05c312b65cea2b31966760b53b3c52570e5610404af8a132b7365eaa2bf5887d

Analysis

max time kernel
140s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3be51cba01f823696930c3f1ef8edfc9_JaffaCakes118.html
Size

18KB
MD5

3be51cba01f823696930c3f1ef8edfc9
SHA1

bbadc20b38864fb4e62d65a520b11fcc198af490
SHA256

05c312b65cea2b31966760b53b3c52570e5610404af8a132b7365eaa2bf5887d
SHA512

516b6f8995eda4a61768789eaaf87bbc07fa84c13301f01752f5c68ba1be3d48f831cfd3ad406dbf9ba978fe1927e6d4e13572318a7bcec8570a2c30ad688c40
SSDEEP

192:H19o34nEX6wAhEEQ/cv5num2XTCGA1O/zMsFUzZDQ+bNcsgKcE3Ea:Ho34nEXehEP6Zu4/0za9DksgKcEUa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AD9A0E1-4002-11EF-A1A6-7AEB201C29E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40736f130fd4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426918250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c34a479451d14170826c60411dd84ce7e84a7acca91c408ff2833f08eb116025000000000e80000000020000200000008fcf871cb70f177ccbcadc62e68d91182323ed37c2c7ddab18e25d8aaeaa2b18200000003ea0d177185bdd5b2fb34835128bb6de499d0fae3c30c5e5c7bb3497e615e1c5400000006d82fc375aa311695d48729e6686eb19e9c4a6e10017b644820170e414ca43de585c6e211f533e1049fd48aad133b507e9f02a89414ccf030e14cc32096bd560	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000cddd6831312ebc93d3bbfd303bce88f99571ff3dcd26ca1b85557dfb8433a20e000000000e8000000002000020000000de85d1392a52f572fae32ceff63606c0b968b6cb9130848e7bbf3999295503cc90000000da0a632bc50ef7cc1414157750adb5c9631848b344a430b420bcee408d7d18a2038538dd488980ceb16840d21147b932eca4aeb632574253e31ebb0ac6421a713fbeecad13aa696438aba2309ee04a3be80c5cddf2f95f7f1160c38f45bb024d19a4363cbdd9f210889110a3cd59f45f7efe98717acc2b9098dc7ef97781ec47eaa41b67a79902f329bfc3054153c9f5400000005edb987a2ac8640638ab7c532391d988eb8506c94a7347209b8d894b8b581d7a5536efc2616b562b1e4fcc747330d1209ba43c06779b69e9b7aef3b809a0a7f9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3be51cba01f823696930c3f1ef8edfc9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3b2c3b8a13fb2abddc45e0de9ce8ce

SHA1
1ec1eb96584c0c111d2fa75556339e1271fb5bc4

SHA256
9cc9423ceed514e53a6c65e3bbf33aa2624f00f31a4664396935817e98b01c3d

SHA512
1eee3388bfe14ee53edd4d1e86d15c99c05151829a86d1510c980be6dc898c9186d4780768caf2f1ec6145aa4a2becca34839e56ee4829a1df3a0e7d6daecb6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcfbac549b0320b6d2d891bcf801ddce

SHA1
8155c52ac73eea6758fcdf91746d558db7eb7431

SHA256
d3a31da5a72ecda542691650a200945991c06b9def2337efcae47a0a3e62b6f4

SHA512
7d016350e699afed3e6c4dcc538c103f22c470b681f005d6bb1e014de37e2ce8b1d6d24c3887a7e24bd548deef88bd23dda45b247ed2ecd06046858fe227660b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33208b88babcb0ffbecc623bb1166f34

SHA1
734428abbd06e1addbdbef3c9e1618c2f6e84e22

SHA256
3f565d26c83c79190b47ea66c1af4c9b7a4777dd8b622a7482a35bf005381e60

SHA512
2307c05d230c51b214a3049122f796eb279338b87acd9e84aae22131703ab6b80d69a73827609a798409f003b0d7a27794a0f9027b383496a93f25e6fc235d68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc3b49e73aeede5d7bc915bb6a65ec7

SHA1
423e1ed5a3f3248a253b18c9a894fd565bbaff70

SHA256
260e46ab18aa29a22e6eac7be21a6c96149dc6e9382f71b266c4f5639fa48aa0

SHA512
f386e708b3e26c999898482c1e8d3561a049ca19c6a2d1add907880c144b24fefc82efd4428a32cce09f7ec8e6cd157b49749d381a2c0413f7f769a64f6c9864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e879f95e45eb621f99e3b1355752b3

SHA1
7afc89124800ea5d5fb923c7c024b9f1ae9efb0f

SHA256
b7a4068f6f604f91215cbf8bec093dde45eb1703a6fe9223431f82d6fff7c87d

SHA512
a9d3c41ab07e523b126483835f2afb4c96e6c826b414004b05a83dbfc658e39eb2b0a3c2163555484d2f68ba467cf70bc5e8c1b3e9453906ac2b1aa4efa85254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2d29bde953990f742dfdec2132f2521

SHA1
ebf887c5b106f318c89033fb02a4f9c7026eec10

SHA256
14cf43053fbf25ab11fa64723d8c7b9dd7160b0d95b751ac3b08c39c3629f57c

SHA512
7a23c0632ddb01830b26136c37ab1db2f62bbb0d5e97333c01512ad12dd3878f17b335afd4c01626dda51b5da1bdc2ff9412050b2a2ae2be89e4e68d8312ecec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ba81ae2996fae04ad8d7d04443febf2

SHA1
4d7d1d840f0f16b90937b7beae5e5b999116533c

SHA256
cb3d22f540f58f5b9879d4db81127183209f8a26b57320bb53eb59d3c11e4ecf

SHA512
fa9764b89b057ae6edae40e1727b7a883ad0f9a1a4313ecd5f95f1f064115f8e554870733635eda9dd21a840b553f4c42581cf677dcfebf33f670322919e7f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e095bb4190488ea2a1100ed3795de0

SHA1
c2c645de37b6ba76d0ecd84d64768b6808bb29db

SHA256
470f97315f9f20a72f3c54e15c76d6e2d1653748083915d0a58b5318d1101d8c

SHA512
0e2880b31043dc5579fe5e7995fbf871357a389bdda71e6bfad318a2f534657cfb23c95ccf2c12e3de4d58923340e9e515c8d067463ab5d36d041b0f811cd180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35dbcc0c4f0b996a4c7ee9db61e7df01

SHA1
839dd9933162a28144fd7a06d972fd990c343974

SHA256
2b12772a789b3b47622e6110ee2ef046d96f9d28892ae04a864a8afdd0d56687

SHA512
378fbcbf530b6a58b5f87b1e2d25c75fbdfb0d2d2b6271dcbb7e767b655a880e4166e4cbb36c3f0d5c130cffe507a6f0ed84d2b4b8046060ac485a490ce5a51e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a92faa8614ee5eca9b2a07cf009b6fab

SHA1
4a7938b45052fb427075ce30cbb2d3364f06fc8d

SHA256
046b4934275e614a835cc1cfc552dc936ee6a5af479ec3f9c22f3d0dab8661d4

SHA512
1ff7b2dcc39a8c19c66a5ba636e4438a98b87bf12c5cae51a1b97c3e60623847d27cca43caa4d212e916d45cfdc8294954d566d8944eba91e1c6a230e7409681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b580055b5aa2ab08b2629e0e3fee6abf

SHA1
52be1d104b2a3499e97aad2832260d4f24b64891

SHA256
b256cedba892d0a332487eafd81101d8b9e94d125275e4f95bbf53beced0010b

SHA512
5e51904760867a0d060d10279f77103d1b0b98f0dc63526b76d050a8889e7d3ef2086983921f25e1094dbe32b4a4aba4e968d5592bd723d0618653cfa0f83f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b9a0529f8cb2091c67ff94eb24fa70

SHA1
67bb78462b11634e6da101e6a02ec124f04beced

SHA256
d76edd59888bd7959e23c5123fee8788e7dc40d13cfcb4c4bb8e8422f3407344

SHA512
36942f316919a3a2afaf071f661e49b5079649eb089afe16159589c13524eaa2249d962efb850a3e371bd1d3549ae2441872b16a74e5545952646789889a6ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3914b7daaa1fa490f805dacf108ed03f

SHA1
aee1a84362a8c04c38fe5436211541b28eeefb6b

SHA256
7b1642dd40e79d15a417ce487828e08d784db702feca66c1f73e4a6304a01623

SHA512
d3df5a4688602d8066ce13e862e78c54c65ceb5a5ce928a680e063fc2429f89b74be8318516816cae5793313d080ee75c97d8c06f5f51bfad0ce4a829dcd1dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c35461aa9978affef67ee047259896

SHA1
5fdacf92d1252d266b5d4ec5281c08b0c05a0bae

SHA256
a32e91e11ed9268791c66b315a1e2eb2327474c7a514a246490362a2dc6931f2

SHA512
0c56010477ebb1b884ac0860625ffa8301019fe96e3ca03d96b0f7cc58015ed20400946d717a601af95b47f0111c2e2413d517e43936f5ec3556142ecf3437ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c42ea474556433297b762af5ad1d0aa8

SHA1
2a5f978a3921ded70fddef16c38567edcf86e627

SHA256
b85c408a7f91360c11ebc10ac8ae365685452157f75423c559d7c6de36fefaf3

SHA512
ebcc6eddf3bdedb01174207886bd8be08b78b3e9b34545dc575d8a616427868a0717af99522b6d3bb0ccc17b690f304f91b0648791b40b9f37eb3d8668653d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5BB8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C2A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit