6254dbdfe09d7d4094e07884840a285de126d82be9dc7b093561a94b11641a7c

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html
Size

36KB
MD5

3ba0155f4d84d6106cd34e94a2a29f4d
SHA1

1adb222994ff37b15023e8cb876764d54fa2f528
SHA256

6254dbdfe09d7d4094e07884840a285de126d82be9dc7b093561a94b11641a7c
SHA512

660ef5ecc01535b73b6d23670c28457cfe563d0792ba58ca2865dfb34dcae8a3bf96b554897e33a0b86f8e455cf9d280e8661593171e044a5ed70855d9ab8928
SSDEEP

384:3r1P1C5KolonoDpoio2oBo+o/ovKvjkHhVbJ23qpB7WJ2BhCKxLYy8YxyoUy5cyq:bImu0GYZ/o7/7dr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{369F3BB1-3FF4-11EF-8BBB-46D787DB8171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000afc8a20d0c777de7e29646a050946b463f780085498a10fd82d31ff16a63b223000000000e800000000200002000000023399845845761d9025da06ac913ff39e765ca57e7cecbec23b56a3dbaf813d420000000c814bfe26b2c09436738e1dd91e58fe41d9689392b46d35c689f99a36d9033394000000004eea047ea93918ccb417ab77fd6ae78e77274d5fecb810c04eb89b26730556cc04712ef19782ae74d175ebd9ae513b739c38793182eda6b6bcdacc5be769bc0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426912227"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a343bc5dc07b3b1b2f58c5ec88a382411307172e465c32aae8ebba5717b03a33000000000e800000000200002000000017e49df264124aaa5f9f30fc66cb4719743daff6d6a6b93498c277e178ab9214900000000da1bd7b31c2794756621bee1c24aa65820635d1ca7cb3b582806c2f1c5c6b2e762597975502d1be4ab9c6405a319b214758ab68fedda227ad930a1020035e22d03906b2bfdab68a8e1421e9e940205112faece223f3c51669034af7ef7331282243f05d8004ae79af6ab597c883048e39a81e301969e4d231b86fd5847c62fa6b33c4c87769f0286b62f2d34d227f4c400000002c250000bbe704feed8c1efa261825a4cf8761a18fc885fb32284af9364caf211820095db4673af5665cdd9ba482c9f2e4466623cd73f90c5a8c2eb06eb30e6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e097c60f01d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2324	2272	iexplore.exe	31
PID 2272 wrote to memory of 2324	2272	iexplore.exe	31
PID 2272 wrote to memory of 2324	2272	iexplore.exe	31
PID 2272 wrote to memory of 2324	2272	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79fa94864e64cb6a94a1f3ecd4a25d46

SHA1
3877f81e6dc1f3218f4bdb4b27173df7a2e4ad74

SHA256
26b97d1137dd67feb8a308d148fc6f8b75d8c3927594d85f71966a52ccb97a6f

SHA512
2101c49cc2e22b1f73f712aed9640f69111e5feb13fd1d30ed5f4603e9450d641db877c9aabf198dab8f96d8ce500ce962b3c818a2d01c187fc762e82cf6883d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72f1813dc22adb8e9a5ab82f560c3805

SHA1
2018da81848ea063bea1e672c9c359783bbc7ecc

SHA256
cebe74a02e5aa363a27c2f90bb221450bccaf50fc5061a9ded3ea96c1f53886c

SHA512
6d97ee44723ee83aa89c2ababc7df9ec4a80c2eee70b6dc8a7cc3b61b3f23167769c7086608dff1ab94f9709c29283ea0414581a175bb2433cda0cb8c7aac223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91b83480bcf092665437e55f79243cc6

SHA1
2c1386c4bd44adc42ef265e25b6ac4b7c1a89501

SHA256
ad99a859b9bc127abb141611ca753982248f94115bbd9a91fddcf938f40494a7

SHA512
842794730aec6af88bd43e82e77b41a493e42f6163a1059cba48ddfbb29aa8d80ff4a3ecf8a397c3de658f3e72bf7336f55c6fe3589e262d8ef630ff74ab0c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aba19adcb82958f19bba3459be46bc1

SHA1
9cd52f908f63760c974a5b34eb02b8d8ac98c171

SHA256
8b1b75ba4a6b3f606683ec0156080af822969548ce421c2763ae171636be250c

SHA512
e12b093a9ceda85ac540b71cfa7f3e7946a8e9bdfa3dcbf5737b8183f83fc165e595cf23933ff8e4e7b7f3acf7a11d2ed7b63b68bf0660595ef0f8833f7777d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
489ee761dafad86d36becd721dc62ac2

SHA1
cb362bf03ecd2d5067236f145e0f7d3984d25d08

SHA256
c6f040417b07d254cb18bfac6239a2fae21f1103129d6bc4cc6b1fea4b861bfa

SHA512
2ac1366f78eef5c55693bcd83fc553b130405e69a10c643b58e59a5a6d46105c5ba487b3f80a3193c2a4f78d8c0b1a2e53585f932df6427be65b5a8f210b0dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618622511f6cf6890d568c6f723e3d86

SHA1
6b4e78238430d4b096f30d865598f27820d03587

SHA256
77dbc1997195740b23a47fb2d82a3039d8e3e9f975ea88ef834c59ea4bc5893d

SHA512
003ad3862929bc375eda2c7eacd5dff973c783453a7d82b60d581cf9f7d2d397d909cf04f8980f1b27fcdcdb1a4875f79ba28f58b1ed77de735fda1dd0da960c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61ac8472a43298400107b084fe39898

SHA1
a1502fbd8440f8dfa8fc8b65b1dc72a215c1497f

SHA256
1287bbafac2baa98852c96f5d3b766c1f3a5309c32851f11eb2b0625b000bb2c

SHA512
a97688b5ddba3f7dbd59e2dcf6d7adcd1db9bb025908b23377a7acd589a9c21586effb185a2cac8953665ecc0d77d8a9eca6d7eca894447346b252c4c6710948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a4b16c738130eee45ccae97a892c390

SHA1
541a610ad6073a672baff4d060e4a6f862e34f6f

SHA256
e418f9a48d0652daffd361d92999b6e78a898f54bf4bd374f93a368d4ac95b94

SHA512
0f9c712b1d5df240727aaaddeff4d181e14892d2a1f49aad8819dd376f60c932a721fae86a17066dabed4aa94cbb461f0ecea0904361b3d98c843bc432a5d999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fbd4f0186ed9638f4c459b9b55ea30f

SHA1
275fbaf0097ccc83f077d883debb9873da76c464

SHA256
965e01a36fa7f2d4a565c3c40c98a642bd2ca34455ca92a162dd8bb6a6d0bac8

SHA512
8a8088b0e9c9893e7de2c1017defae88a2299ed0c896b7d3d60af6d3df9b757bc28161b23e511915db700a9f8dadd0c33883576a336be0f70b3f3edded0d9029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69209be2036ff8ba303dbbda5427d272

SHA1
82a96825e6e0030aee75efde9cb4c9e22a8b554e

SHA256
0071e084377e7337d2b3fc1b271a835e43ec22cfcbfa842ec9042ce4cc4db774

SHA512
b85345950e4fc6c6fb83a27dd0717f3941538b3dd789bd07f19c7528b56e407ef129a0056848ccdde4d8b5fded3126627a1e9ffbc90a4e90006bdeac3678c16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bfa6829cac85a0fddbce95a4f24c337

SHA1
ed155ba28dc8995d16911f3764c3bed038143f9d

SHA256
b68cb2a3b3a8eede13f4e5b51014f3130c13fd4eeb103069bb767d66adcebdbf

SHA512
718fb84d243777ce30ba08f272b3dc5ed69e1579dae32de7699ab04773d0f0da846747fe9ee0755a1afea7a1f99a851898def9ad48ddcd6fa8d92c129a172207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249fa7bcb72c5423f68a3fb26e0838bb

SHA1
a46eae112ea2d6d4ac754e016cd880e90895e334

SHA256
20da73126499a2601844419fafb154abeefe559a18c601c325886ac33f3cdeaa

SHA512
3223ac8b79cddfcabf202e7efe60e3dddd47a13ed43ea41a32fc16be0e4f10d9eed7a45507aefead272a96f4ce97940c0bec17713a222027bede5c5a94c68868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c58d4fccf54c3c02eea321cbbed7126

SHA1
b0e669a297541abc78a709955286f190ebd69fc3

SHA256
8c9a1fb6502d0e1b413c83259dbb7a87582288a7865d596ca14e861361500e48

SHA512
243a6ac6517443324e5555da695245715342eab5a932b4f4c4abf4665b51f5ff0639c75b2595b6f4dda242d78f59055620e69f97b87fadc26ec8caad97dbace6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad829a625494a7599c0c0923ad8e6859

SHA1
99024986ee3e9c7b39f359f62225f1acf5577d24

SHA256
ea1a36b32247c348265f377f6d53ba548d43d8136ac9169811a93c291e03a3ec

SHA512
b185a24e6e09d83199115833caf60ab7f1e2f135902635a8643fc535c8f1d93edaa93747d076472a84d7622e9ac862ef40f3a29a82bd1a81a2951ddef7d18191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0b0355229e036790f4f86b5002b2483

SHA1
6fcce56a5bbd3dd64e3cd44a16de4efbc8eddc2f

SHA256
3d18951edd84b181a0e80ca6e39f6db29d9ea147557ea763517b49547fab5da1

SHA512
546ee9351241c0ac9fd69d9029ebf9ada5138eab97833e9680df6d81bfdffe9ea4b89a7cb9c340a71894efb4e8812ddfd57490d6621e204e87e5cb23c38b3f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar109A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit