d3bef27324a5859e925c0501ce01c68b92faf177654f7e0c2552fbf20673a2ad

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3988bd1a1928962181e2ffec8d56ebea_JaffaCakes118.html
Size

8KB
MD5

3988bd1a1928962181e2ffec8d56ebea
SHA1

ff9719b91c3380a182247f8a8c5829e40d50f508
SHA256

d3bef27324a5859e925c0501ce01c68b92faf177654f7e0c2552fbf20673a2ad
SHA512

5e2e35b4cb565183a38806044d46a8d775c5223712de838ef23b5cc1e1b4c98b694fd0f2f693d01059e5a1eb3d19f9a73e4190f0cae40e0a60f68366d4471176
SSDEEP

96:uzVs+ux7BCLLY1k9o84d12ef7CSTUazfIneX8qH9ai+uNseijNi3ScEZ7ru7f:csz7BCAYS/xvHSb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000648df786a14b4bf5fef3897bfa8a5c863357653cc7a2555613fbe7a188c0ed66000000000e8000000002000020000000dbd30a6bb83846d5ef4e5d4a9e212aad9ee37c256a67383282ee118921de2819900000004c4955d295f7ddfaf502b0c00121aef7ec70ea193b5fea75e0789af3afc44906518971e366ad901e72016095b3ddabd8b556e8d532c49108f620c4ecc88b14cba3211b8834efb55e3bb7a4b300b1659a2cc6e352f242b0122a81640ff2cf49e8eaa6dcc7a20739555f4af3a80a398e1006936ad90a16c741882bc34d6dae135ee05bbc3773a58ce24d2443af9146ebf840000000f23a76ec5b5cd7d3b13dd5ccbf4bdedfb297c0e2cd09e1f6c453e4914754152c3bbbfb01bc6cb9680986981a7d5360241c3503a609de77d93b1e620abdaaff9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426870461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000140ba2bc7ab1b7f7d0fe60ef260e4e88f0dcdccdb557fc46bce6f4cdcc41cede000000000e8000000002000020000000e74831ddc765a2289bd1921a48780f1911df063906af467e4d37a1c24296a42d20000000cb4540a88f306aaa7ee9c4ec86281aa4471fe3570a82c4c4ec42977210dc46b2400000002bc7713d3e932aa04d4d0948277cf242a862c58c49663c2270f2ac1bdb1d7243dcffc477f1c4b12c422f1fd15503a147439406180eaafedeff801a4096e09c1b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08f3dcf9fd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8BCC2B1-3F92-11EF-AFD4-EE88FE214989} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2160	2064	iexplore.exe	30
PID 2064 wrote to memory of 2160	2064	iexplore.exe	30
PID 2064 wrote to memory of 2160	2064	iexplore.exe	30
PID 2064 wrote to memory of 2160	2064	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3988bd1a1928962181e2ffec8d56ebea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e227484a04b3880df9e0e17817f664e

SHA1
24cb71972ad84d93a1120d23baeaee1b746a0f3f

SHA256
2bf62b65b5c4b660c2e345b3e1cbe3e5ac9bfdaf03b1df048c5f5e1a56858737

SHA512
b1b6ae73c44774ea0be1d18dd83dfed0ba41b18010a944e4ee11bd0b5d480bfa3b9718052920c4dcf102c968c5c7611e3973904ea4a2fe17c077b56d9354846c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f690754ee61a0fc5781e794b69a0e768

SHA1
c359018c6f1de098f60a013f62b23ec5170899ba

SHA256
a317d1ee57f7b9617e4751d8153f9db0c2bc4dac558f977d36f51e5e6c7ca5c1

SHA512
fcbbab05b2639dca1ab8cead6759c5378abc9e3d8e7ccaa9dea6ee1c8b48026b9fa2dbb3b51fffe804dd282c8220128e59187157c0eab33872a1adef4c3844e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab423fdcf2cc2880dcc1a914fe806d17

SHA1
06e1fb96c0654182608c602d705d9f0eb6b1426d

SHA256
cc69ed88cabc6da5979b030bfcb397699ba44bfc0af8b00b46a13dec365ededc

SHA512
a51159645faac1cfa8e587447e6345cd64f44a2c75973f565282fd648632d0ed24320cc65a19adbec96f6a27e175f2e66e8fd92817ba8336d7f381f1aef9289e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7cc22d54754163f9c6add5de7eb6cf9

SHA1
ce74dd9181f3ee4526a90b25f6f9a1f9c84093d8

SHA256
8bbc23d3a3eca40f983134dc33e629cbb0e8ff727de01044a49bc66fa171b074

SHA512
b1dc7b731da1a2751b2ce46c7991710ae2be551d2580fd2d69e1709661a93c17f8f94e9ea5c29f201534c234c8926d5302430842634183f627aec32b27d582ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28518402e76037efd7143cf4aedb4c02

SHA1
dc371749688f62520039b877c1693be897dcf98a

SHA256
ebba180ce5dc121308192930e4e8a07e4cf45cf7d852a9c0ab7dfbcf5225114e

SHA512
ccd06bdd443d395a4e32e88503d2378236bdbb1dc0bd7529e996be946170ba385b7f1b9fbfdec2c8890f89d16b57497ba273ed966789bf13a97e5e2153d30b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c53299a07b8d098a8f2ddc814cfb3ef

SHA1
da19ceacd9e88d4d9840608498297914336fa359

SHA256
8358f2228e5149fb591d38e7eab8870317d55c515ae2f9f9262ce1eff33630a4

SHA512
40ebab099433631e190f9b407b8297657e65f624d95eee53750c0057d8ae54e99850acdb6eddaccd6393d630a16b176b031b8dc5b54ab530f58023f2366a4012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39e2aec077aa5feeff01e8e4750d7c5d

SHA1
7509d6c6b99bbb2e5084d38cd831dca8bdcb6d40

SHA256
3bd5930c6dad5659ef964482d966cb5213da00d312306e068bf51643eaf66ed5

SHA512
54fa9b6259364cc0e25646a0c9c7f020871c24c58ddb2810e451b011c63d90fc80e2a95e520894590806629a8a9afbf34b2ea05d86b3f4c317121ada40d0983f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6a1a814d227ed291d10fed69d2594c9

SHA1
5be499634f3bc28c88be77085a5a1acef85dd625

SHA256
824e52683ca282cfd36587cfddb4ebcd9c64db1789a8a364de1cfeeda62f5a9b

SHA512
23a87050434e884c12acc903a5e1fa8347831ec86336cef8dfdc40a48ee5315ac5730e9c80980baec43d9d34d1f1f86ef296975a4ba1bf98e491537ced766d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cdabafa9bfd5c35d90c3d22721dadd9

SHA1
bc58c8bb9c8a7ba1dfb5af0d97b52cc87c480fe3

SHA256
9bf2bbabdfea1e43dc3a708c8a3a9e93e1544dc648d17174e8c8a8c8bfbf422d

SHA512
1a677265fa52fc40b6424271751f1ec301578b0bcce7a8cf666e6a677205521033810d6a3ca3d1f8de8c71471d46a617581a1acdd0936e07090967ddb8fa77c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f2d273c02b2d24f8f8267d4ac1d3f6f

SHA1
3d656f2c4b892fa206538ac2617f5149772b78f9

SHA256
c265cfd798c261dc20255cd061c97ce6e2035f3ae19d11d99176e9acc0760fce

SHA512
19bd2fea9a3d6f60d9520a9f2f7de5aa8c996a5bdd6f47accdcf9ca7395cf50d42ae6bed5f1f9a4e073d400da868bb6c8b3b5a3df956e2c9343d182f09a35fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d093bebd8817be6ba10e571504a98f94

SHA1
d308559b6d4db75a1726e4f62b596913e5d33e7c

SHA256
522afdccb0deba5d96ade614975c339c480a5645c307f70bb4b668236f4cc508

SHA512
62850206dc3bf0a857abfbcbc841a82fc7ac46c3127108b06f813a98a026694fcbf7d0647273c1cade34938cf43188ac0b15bd40ab519c491258d169b7711617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67fa2a07111d33fcba84b3f1841afe1c

SHA1
484e9f81855b588e7d5e57439165db35d638c9fe

SHA256
94db32c8469f57a8e31bde663fb662b30a05652c6bb293cab4763682c7857108

SHA512
eef8064afd8fa306a9e5e2b98af66b4a29264b8fa3867ba84fdd647e71195746e7ab842764458fadcec04cdda4b392c05d85cf5474e5e3891060555b4d335611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c577d621e6343820a884006b0fd70859

SHA1
1eced5b32da43eb7a3c7eaa533fe2c1221aa929a

SHA256
d26d4bccc59cb9bb7fc0e56077c961e590703fdba876e244cc53c22569a3d0b2

SHA512
210fa29f2373be8628a26857d2b22e22ae8c2d53318923591bbbdfd56ba4dbfd06d16a68d629cb87b1e41619c215ba7306efb7c496dc29eb98c0cbe26aa58e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9162b0cb5d7cc40cb2288dbfb3d1405f

SHA1
667b004ac877ccea614ae8875ba5c733eb43a925

SHA256
98e37fb04593e81f5a93d32b6f6625378c18fb9032b5bce726e57c579760f5d1

SHA512
e540ff55a632fc8b943d09a587a936debac2eb717162a2f0b3e2df858acd2e6caf24552e87f69d0f9d8a988b84b5b0205ea3858bb9d3772ada6af737b27cf203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e498480bdaea63fb48256b50019d9abf

SHA1
3582ebc00ed49769bd0bcee3edfa4052a5f56251

SHA256
f74c1b42c660560af4b1f0e0589e25f499b4cf80fd3a1ab43debaa68524bf1e2

SHA512
5839121f9e5097b0cd645f2151039f329e5e83f8f40caea42c94b0a5ba391f8322362c15cd5e01bcd2431e707ecdb736be823165ca78ed22f40d2f1d850b926e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE43A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit