb6215cd8ee5dfdc7152a6e7ef33225

SHA512
97d77fc38077c2f17bac86e39a6e9ab54b43f4ab777563e02b29d817007dbe36573a53f3c0b070b4f9472fdf35018960745d922b7df41e4c4aedc00bcce70bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54fbb6ff37472418e6bbbf28861ed154

SHA1
924194fc0116bb382b785991db066cc3f0d34c1d

SHA256
d82f5b068f15a694d44d3b3a9b9110f248b1b58ec9d73bae9b0d692d3f32497e

SHA512
729801b6e650a74779c0b39eaefd2e0abc19ea3ef2e66581db67e64adec1fc6c641d66bd78a88dbdc0b611e83ae161e3616a65dabbe7892351a8fa6cf2571cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b711b6a147d123c6973000956b63804c

SHA1
6a86b6197fb912af0901f475c41818d02bd036ba

SHA256
1f0ab7b533db6ff39ed978b704f8411e5206defd9d652c967ae487d9963a20e3

SHA512
034c4c876443cdef67967fa8c38d2a656df55324ad1062f03f0c93273ac6d3fbc7e6ced7d35405e689afc158b9e6a312c06ce71e6472e9f0ccd46cd896c63dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36784a882a95ce856f654f5f445f1281

SHA1
7060825e1c99ab9436bb04b62a6ce3b2e8f6f7ed

SHA256
02ed8dcecb22e5bf94c46a6d3fed9a7fca6a3415ab5d099c46b6df912536e7cf

SHA512
aa8f4a3a06058c27f0020e1e7fd6a9147f8b4becd4fbe940e8601c645f8485ca0a0c82c3c5bd3bf7c42115ab57fabcde3d88517f0f70107750689c5fa46fa013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341f0651888c56146a7149224a72106f

SHA1
1f9cc4db81af6ae7afb2a330033abee175f36e51

SHA256
d2d77424879b8fabe9dbf00d2d45507eebf49eb02eeec4ff63e1c003bb9650ed

SHA512
408126839c5e78370345b6f84484d7885cc66859adfe463c24e34af1f758a0f743e5d97daa06b18da067c8805ed4bdd30efcc3a0c252e629c5aebc332e0d7cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6423.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6455.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit