cdbae4173abefa496283541025c442fc5087125104305c8a863206cb2c2be5f9

Analysis

max time kernel
141s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1502958a6cb5814a2d00fde136370b_JaffaCakes118.html
Size

57KB
MD5

3f1502958a6cb5814a2d00fde136370b
SHA1

145023c4c7161392dbf112e687843adc75f3eb6d
SHA256

cdbae4173abefa496283541025c442fc5087125104305c8a863206cb2c2be5f9
SHA512

dc3e93615166a8883da0c164186f7fc74e88e96a0e702111ee7e2aa702c3a1d9a9ac88f6eb91e163202c3a0aa917f2570a2e96ad1da5c620187403335845db35
SSDEEP

1536:gQZBCCOdX0IxCSH0xpjLvPeZrQ9Errtk7mmDX9h7WXyE9vHFRf+z23cZvIrviKVi:gk2x0Ix4xpjLvPeZrQ9Errtk7mmDX9hz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c8071e46f20a63b4e43b4331f59b532a5b0a40a413be7e0ada94ef56d7d08d1b000000000e8000000002000020000000cc13a48f2a739bc79327d89b41c78011e62d602965f5beb72d556d5dd8326ede2000000092c451464cff0868c8d86aa17c67e62707ff2a63f4e6603faddd9e29554f9f234000000012de03927b20d490e974ea94ddf10cfb70a233687329f175a4d5fa4656c22aed5d3f3595080334558469c0c1a406e54791c083b83b8b3b525c5c37359f2664c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D3CFA11-409C-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000401506da7cf1ea9305cbc961b69f66231103f7edbeb417b730a355443a1ab26e000000000e80000000020000200000000ac4802575795e48d5a26466040f96c02e62e6f22a8173b0681cf6f38a4365a09000000038a47c948fb3667b8a45e23bca9c35c6490f5ec00df28da7af805c606f2f832ce5f90cbaa54fab694d82904eed1d30c4a46a56002f2b1e881ed3a89ee30e146e5e59ff610d5acd6de6fdb696037b8e4272e910dc361e8037d1df1124b0d4ba52694c990436393125a14e1ffc1ace0e51ea81f902a45e52b1f76886330526f769a70de71735fb0635bf3a140013400c2d40000000ba4864db7b60f27667c251aa6e957ac898389e2560e0ce862cd10f2aba0e925cb64102c75d04e0d8bdfa77c54a519261550715aa266712e21207eeb41e5cb173	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02772f3a8d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426984340"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2404	2532	iexplore.exe	29
PID 2532 wrote to memory of 2404	2532	iexplore.exe	29
PID 2532 wrote to memory of 2404	2532	iexplore.exe	29
PID 2532 wrote to memory of 2404	2532	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f1502958a6cb5814a2d00fde136370b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af69693d8491deaf2e842386fbac8c1d

SHA1
9cab0a3dcb12da63cbc63225515aaab1cb945241

SHA256
96f91be7a92296ffe6ed885ec1a436208ca37bc94683be8d05f41cae789c27ed

SHA512
562ead9b263d984592a803963d34bd43bdfdec984bafbbc39e8f7351d1afa42b6f5c7d4b6bbb549726ec08dcd05d6099c0b1de0a9ceed7a5efff5807c7766a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0e3bf06d33629261987e4ee79bce205

SHA1
d7d5618c3f3e7e27a151419a64d86560a38aefe4

SHA256
b9fd377f63319b7039ef42d96f1d9bcaf4d3c0c05a59c2e817b2a27a9f39ed55

SHA512
5db80d5d7f79018fcee34c14e1c637050aec4cf98bfe62414377e79c14ec2cb1fc2a2f140cd3382e5195672c03ce8ca7aa0edec9495b6ccc3be7c38351a0fe75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438ab727b918fccc286870e875c64b1a

SHA1
f0fa03262bddb928356ae6287b9c81e17556f197

SHA256
3b4a4474050de8d25b3473091b67a2a82e8f8e17cc1f34d274dd76822e37ff37

SHA512
bac8133197d0fb175473750c3a264075940822a5273200b334b5a108c68ef123e5e31ba408d091754e77e5dd77b6f3da45b72e5e270f4879dd96182e9c369b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ba429d6123306931f8a5b3c0961c46

SHA1
3277bdcb959b62143f7c49eb5468b0a241425a6b

SHA256
e5a6863625ef41b14d9426e084a3d17f9e7520c84b6ae8ac087793af9cdbef94

SHA512
0c795cf486c0bd04aa19b5f6df14f93f6cdbc1622b9e69fffc75eaf20b57e2bc7a6b555d6991305da6ebd764eaa9bf71a1ca6844a0e33e832723c27c0c0926b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2794e556e84fa5453f811ad45a8ca01

SHA1
5b91eb3e6e28f0ac59971443e166351b0dfb31f8

SHA256
923214a13c8bf4cce379af82646a9fb02a62219f1ea6a46ec13d83b8fc6e5db0

SHA512
2808686750524178591b9b6b4f95871e564c7a0d584133650a53d3b4ca2f0117d0cc5796417d0c1c7fadd91f961f95e8320a827140ad8fb8dca5f5901aac33a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6df1690421aacde61af666a45fd6cd2a

SHA1
b94948e6b86af5b50692f1fabda73ad08a8ce895

SHA256
ac0ac6113add7bdc7f0bbc5e05f610d05a01f23c9e8bf0359451ffc6b92723f9

SHA512
116e4ae0d8da2cb7b0dadacaf84cdc0776c99df200ee0ead91d404087d69b3503eab231839dff75fc87684c8fe262e093d329da1b83e3f2fcfded527a555fec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c2863fa0e4d4fdd8db72d3db5f4b36

SHA1
9c849b9f0ca948c8ea623f0d2eb31d459e707d0e

SHA256
6f02fdf4f66c6e48685d20ae4617078ee51af79a6554197e97c9f7d0617b070d

SHA512
b24f9c50651c9550db5ca08bcf6b59c0a077deda1b778e807bb2d083966ab3b76db3b8d6562e2e82b1feb80486bc6bd1fc0d14ceb8ee155b569f0b43ec2627d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f2791ffd26746cb1b5b9b38c05cd1c9

SHA1
f0593979b5c8abf9b0beb81504c8f8b72c923988

SHA256
d01890bcd045b52dcbe530d1e6467116f85cd5cf540c825a866939fa7c217bde

SHA512
e1dca6c2100dcf49bb45288e6ddc2fca70d46340962d8ef1aba1eed004f75ed22c66e3a56d24626a96f8bb3b975f4c2a2e0f3ca5d48f07d9a29e1ccfc1e32edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8026fd515f0291724f12b1689b454cb

SHA1
16ac4b29eaf4955fd96623dc7dd918173d7a09f3

SHA256
26ac69368f9cf0827108ef7fbb8aca960d0b7f2cc1795207c2e97e57ea63ed33

SHA512
c1fc87315eea49a24004f23246869b67b7b2cf198ca81a02bc76ff3fab864181816851400cc9df14413389a2551e40032d84da82e82e19a6df0377ef80aff2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4369a6a35fae2f943e5a1d7a4e462930

SHA1
c2e0cc77b316dc511d1512fc4971c195f8405c8c

SHA256
3861306358369b910aa73e9102de27c2624248b6e82b6d3c58545aa036251f52

SHA512
634baaabfce3337e17db549d7c4cba96a16dcd95b53da6d21b1e7554c2b67760a420ef1851539d866d830b5b9ee07b38e37261d33eeac0176fdd65b2aa30336c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab885a12aac107a425230aca51088795

SHA1
d3500c7a73dbe29ecf6c0296116d23ef48a9bf5b

SHA256
9688c5ca5de613f68d5ee518353d99e79689390b81eecd4ac9771cd21e3d192f

SHA512
9195fb12b9626afd4e872fc8f48aea689b71cdb06f6c3875a5be364fc919620a79ef6f263c903e695a78c31332001940ac95f4941dd3011a532a38e7db2caea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a36f22e834c464db61e22e0215d3422c

SHA1
9902a9603c0f2a0449c570c804d1cfb6a8da4bb8

SHA256
b302764e71cf9ccc987794401d3ecd54533d87ac4d9c5b23d76a669530066d3d

SHA512
c2cb34f599afd86886b84a56badb6a086499481f88a697fde13b2c3a810757025382a98b65350a8b0c894b412d72b61824428296499795b1975ce3f6da472ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59dd395791dae3870c2bb1a75dd55791

SHA1
7fec55476e5662ac10a732e9d64eac936c18c26e

SHA256
1e1d420a4bbbba96b40dac82be6c33beb696627691bb50dd922bbdcc199f319e

SHA512
e38766a7d502cc2785fb5faa6cb8386b27254267dc725934e37e3783bf3225e63a7cede90faa3e5007bd1d25979e2b444bd786bc0fbc96e20e6d681d6b351703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce75c1b66562a441f5dfffe61dfa6eb0

SHA1
39e7166915ed42ad4f2b3865e3e2e13be1e19857

SHA256
3ce9df3469576d2326e7e1493077797bc75cc50f9ae40bc51baa6d6426752e08

SHA512
8f82c61fc3f620506317702315445832555cf27823c57f03eea1891e421205c0e92be4442701dab0c0d1ff4f4ca6dfa312bccaf64751dce1b624b30489c34421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F1D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit