617e9212407c6931fa728d6dff6355e87270289acaaaef8fff7a814f99013421

Analysis

max time kernel
69s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2533ff5e3f1d064813c09e6b2b6451_JaffaCakes118.html
Size

23KB
MD5

3a2533ff5e3f1d064813c09e6b2b6451
SHA1

3dc6bbdee124a2dbb44d26856194e35d0ab036a7
SHA256

617e9212407c6931fa728d6dff6355e87270289acaaaef8fff7a814f99013421
SHA512

038667014588babe794aa0c9f930e58481cd853b36e1788c9b8e09a6a249407212cdecd46e6278abfcbaed47a0f43beaadea4364479614d9c2d1a184c450a214
SSDEEP

192:uwP6b5nOejnQjxn5Q/VnQieANnonQOkEntffnQTbnpnQtBXavMBgqnYnQ7tnuYEw:coQ/6BK0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ab0d83bad3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fd3677edb710ab0b62159412d36a334448d8dff7a557c1bf0b76652e395a6ca6000000000e8000000002000020000000a92f523dd5400ef22fa9e8b5f1369d5c4e3fc96aa8093c000ee74440333a431e20000000179c8012ca4198bde32239ec54afd6fcee4b5708780181d26593b5e6a7c975c840000000446990da1c8714a1f198e8932a41010cc6e2f21f72bd5fb98791968d1ab50d9adda0623ae70225d38d3dcb945f5adf083a34ef6af933a55581678562a65f37ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002b5a2d8479e3466d46e368e8aa78ba5e24d00e8e2401654f974ec1ff2564c393000000000e80000000020000200000002eaa7c2a09b2a8c0e84b28937fbd506a1f34cd93fd160d1c4ee78a18fcc895cb90000000145ed8f203fcf9649f1203ddcf91a6fb4d7d0bd0a183f1d82b0fa64bff1367cf6779a88c9a9ce13cf5a9a1a13956cc70b40afeb10f45c985d4fb7d1fc12d7b5a479adb72c93939f6ff6ecc8ec610b7414780b24f247e2212161cd7bc2e846806c4c15df5db5d6478db15ccea7d8b7c79a563c75b6bb424b2684e299a2f7219dd0c724188b59ee907da87b32ca18ba41240000000d989591f2d3b58af66c11a0c7575a804c7c7b4e1eb6ee324f0cc18de2f51dc19e16ed46ba211ae60a4bb6e3eeac98ec5fefe0608d37d5d9a454c5d07d7749d8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD953681-3FAD-11EF-B99E-46A49AEEEEC8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426881933"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1484	2028	iexplore.exe	29
PID 2028 wrote to memory of 1484	2028	iexplore.exe	29
PID 2028 wrote to memory of 1484	2028	iexplore.exe	29
PID 2028 wrote to memory of 1484	2028	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a2533ff5e3f1d064813c09e6b2b6451_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e0c243e715777704b9a3bec1fb30274

SHA1
e9a15b9c8de92687e53e102294db07fa47cc03c8

SHA256
eced6745ae8959bd8adee7f4ded7b34c5b7a6daae697e030765b2e76191c6873

SHA512
ca610149f31e16eac29a7ee4c8b6d741b10561f4f5358e45adbae7b8b75dba6c0598867f8710e331cc798ca847a074b1ac85d47e7f495eb4e779e2dd0aca8a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4b33d9640b75671f3f100cb19dcc38b

SHA1
7e3865fa81bc4142c7b93216026f8bd231ad07e6

SHA256
c7ed206eb3e5f8c7a15c75abe12e247ac133ef36ad13b7def07d3c9d61f51b57

SHA512
a59f960a462a384f95c4e778cb80e45623b0dd7d11d5aa24fc77ced8de53d4db2241e7d07cf6bda0b8b3e566440f08dc6bd2b8bd29f20be0e4a30feed0433f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1a63dec77051fd92e984bbe2b54c79b

SHA1
796f8b5754273148c03bc0753f9e5a9ab65eca5d

SHA256
9dee180c408c3debfea22b744557369589e78cff7f5767d3002e93dd43507aae

SHA512
959bc383f30933e9ea71895ddeddbf6d17b6edbc095121cf421eff29983b2beee4eb3ca497590ede7a799918ac43d8994573609e6193a935403abb7a75b816de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071f3a9e5cdbd4caa67f4d02d6f4cd50

SHA1
d3d7e582ace4dca059fa54d8fa58c48af8880bfd

SHA256
77016716721b926aaa01060f200ced9ae2f71595a5b8d519e8050cf96b745051

SHA512
d480966aa97491e8047033e18af909004837f64ad2275abb94c0d3273bd9f509a04748fdb9c9c7de1e1fd4c86109d5cc96765dba1266cd91a1a375296640774b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9584d110cb864f9beb955882c6d74060

SHA1
d8ed20fe11f5959970361569ea08d54543440bca

SHA256
b4eccb60f615f69b1a0727bc9bf341ba4bf73b952d8bd4404f8e7af03b717393

SHA512
719356377745e1cc820f8fe44b4a3ac8da4f44cb835cc247fbef8290086bd8a4696c81f661402648b31bb1cff0b980c4edb7c086457b1088fdfec23c8dc4e7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad59e0ff755d8774544ce34970820274

SHA1
002792aa907bdff8a205ee98f1575792005bb977

SHA256
20ed721225caa36332397aeb7af5ed913a733bbe81013dfa65ed4aa08c46ebc2

SHA512
c786b333dc14fe26fb256b2d7ab1d9d22a1b51cdca9a6d95916c5de401360b5537e6f423386c42730acd8ff8f36ed8ceb4c7c5346b27b989729165434aa2e12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d90349ae94a564fbb40a74fe41eef2b

SHA1
daa045ab6af91adfd808414d31c0fa79f37fde38

SHA256
6b87d037d14fb8d5a9f9d9004a4ca3cb11dfbd60a7cce8ebd740af4fb878121f

SHA512
2c20de1d6989e83625d5dacd38e67b4911380ce6781b20fcc382c5427c09654417f2b65344bd1b059a992ffa665a131e750e9ca01f6f70faf68f58ad7f2909f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59b6c0a1babf3edaa5cfeb558f0c4a5

SHA1
80def24436b9d0f5826f44fd7b75308da29499f0

SHA256
ae5ba50e1fc0520a7b25ae6a45a3bf13c7f3fd4022b8a559f8d5ebbb7f96580f

SHA512
156e555fb7e8338a6ec44e634795ea9d643f7134f10a54518eee66428d2e74ae2800ed27942f5686dc14071fc879ad9bfc4fea269e9e79a9211475bf3943e2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11427481e0a5c297df2536ae97585b63

SHA1
84eb72e12e73eca391a9a48c7aa46310ff020d63

SHA256
32924840eb6879ba81c5c3905b911baac635929c3f6ab91345d7e0ba746aa653

SHA512
e55915af6efd4452af3abc5be2464fb51792f32a4a5bdd98b3724e9ab7b688bb2bd7743acbf7cfb3fddc87d0add0f3cadd82b15e5ed60f9846493118916225fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ec22dd2c156fc18bd151569250c43a

SHA1
1545a852cdd0fcf71cc5acd05988cb3c33a03a7f

SHA256
09e46e2c388dc7861d3636035c0a2a77108f659323ea891bce1acd8d120b3506

SHA512
549a30a405a25e58d2484d167d316c7e028403204cabc327a42e157456f845eacce422f7c8693f45c5eee7e9d6adf9d197dae876960483b5bbda8515b86cc64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3a945bb46285c5394177f0bd69816d5

SHA1
1ff5d13c19e7484d116589369983741eb1399172

SHA256
5ed9657b3d63e17929c6a9bb9e3e1574186f764c91bec963750de478c4b0196a

SHA512
7bd0a06130545148ebbfd3f4bd3c74f051981b56a3894da1c1461332a92291a6e9cb5a09bc9d1b2fd2c2c0594408a93c53282e9201dbbb1093214fe6d4ee62e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47DB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48E9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit