421617ab39fb070abe0c3e6946ea2a2028fa354b95e77033fa87f7d51599551c

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a5c523911ea6266a3903c9210f5296_JaffaCakes118.html
Size

53KB
MD5

39a5c523911ea6266a3903c9210f5296
SHA1

3deae66bdeeb9d758c3f47b19029d99b29d26c77
SHA256

421617ab39fb070abe0c3e6946ea2a2028fa354b95e77033fa87f7d51599551c
SHA512

bca6897eafc1394caf421bb9da7c6ed148006f95574b4ecaae052bc22e3e1560ea305046328ca8cee605b33aef65c6f14eac8add81abc33e88f3de24e67f19f1
SSDEEP

1536:CkgUiIakTqGivi+PyUorunlYa63Nj+q5VyvR0w2AzTICbbtoL/t9M/dNwIUTDmDH:CkgUiIakTqGivi+PyUorunlYa63Nj+qa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000b0e7162e0af4a0975da6b498d6809ed2281265e8d45f1dd4b907389a8d9a48df000000000e8000000002000020000000cd05c261451e2a216b352c0dca7ae75c822e8fba3efe48375a92deac1db4cfe92000000043b94e97b04c7ceee41b4042e2f3356bd464a47fab5d71cf608a18e01575576d400000003e81eb0185bdeb0f9649eaaf92e5c24bcb8360d06719f32d4912f05d0ee593e6d2f4858b17ef92bea2244ac7613167b6a6d9e28e0f00d934d3fff381c8fe29f4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426872670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A7E5301-3F98-11EF-B585-FA51B03C324C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000006e642a1d463cf7b287118a04de8fecc4b900b5f90e2e35a42b650613fb840d05000000000e800000000200002000000059a727280c83d1b809ab8dbf9755b030a2346953401576469399fe593bf45d7490000000c1fb9806c2693b2f75a18cabf2b0f704a8e337d4431ad2619261caced94c67d2a8cda9a2e8884b2a248094af5578a575c5b0c19a6a0d8b98e20c9397f63b55934bc9aca711c6c07ce51662e70e2c5fb2e8faeba8d796555e50b69dbb9f4d173f1e5a01a7c7697be7c5385de8a7124b1053936c873f0798b563d1f89145f878cf01f7ecbd11fc0bde3d0c3cfb6ce535a4400000007b9599a9a590dae6f23cb2e85585c25eaf92dfa2f2c8b0768321aa41fa695ade86db429c20aae227454999c83203608fd9215ac0fffaa85aabe0ce084013dcda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cde0f1a4d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2336	2136	iexplore.exe	30
PID 2136 wrote to memory of 2336	2136	iexplore.exe	30
PID 2136 wrote to memory of 2336	2136	iexplore.exe	30
PID 2136 wrote to memory of 2336	2136	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a5c523911ea6266a3903c9210f5296_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfcbe938d4ca3849ae08b7070cf20054

SHA1
58e0ba4083d56e76eaf77f3a858699b6bd014e68

SHA256
861943c8aeca855219b7cbdf829b79e97f29d378795117904399a29ffba9ccce

SHA512
2f2344c2f14e8314d4d4011d0b7ff48ce9a377c78c1c766e525a397df730c980c18de5fbde686d7882c268b4e59f19d7e4cba6fef33bed33c5499342e3c33124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76522f6d1b2b4ad3f4345df6d8855f22

SHA1
777210109d3ad519f656b562315627774b9ead4d

SHA256
9152d7be90847defa2250ea4ae850cb1734a1f2a1a64b16d87362f932eaecad7

SHA512
0c9748706acb1d076eb0f1f8f785fcbc165e4516eb1374a2c7c176afef0d8746360242df356262b29f2301e3811937503da4684ba3db4d7ce7b36bc58bf2a376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69786cbd6ed85f2b13bafb8814ed29c4

SHA1
7af1e3eb3f61bc4a25c50ce8be68d168eb14f767

SHA256
9d41c3e437ca66047d29f90db1151d9a98d69f1c046d46dbf792dbfb4d430603

SHA512
ba9c58f520000c48aa9ae7c9081e17ed61921997cc8d0bf9ce6c93c5158f59b34bf29193b5cad83585daad3b54b2d5aebb8bdd9479084e7e97bf5874203afd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d34368dc260107a67d7cf8e0b15bc04e

SHA1
ef6abc89883caaacacce3426cddb8048428b1bbc

SHA256
67591819e4db7fe52c7d1ea582c222bb55e1d7f27d258594a71cbdd683a2f5a4

SHA512
11eec30f11f909bad5740a71d199947053ff1629ec9855c9e6f27327ef28e33c68b4cc22b0f59b6b73413159f39e0d451be07f641f4ff5641ea9a193ec1f5413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f71d05427e4ddfc82d346bd13e8864a

SHA1
0ddc26d948e16fbc278b3f458677c7274c6425f7

SHA256
cb3791e209d87441957715440a8c9b96c4500de7893407ff775c06307b13984e

SHA512
d6a79a800b0d7b94edb1f596b470b87f0c07f57f10f11fd5f7e4f48abd56d08834f30d948a6879e60cd80ec96eb5f412acf110ba91ba49141732b167b7b2cf21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34d5428bea9ba4678af2be7e8e4ed15c

SHA1
8f97cf7051f3527b9420fe418cdd4b371e7cda69

SHA256
75ab20c4a0335b38f96118f6511565f3edb8c02ea88558ca2d1fd9062a6fd772

SHA512
a2f5ee85d64833389c9c6027b72daa82388df38e8f8bcd791dea158f2fa72fcc95716d7351eedcf7003bac302a0a7044dbaa2ea32198439a7cdd6a77855cfbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d7190cf7a49950eaf631800442e667

SHA1
ddc4a81bcf37b46b2e776dd6e429ae52304adc8a

SHA256
214c7ea8fc0066916031fdf5ba50a92917c333e3b0c0d57149595944b03dab83

SHA512
0371f0fbb5a751aba7235b5c9c4f9db7dbe40bd1516eafdba35765907e2f57cd7212d0644e720915cbefc203453f5d86c44dc316ba8d0b806e196fe36baa9277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbb76eaa4f349e6edbf130195f966e28

SHA1
86a9b8b7893c29752b09b0614f830b091b51d7c9

SHA256
d07a9ba5f31f7a88dcf9a551a0116a0f9068462446cd74bcd32ccaab97bbec43

SHA512
19d695b9f67f077f56ebaa151bdc2f5830242ad720c2b2ab194af27c9801cb704a3583d36e88b20004777ffd462535f946b5dd0e38efbafddd29b9d5da18bca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7cf109be38ef80f2b4d2329dcba0db

SHA1
f5a4de176dd8ae59e578390afb6724afd7d5259b

SHA256
6e6742706a2857c683c887f4f086c3c3a0c89ff8bbf8d9cb28f7b5ce5b952481

SHA512
359cb68b0b79df685a767ff9644d574b13a1531cfeedb2f6eb231aa4a4f8bcc4f211cda27bddc6a5c3a3a2e3b188f45d3c2b56cdca338ff55b5fbc34bee65b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d38fc3580527485743f89e3ec0005ee

SHA1
eef86f03ba112d545cd1bc1b593a414d8609c872

SHA256
b527021d8cfdd7138bf4867c4137493e2c78147957fcbe5948130fa112598278

SHA512
5a01b9af9205a1ad09479922e9d29394d065bbb2b86080af138ab1b51209bfd6b70227466c038703b09f3cae44a9c9917357844d2e802f1ae107a9bd7fb715e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eae396f746bf87ddcc397b08d702ad3

SHA1
871924049c1b1054ea9de4760f751b3f53fdd68c

SHA256
5ef61a64eac371061288395e23a70cac705ec84b5b94eca70d4bb9f48308261a

SHA512
e4df338577fe7bb480f6b6a3246be002d61dfb4415df1a89ce824e0b699d191c779abb85d126c94fd683300d1c711ecedb40560e787728b65db201ef755e4ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\normal_post[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA16.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCAB5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit