977821e421252abf390983f4123db0bef72619a20d92145baefffe22464ec94e

Analysis

max time kernel
137s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fb56c612fc7a0c80ccb402c48783b29_JaffaCakes118.html
Size

11KB
MD5

3fb56c612fc7a0c80ccb402c48783b29
SHA1

e6ccd707fb9dff8eb0980a6a7be1eecc80ed2882
SHA256

977821e421252abf390983f4123db0bef72619a20d92145baefffe22464ec94e
SHA512

3eb712c54bab63838aa9a73f9caedc2ddabb10ef1e6f82d90ef9bd4ad29de46b4917360eb597dbebb2dd99f71073aa49c022f76f630136734bbc322b55a8d777
SSDEEP

192:hd6vRxw2sVH1tT8EWyjqHbboGmZqPrVJgvt44dAI5bNSj+Gypl:H6By1tgwji1mgRJMzdAI5hSj5ypl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706a756fc6d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A976821-40B9-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002c152112334c492f153b26b153ecae379b3925d5463c726801e9b8b074aff764000000000e8000000002000020000000e2fc101aab8f375e18000a934cbe57142df9d09988e3dfc483ebcc40cc62fe61200000007ec1da2d8aaebfd1a08d0596dc596471bb802c7b599304aaa242d3152efe7217400000007d66b85ebfaf2ba6dedce604ed7c7c922ff186dc7a60ba2e334a42b9c637ff75db9d4d56e9f877e27c3d7604954d14aa0282cf9a42777db8ea3616ee5975a2bf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f9da7fb6205621e255175ef79a8e59d638f05ea336bd778b02b6f741b7017a51000000000e80000000020000200000009a4f2808ceed32b2a492be211cca9afe1cda931031e8f64edde86034d89646a790000000b1970e58aef29546f351e761895c57866ae850da72dc853f9afa4de49a97167c897ae62074208bff4eb3805dcd6d8c3b14529a3dffea248435aae55500c475063befe6a12e64d52d507e609501d60d27dddca3f85611b1512673ff17b20165645e90087376e4b2a386c07ccdf60d5eb34c34810e17ac92c688fd49db22ac0ac8f7768681f263bf167594742bb3dc6ff3400000004250c622a78f16f77a67fe686dad70c6391de17b0a0feb0dcdb11110d4c0d9d6ce5b90dd2f44a762f4d4697cb288907d286c06a3ffff3622fd28abc3614e3f66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426997008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30
PID 1140 wrote to memory of 2180	1140	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fb56c612fc7a0c80ccb402c48783b29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10d0ac0745d914c87b9bebd88c374afa

SHA1
be1022bda2c353d3a2cbf6c420d54516d559af3a

SHA256
883a97f73aec5f120197d5a43a83fc6c3b5d00c388c343bfcd69391a34fc1f7d

SHA512
235281d8e51d44b574657a23a72001a4d6134ce07f1311dc8930e35414880b27ae923881fbf04accbb4175be447cd5d224f4ba5bf7da14be7d7b40d416858060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ed5f050731ddf0c54dab5510bb2db30

SHA1
e46bf497951a83bf556ef0e60326369ae0eb67ee

SHA256
53d5779d5c9258a7195071e2de99ef5883ba68751748d964fe04267ee95bc2bf

SHA512
1e89c0b768650c55efe9384d27ad82dbb657dbc5c360823dacab4ad6d08ed10b41844d13d33ef051610fea9083603a0e8467a80f72a99d4430fd7edc5f2b4d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f410f631298c5cf1032694d6239fe72

SHA1
fe40e67af67a094a8305afebf54fce053f0bd25e

SHA256
99dd7feef9e5f80b4d0f7d699799f9277e4acb4684c5833fe968c6f639804fae

SHA512
1d4da933b8c9babf3ac81452e7b46945eeb158cf62125ab8be44681862a9d3088ddda2c49aff4a237e120963201e3494d17c5fc7f1e5f8fc5be6760c47f26be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed739c7f282a46eabfa0546d452e0ff

SHA1
9e43f2e76e75e5006e7ad2759f0090046e34a4cf

SHA256
c000e43cfc5cef9867fc9e1076ea2a193d43690ba7515a8ce7d28efc6a0ab28d

SHA512
b9294150b5173e5f86aeeedc505d3185b369d6ee4c8d21162ecfee0332aa884390487559c6e198ffedc030ea4b2c5a2b169c91d5b8e98a98db3235dec3403b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69e5dd39b834327e252904d37bb876bf

SHA1
76f6ed7de1dcdf38f413cca147356c4943689743

SHA256
30ef3f08b0e9e81ae599cfaa137e5cd3ecf1ba8608e0ca610bb8764bdbccb916

SHA512
186ec58dec3a93a91ca1210103464a53b64dcecb87fc030eff7a7ce9cd3ba24b3e254db63f59d238d19a2b60a39c79795d9e844c6a9cafc56e750a621ab904c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
988a6842ce25cad911c811a76bbae7fc

SHA1
22db2c307c8e60058aaec1099a1d8a0e9070d6d9

SHA256
ab6327eb2c51619eb11da1cf8af779485bdb0404a1be65cfa26f351a71397806

SHA512
c56118b55c6f31f19b280b10540e35e311d58d558c890461f0893413c1d29b3a0d3348cd5b2f054f0c3a4fbf35386eaf7b1080146879390caef3e92d8cd559e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99bb78b21b58d50cb0d7e9c6dae3ef60

SHA1
24121075dbbd6c20cbe09788185f88a2c852eac9

SHA256
860a187ff4a6643b22c8e01e266338df10327fd6b5480dc21542ffcd7438745f

SHA512
ec132b40afa2bbdd0849baf9c23ceec62adc149112afb1a164756b2591cf80743c3a74a2096028d124393dbae4f04617abf56a5f1565c86633b0c084796a52b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49b3789d0f502d344b033e856035c2ec

SHA1
5c1f45d36c46e296447c8890c7747e6b6d1ed014

SHA256
670a1af10d5f7be00c5f25ec1da96449bba9732bb3930c0e82f24ba2b37928a5

SHA512
a52687a9abbf4cf1054b50f82b0dc67640c046dc0cce8c8a9aab30f021639f83277e145f2e64159dbebbb53e0cb4c2b6440f7e7529fdc4161730f2ab401fe6df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0395ca6620349e15968b79ce66e6fc2d

SHA1
562b7d5e24e0e885ebd52dcb76a64c699e26a9d2

SHA256
e867e4154adc5ed4f77ab185e5aa4d3894dff9434dbdb74e7134ff0f149477b0

SHA512
ef756722c9fec81ecf88f4242161db5c053a1e61ed7d8df128ea851e9657b11ef580802135efbb61d310215270c1e1290519cfd4a0668709c970f5f6a521fd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9234fddaad24f0dc93ac5c99bfed02d

SHA1
f4d71b416eabd3057dd40c2eb50cc3b520d3937c

SHA256
fd197edbbc568df908da6acfa98752d9b3505f910a4d03b55b0b92de3502edcd

SHA512
8689c7b9b4dc838b2360a214de58926c13e88aba7a7b1a70b9671aca95822af2dc9dee66199a0d3aedb79039b64d4314fbfc0ce9f0d39c6569f62f32b29084c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b305287d6879ac2fd47028a1f6e7ebb5

SHA1
2ba23dda8fbc3379e11e97d6e934936bd8a033af

SHA256
71e5ddbc56df92b60bab062596dad5618aabe3a777619e2fb389fee945efc731

SHA512
ab6bdc933041bee4f13859cd5a3394b2277f696c45455ea14d28b0bf3d66ceff96061c5bb7514d83cd252cfab0bc0c4c4e02c1114e946f1376312a2864329282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd48471f8de1b194fda7327d61b7883b

SHA1
9628694695f769ba915328e03f7b610e868ac3f1

SHA256
8729cc5407272dfcbe17e8a44a3f464f3a67522f185590e416aa16e323561b5d

SHA512
fd0fe575a0cc3c0fd8603418e912df5bc9ef560ec9d4c275424b93a630cffa3c08373105c698360f2c60a609ae32cfef6172278361f4eeb13a2c402769e83edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4742214365052344ea04889e9019870

SHA1
355039c5372d961378b66444434a88d06702d2da

SHA256
4ca3b6c7f2684921258e4afb36d8a6c8bc1dde46f1cff3fcb90f919578f225fd

SHA512
836b844e4e33e82bc1d70bf8f1e1ac8aac30b747bd0725ee69e8a3554256c2bb09de04a847050aaa2f3dc1338bfe8f5f52baa6b0839dd43cd1e53b35cf218240

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA59.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB27.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit