13c3017d8a0b5338687f971a6ff52d2821ad17ce61f7510ad56db150a206c7bb

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3dbf2b61df28a976ae21367d9cd4aa15_JaffaCakes118.html
Size

11KB
MD5

3dbf2b61df28a976ae21367d9cd4aa15
SHA1

0512eb12a42ffc07f184a02c82fec94ad3c15183
SHA256

13c3017d8a0b5338687f971a6ff52d2821ad17ce61f7510ad56db150a206c7bb
SHA512

9c270ff8ff4d5cf3ab0f1cfd5a64e41dfe5c2935b33b6b5f389316b39d96fe4e5737ecd5ac3bf72b3023c14294e1ba52cb8510c8928634eba289a6928ec1fbb9
SSDEEP

192:csz7vOAYS/EphKCO80HY2vfUyfcHHPHb76f:cYOAY8EOCOOfyfGvHS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426956197"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95FE25B1-405A-11EF-9143-7699BFC84B14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30795f6b67d4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f43cbbd204b15e6cd9f1ea42c2f8e342ad945fe07f2fba9b055b7b7205c840b8000000000e8000000002000020000000184f504af70facc820546fa9939a7122fc71eda7f0210e515709e59817e626dd90000000c79b2af0d61b4c87437b1a27bb0bf48d6b36fd7ed1c57f52cb2be09ebbbd2f67c928c8e70f61cf75b3675074a0ee67c0348eb564dd26b166393782600c694e21258692f7733cf01bd42520dd0ab7385510381b372408fecfe05e732fdfdea00dec8e965a2bc8ce145e3b6d4064aaef5153519ee23a517a09ccb4cb1da3ef797a16c0ce622987a4755ef5d283534711de4000000097653a9be7fb7a9fadaa69e3199eb85095d118b827b105d2cfc2266648278278890bd24897e621e97a0dab178807217a770adca9be19d083ff65f70654379ce8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000591bc2e7cc75737bc586a32e562536445a27dc61479cbc4dc64d64b38c7de644000000000e800000000200002000000020d16cbe5539fd3952487360fd2d5fba1f884dcf8d5342c7ed30295bbf5f0c7b2000000078975e894cfa12d378df99df8f3420282c89747a97438811efff1a5df5f8000e40000000a6a29b5a19ca28f3fc2c472522b19d4e1886c5c99d9da823fcb2515cd2a323c2ab1d2bef1986b96512c61f79485dd5437021ec9b222e0e16bfe0bead5c97e21e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2328	2548	iexplore.exe	29
PID 2548 wrote to memory of 2328	2548	iexplore.exe	29
PID 2548 wrote to memory of 2328	2548	iexplore.exe	29
PID 2548 wrote to memory of 2328	2548	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dbf2b61df28a976ae21367d9cd4aa15_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0800b79a63ccaf58de3af0f157d9448f

SHA1
69dddb9b7dd91530a1c3e6db0630162a72efe111

SHA256
98764a72b7c608671c0ee7995dbae3a6c0425d27969977b48b4704770875752b

SHA512
9e36f2c120e994fcc4a3617c06bff927e0432bda03249f059751785d4530f822ab9fb3a1991ccdd704d5cc93eba8730d77beaaa5066651d85203150c98b67ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed02ca4aaf32e75c63ba9af42b315c62

SHA1
ab29db51dbbf4aadae95b1ae5d1c2ebcfd8125f6

SHA256
ff11b8eb0a7512cf19a208cecdf83b865004908275588051a071b8596ac52b7e

SHA512
71ba1a9c8c9aa3d491c085e8672acc29cd4377ca096e919b3a891a9b8d211c97cca3e82257a46c9d03182e041207c3e02f9cd8bd9b8cb113c2a5bc328e0bbbe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4532dcd74e8bd345f0b2d5b7b4f0e0

SHA1
c07c2a7470eb379a8ae6d20310de5ac3a153295f

SHA256
e85438febea44c0ef59500325e5121247d75f2e528addf6d0c45116d5e00fa9f

SHA512
f92db13fdbe6f02984a18b4003ec6c018ecad8900bab0cdf35dce5abce5fffe224f6db3365080872e65c11eb80ffb763332d255d29dc76e6c961c7c33935c15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc36f7c36496bb54d97442b70b40b437

SHA1
b0114d02cb0a578a9f5d850d07c32e8c35324b39

SHA256
2856abb80e40aaa10ea275f8a7e5e56a25db282085d59228f2975365001598a3

SHA512
15c0bb2bb0b084a7a191bc782b1fbb0c7588b55e66ac29048e8d1d592e1ff181cbb99c1e29991701e4654b4ef7d17904d61b3afa841362261fd4e2e9714b7296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f88398ae98c0d1745e51ec8dae63fcd

SHA1
ae3ba6c61a72291ff9aae8983765029b51c2e6b8

SHA256
98076678ee3385238016fd2d8c9ef7c58554800e933d822ddbff01a1b1fdd578

SHA512
baa52638a919d88d32812a62111d09ca72ad866926e67398b84467c927649e5e487f9292abaa59cbea1e6d36513c14935e42e5c01218291e79a327ed3b3d6b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c0902c306d476900e498f2ee9fb0ec8

SHA1
656fe894701707bfd3e22545a36039ca2768816b

SHA256
a76fcca63af4c616916f97a15ac37f7a94f9e1b4bdb4371f257e981a4d769acb

SHA512
af81b3e514fea90a415e6d8d43850f5efd2e85638713271c2bf7d61cb504d0b30a14909516312c81eea88ac7998fd4b268588150e7fee9326f545006ae570f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a3cfa78938e45f415917b2d8f503977

SHA1
fcf4095d30f1c02f500a96e0579821cd29b63cf8

SHA256
b1d98cae13e4fe5966c176faa97400829692aceecc1f4ae64c974ee6c194ee55

SHA512
ec5e5165938e58ad352fd03b8eed681b9afcc497da20d26494391a9dc7e9c49b7ab5db61f999c3d28e3a18d213ac21175b0c1a682b3a66763e7726694eef3594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c17bb1dc25dbf1e8afe47e2625f4c24e

SHA1
579cecba31f8c1c80e199a2d21f71e8371cefad5

SHA256
35c543071d59e9e1633e9a39aafcf95e5ee902e445179ba25d8dae9dcf8d691a

SHA512
f54a022760c5b7e4141099735f2299eed029a329ccddf90b6cc276d2f6fecae63c71f6dbe9f6398cd307be9d5b18ec1112e765d28cbf105a5760e6369b050212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f29e35d339fcaab775d9582a939f3c1

SHA1
d4915976a8785388dbac24e75487897219e47460

SHA256
84e0f539380e25d0d4853eaf5d7a1560ad5d539104ce932d523462994639bd35

SHA512
a04c7d660be107d0debf6ee35fcc29e896e644ed25859bb9aa40dbad2fa05ca2e952ae5d15f2064cb11921b74d5d181d05b1ee069e412c54d3f835440ddb9f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
945d2f85d5147149d29aaccdc89dacae

SHA1
f2fe6cbd71d1c03cb4e00a0b23ae5170b5179f5f

SHA256
6c499f970b87ecc2bd4062db784b4f9634b417f4fe7a3ad863d7e78cf37d8a2c

SHA512
4f605e67f6f343087bc26d52c54e2c38570ed5ea0034abb8893e6a377745241620b32dc5701c93395845b92cc5ff2bf352618c5ec6d62c9f571bbf13c8d2984f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32e96fe5e1990e8365648dc062c39f95

SHA1
b5548a5bc3592c56958facc90950e2b6e82de294

SHA256
e3a33b1d371a8ca4aa4adc7f4e2ea7b238e6f3d6689749a675d99defe70d448c

SHA512
c748a06ea54b81cad0e46c1130b17ec1aed899781bbb3544218e1f5ad5c2cd958fc112aba0566e1b7a5fa7979e72da5cced06aea58880a229710c9c1e6ded578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67f0317c9ad532d3e4be9cd56245adc0

SHA1
9bf06ad5cac844a7856a5858448a916c71f1809e

SHA256
4e6a0fcd6a2cf57c07737e1a8896c8c04511de9f32684b9a2ba2cd2d4725b841

SHA512
6a97f1e94dcf00753b61ec61fdc3314de962b53959b5872fdfbbc31a11adb8eb56273cb1ad1aa2f1d1789f77032905f5afc722ddb22a30d9147a6f6551193e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b003d177d196175f168f903e8838b9

SHA1
8876114ba7e707f4adcdb820df2684eb0d67b5f3

SHA256
9b3b94c09ab5167ef08a3a828cd9f3dd2c8846f718441c6b753ba8166a85dedf

SHA512
8eb17298d3cee556186f57c2fbb0670c10d34521acf60f64306c376c7a744bac2e970063c442bc0c1306e0b950d105b33526fcb40fca906debea4645bbcdbd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63b9504c68bf18af70dbe77b791ad229

SHA1
69b9d1c1d83a21f09d83fcaef43ac084f2e0d5cc

SHA256
bb57a7908f661713a2970aacc3e56327a79abbbca2410a3ae10ce13b92b13fb7

SHA512
46123f8aa1a0a5a7cdda6bc047829456a5cf22bfbbdfd1a80aca7471b216f13db5a69e94d84885202993fc5f7f7ee6a9865330cefdfbf02fdd14145ad909e49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033769acacadec3fe63971ddab7369aa

SHA1
ba24bc254e04a50f94a05e3d2152cc3a0cf49574

SHA256
e57a5b2d6b2aa9b71e8801258129bce62d43030c96ff84450af19223c3e311be

SHA512
e504a9197e92f2a0dd1b28ca5a60959968dc0c6e5c02812ac269354836decb28679d8251857c2c3f7606c80513e137856b2f62c9597acbe947142667d354971c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31071ea7e8badd137dd20ac9dedf2221

SHA1
1a70cdab7bc337ea29661ee46675c0f1a7530e1b

SHA256
ca8dd109034a62331d0bcd5046336563eef989f696c4225b6ee4dfdef37e217f

SHA512
3e385fdfceabd461a57d7670d6067769566c45e8a4f82ced54a4cbe0fd44e693856e2cb47bc206644fb7f98751730fd4d2318c55715033797e95f4a471406333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6a14ca7d7006630cfd9471237a60ce

SHA1
e7e8309f720f47e8a26ee87db32ea3e2b5683f03

SHA256
7f872fc5aefe5554b7400b8ff8f0530bfebc93773cacdf05d0445a418a75cc92

SHA512
8405a4187d7a7b6621161cff1e7a473b129226f3de6de881619ced759bd80cc1b06f3fa29e8d9732c7ec6d78c6fe06812803ead2f68aed0a7b1984a581332024

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD24E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD30E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit