d1ec55ed8155968c3d2d93982674470c5dbdc8f8ef0b25adb2c886fd8f75a469

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e54fec605d6d7346fa3db0b2d886a2f_JaffaCakes118.html
Size

27KB
MD5

3e54fec605d6d7346fa3db0b2d886a2f
SHA1

296db747c047fcb2378ffc21f1b348130ace1852
SHA256

d1ec55ed8155968c3d2d93982674470c5dbdc8f8ef0b25adb2c886fd8f75a469
SHA512

fbf8f7f4b9313059a1d328dc98a7ae1a8df35f5ea6c2533cebd1409d3516c44c4d64b9a76d7b2d7977553e97cb3f838ef2b4a103b38209b6e06379bcad25dfb6
SSDEEP

192:uqeR774b5n1ijudnQjxn5Q/NnQieINn2+K8nQOkEntLnnQTbnZnQyCJVevo7Nt37:nCQ/w+KxygcseOhI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426969244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2015cace85d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000005ba8e52689688974cfb13195d7d1afe19a55ec3e34010edff89aae8aa3c819e3000000000e8000000002000020000000f68e9040d3d3540631030baa31598ef4d5c93166ab571498316a080651f3ab71200000005e56e212038604094b3ea070e6ef207621cfc5b3a57b07422ba9a90d2df196a240000000570a64d444291143e56c4a1e2096cbc022cb51f48ea2a81da4e5f065f93a8d4dc5868a81dc62c68a8d9224af214b57b45b422e9dd30afa2dcca8618534f2a076	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000007644eb16b9612d273b798778b838245066933089ca4f76bfbe82ad8c12ce1c31000000000e8000000002000020000000b1895de14c495b7ea498d19e1c118f1aec51d2b5f5715dae413a716010d7fcae9000000042edd662ec212e7bc2e182f36da4080725e07f053d1ff1d2cafd398d40b36a8196eed5a53edb84eead0646d162970385c67b55a64cd50e21eddf0458ab281471c029b5dca1d7c1badfbf2cd3e4963b54c067eadcf19dafbe708a978e08e4fa31bce116dad70eb19a83e7a551157471fdb16fc052c5b1b4d16e5756c83d0eb5c2756d151ec7ac5057b4e40dcb2982ba87400000007157e1085cad8c6e572240f141860e11be0994756c7294cdc2a9f4b2b0c28f29d068cf7c5baa306e8acccc28a537579735a85dcb89ed8a94c2a0e7dc4935b6ca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F89B6F21-4078-11EF-9CD8-667598992E52} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2720	2136	iexplore.exe	30
PID 2136 wrote to memory of 2720	2136	iexplore.exe	30
PID 2136 wrote to memory of 2720	2136	iexplore.exe	30
PID 2136 wrote to memory of 2720	2136	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e54fec605d6d7346fa3db0b2d886a2f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7eef25a1454d1d567b80fbac91ddb4fc

SHA1
1c6dc852e354c6646145021059e136f3eec42408

SHA256
0d031e06cda7193ac13c54f1f4571e6712a079d7fc3e154af014d85adcf1dd24

SHA512
c80bc9bf7f9e50535d63120cdd9b2a5fbdbc882848c77a64bf4e5ab15750e11e1f3ffafdd6442315d1fcf80bb27c58535137a0efe092cb853411554f03f141ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
96689fd1999ac8adac7c42efa929bbdf

SHA1
5c9ff316594c189b770120d979e467991590ae55

SHA256
2f741c8adc86d185bbfb18d5c2e07cc51af217f9e708136248a43f4ca0a5e5dc

SHA512
43e4f17d438ee3e18984ddd38cbeaa120ad6ff3fbf2b062acd913b2af0a0cbd8b2abc52ea7041cc8b0d91b4406a25d2c1308f5c56ebda15422f36ad55bd5a802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5b09d47b8705f6445cfe6440f542f91f

SHA1
7809a20608ecf4bbd96fc25b9556d85205196ebb

SHA256
2e42d53ea9512be0ebb357e38abbd664a918345861714c917bc2df417a053d4c

SHA512
5bb4b11849d70069304d995ac9a74e714e665680e1d42f7901114ae736f6aada67f93fb8b004f6b6151fcd880e5c4a5d605644b1c9f630880ebf5bd2f33348d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2b5c7e9e4f04be669d201c76a1d35215

SHA1
3e79a2f48f392162a27353de2e90cb709ae956d5

SHA256
442ae579ed386fd0c872629c2bb7772df09e73cc0d1e7802741ae99b4b4cb4b3

SHA512
05184236c5fbbe5a384c28a518dbdd2efce2db63026a4e595ea2c8dc2d3790aa71e8c5aaac36aa704b7f86265b0a117e3a18c96352e02b7c88cfcce05573ffaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
efd86b236f29175f9e097b952bfe4d01

SHA1
69888191763036c1f12d99ff5edb0de4c7d894db

SHA256
f720ba912706c1a90b754513d61c39a1a8b2799dd8cfde0fcd8ce6207dc0e03b

SHA512
a1be848b3509800176580ff4c58dfb47a32115521d89fd81d24747bdbfaea4c024fab2668fdaaf4accd40b61a635c6efd1b4b4677fac7b4537d453a9c64edbe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1b5b46b7753bb9374ffe3b18e4be76fb

SHA1
5d5bda01956372f9965c55ddcc47831a221ed55f

SHA256
85cc84f29a2520b53267c340b35ecd66f677659d56a8a0b5f7f1e10b7eeab4c0

SHA512
989159a96485c474d7fb4b25e7361a26b7a298390a3abbe47614d442365705ad0ebca241fa29bbbda787e41488eaaf277cc94eb1a820a2068e5cfebe61b3d640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7b958c16a8c86f7fdfb484afdc3c8d1c

SHA1
e583f624ef29dc78a4fc4a1befd1a7d7877b4494

SHA256
37915348381b7d69de93fe361f2ed87fa6b4eae91d6794ce2465dd19fd0a17af

SHA512
ae40604f55bb7363a89bced5e9a9ac456713f14923d1ac470e98b8327754452998202a71aeaf98198d59e5ed3f351ad4d295aac3b54b56f19f9ebc7d1bca5ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b00274a842eee40ca9a0a5623d1fe5c5

SHA1
68b098365574f41d8879bbbb3a0ad82cb6845e48

SHA256
13627d3ee16edf1c8b71ccb123204ceadb31784ba451bd19a3919c03596f076f

SHA512
33a72555d1cc81814f2e340de2dd4c8cc65f02386c4935d5b0f8dab973bbf6f17d62572552edae4edf4f408b53ab688d1e4567a2ea39ce401c5bbc5c38386f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
81862e3be8b9c16ac571deb1bef10ee6

SHA1
ab6f3596c41a6e93478c2dc15b8676a0988cc458

SHA256
86d89c6d3af75fd2af61acad9c61669181faea5bf89585b96a240dcf2cd42edb

SHA512
f03567ba7e50555770ba9dff2fad9e884c20153fe607963937142ca1e6f2cdf459a8c09cf79075503fa2be60ef5bb7ba1dd6a47d85d79a19984ca7c6e8d92525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
829a31a2a8786694b1923700736acb95

SHA1
7d136ca62f56d5113f0e9ffc6206f563e791f112

SHA256
b0b9c5f18a6e4e13885ec36a8b4538881f056b8844f69014f38d6dc8c4f741d4

SHA512
eda5ff8624b3fb8b7f58a265f78c0ef69ac2c9483621e2c618c4c113866414fde03534940464970ea4d5c675a7a5b6ba966662ab561f5c0c0d3d13f8b6fcdc55

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF808.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8B7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit