853887178470233af199320016d4fc29aba5404af0b02bff6264026d8846104f

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c742972e401e91f39c7f5f86b49b601_JaffaCakes118.html
Size

38KB
MD5

3c742972e401e91f39c7f5f86b49b601
SHA1

43aa5626ea72c2fc5741621c9883c07fa2c2eee0
SHA256

853887178470233af199320016d4fc29aba5404af0b02bff6264026d8846104f
SHA512

7b804125a293acca56ccbb2a959e6362b06fcca84ed7c76185ac27aea1ccd68620a736c994b45f3842ea56d5da41dd448c7469934e4637a8aa63fefbc5beea9c
SSDEEP

384:a4S53cFEZFEpryaV3NKaw4wSX6KFri/HGBHK3Q/kJ3FxSUQ6m1QWXhS8JLUAOABW:rS5PEXKV4wSX6KFri/HGBHsFxpQJUJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38D2BE91-401F-11EF-B0EB-7699BFC84B14} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000f71fab18edb1a273bf07db6759536afc65914c5759a315d82e7fa7e5eba9f9eb000000000e80000000020000200000005aeaf754623055fa9ebdec085996dc194c48fd8a1428861a14d269621d238c299000000081f592cb8221695b821caf030c8534a79ba9f158fe1c01f5b23691ee2500780fe2c0cb91d2413496ac6046fac7968715ddc9f41be275276da408392632b43a042bb746507ba0686549a6abaa776a4afc0bca63cadde654e0dd508a50ad38bfa652cb510fcd5940d46c257c33c9d0b0f4cee708ce049cb10ed337bc093ab196247c918565fcc076d6732ec79fa02af7c64000000082e44a77725429779b54082af7faef6b41324b052b92ced728b5c256ba1b5cd890e3a75d2d34dccd6a4abc89496224b3d892d91663a612326fb621c519790a41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000066bb357fa7ce7ebac82f139170784d8f1803e1fa142aab7147dedaba67c2f663000000000e8000000002000020000000aa1517a524e9610121e1e9c3fe11d9970611e94ac916ee20ad05be6be2b4081c2000000051b0195f7f926d36498ae633734c0c072aa3c44aa97cd98ff15214de10b08eb340000000b969a8e8afa34c5565822fdbd3e157b28518f999b5dd54781e46b85e3ce68478fbef7ae496e178cb2732ed18ad330d742283c2a8dfc22a3adb39388f285f0d08	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505d860d2cd4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426930699"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2524	2248	iexplore.exe	28
PID 2248 wrote to memory of 2524	2248	iexplore.exe	28
PID 2248 wrote to memory of 2524	2248	iexplore.exe	28
PID 2248 wrote to memory of 2524	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c742972e401e91f39c7f5f86b49b601_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1df26304bb7d463c7cffc76086cf3e4e

SHA1
05c5ba332354f1e3789ff272a64d1dcda7480805

SHA256
0dc51b376e2e3b0904d84f758a93a792199937868e427c20361901696c73ef0e

SHA512
4c27eeacb0d41846846cf24c0b2c79c17896ac239eeeef4b7047af4caa28e409d02ad4fab37c77482016a22c6c5b41e5bcc96ea7c552423717bb73f40dd26e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70cb5c4d018e48fab3a0eeed595b9b36

SHA1
5532a0b89db3c571fd3d2809122ece08dc780b2a

SHA256
b6340883f9f0b90126323cf6e49e7a0a53a6180c2b0df7b8a1e046e44abc1020

SHA512
a787f75e2a8473bdb46f50a4f846c6a538159018596d19854bfab487619bdc6d386c53b74b49d5eb0663d697fa9432a8547437a4558b745357073d83a82ab1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
798d44d286ab28b6d6f5e8fbd92e73ac

SHA1
202da643639c5aeca97f06d9aa4de1b9ad191418

SHA256
811133ddfe4947fdf83170c1e7386137f91f60cf8dde432ea4882e840c7f44e3

SHA512
09cca1a4e16a5239ca612e11916039f979e2e1b86f094af78089bb7688da6341f2361de32fce312a298645470111fc1703f50b685d45f74db4c580398845400f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ce17ac21e366022ca2873246172b21

SHA1
72300baa5be6c1e69a3bd6794e6a6612df00705b

SHA256
73a0d64ae70f83a7c626804ac535ac677e6de0fa5474a3c190a97f3ffce56ee1

SHA512
b829b9b408488c75243555534e6d0a4f627610a7fd3f0523034ec9ab8638ea353f77dbdb8b2c915da595b0b9782164f92c10ef43936adcfb1b3bb302c5dd0175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eddf9a5766aaf1caec2aa0e1e3d8f02

SHA1
628ce4d5ab50179953a7a99aa92c926b6bd64ff9

SHA256
5181e702092b6973802194b5b4b8c638d55113758bf844b6514fcfff61cb0aa0

SHA512
93f08cee1ece7d8fa8d10d794d9571f0c48327bdde470d69e3e2ec5738362bfb7b74c3c8f0626b6dcd8b4cb1941c890e7f88d78460aba3d11b820aac4a8c9efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2a9029bb085a2934e271b41b24c349

SHA1
4ec144037454bb58278ec6c3a8428a18e2b9bf3f

SHA256
3e62f9492859c13ce7b2e932b11ce4419d8d9e62a065357fe329bf80e6afd48b

SHA512
fa20dce1d7b8da8dc8711147e082e069b851f0b8b893cf72a8424432c0156c722d6cd26e543a7f4ce8d710c46dc3cbf16de14f9205a8ec0ac90d4ce0f942909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac5c9dcfc24711ddc9a8dcbc889fcc4f

SHA1
805dc1bff0c6944812cda34f0c01f45221997e66

SHA256
6d36bf57e586fe053c2f15affd777050d30a86bacebedcc984b41ed5012c8e38

SHA512
53a3e76ee253f6432d54579c12987cb5cc06c50f067e574f3d5cecb4c09d4222dbe7ea7462785a7c576d1ce3609485561f0c046c4da35a089155c6671ea66a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220134cd51a9150b40d8744cc8ff496e

SHA1
d7f99b64760fedf8e6dc6888e208cf1d927415be

SHA256
1cd0fd727b3dc55d7f97631bc7467741812c8d8edef3d857173bc158f8a2a895

SHA512
22f9c780a4331d59413ed8c5a35eaa98f3f6c803433510ae04ef60335d651c3797d4b7498489deea55cb33f07f96ce4caa0061181417c9bac4d74e15080fd01f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5705ffad9096e5255457b954f0af9a0e

SHA1
78af39dd1377d4aa2c5e564c72e7a73d30eda8eb

SHA256
505ef264db5040f5cadafa012e716fb96e0c4dd5e0494b716a57600cade50b84

SHA512
ccdb94eefadcd975e6577c93f541959ffeba8b3f7ea4e6a3df9a65f25d39c06bb75ffc52954f478d1567a4af964872f2fbb498909698c99598f72384cf45ef0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4e99643ccc56b01080b2906fbcc7404

SHA1
b8e28c37829f2078713099290d1e9bcf57e510c0

SHA256
ffbffb2de8099cd46c8eb98bdb8f8ffdf2994a93118ae7f15f9da7ce4345561f

SHA512
8a92a898ad5b3b10bfdb8bf81b58ddae0ce03a83173314ea313e32379f432fde7dca89307ac02b856126ae05fb874599f8f6949d7ccdceb2391a908f5dd441e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a86a3fa640476c0ddb0e9fafa9ca68e

SHA1
f91076149875a6d56cebceebd92ad047fe58f52d

SHA256
c8dab6a506eb38c9834728819d8d9fb68ae96ffa7aab8dde722f1553e9885c07

SHA512
1b65d152266a25fd3a7f8308a4a6c051eec1cb9284691e56f44f28216c9d0d96f5d056dac51dcdc426c5a4ad1395c36dd3c0ba656ecb0a2136c03b984cbf6eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd37e758acd763c7d35379393ac975d

SHA1
82f428d70f105bce433a8aa9195edecd973d3423

SHA256
de5eb99ab65889b3cfb77ac25ec918d3cb28313b5cefc3075c9928f9f2fbea55

SHA512
9d5ce477546ba4f5408b8c2a71b7d751d3c067b2911b15972b68fd2332cde39225aa18baeea9d3aa555999d9d6d82c7946a12296fb139c0054368e148d59f509

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD877.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD899.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit