30b3d4919beaa41898572db4b1c44e0967b8f278fbbae565d98adb453880e026

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4137a09a656b9d49e2ce119a58d52e63_JaffaCakes118.html
Size

209KB
MD5

4137a09a656b9d49e2ce119a58d52e63
SHA1

5529268722dd0538c0e8d16bf8ca86ba8047fc64
SHA256

30b3d4919beaa41898572db4b1c44e0967b8f278fbbae565d98adb453880e026
SHA512

03960fca14aab5d2201ca7a79ec2673ed9b1311d35d0887c17fc163c1d61f26a487e92af8e5e739ea3d521a95ae7c69d04f34a7d1f4bde392795bafd8f5273f3
SSDEEP

1536:0W6p9lAirrn3t4N+ks0BA/qveHq3FBF9CegM/RDVY6ihWENFz4IpfZC8KNXHjaMM:6/Aiv3t4Ni/9deff65DfnLF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427026853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17E098C1-40FF-11EF-B985-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f971ec0bd5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009151fdfe17ed79be9e794389c4c1ec9a535987228c921e45d320e8a17a022d81000000000e8000000002000020000000feca774ec68f485b0be2df384e7a53bcb3d8040d81780d97267cff36936da01a2000000076a5cb9b28f2159963479cbbcb32a24a0a9b977e2fa9e5fc4b94a7415bf860c140000000f4253855fcc308df78237f883aaf8f106b3416552e8380bd783bef66fc9a8e7cb6deff761ebf4e450850cfe0258cba50b1cc7d73d34e97c912be05a1af8ebc64	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000004b77cd73c0e6d6e49c10c4c3abe5548a3a789c856c6c591130f814a8d2138b0f000000000e80000000020000200000000297a62be3c5ff3e97fbf6a375935af4761b0d6a2aa0b4a62eec3c8b1d1e84709000000058566f6274972d6bcd6730eb30815983ddd52e5844e5214e6f6a99bc5c7d42949eb7dcc8e191f4cd1a50dabb0eb626bae03d3bc6ca896a7647f22e1eed0100da583029ef0a03284c6e215f0028d3171c60ef31bb739484f3190867a0ab54f66f8cd7c9ed077a2cc5f83d3b4f4e4a855e2711b7cc583a1f6e587bb769273a1d752821b1b975f90032338364ce4fe764f24000000081146b52aaa7413ccd001e08e93b1d3c63a9d83278bd7b8c1208f4b1b63d33302d8003ed87997cc71333f0020473c5db19a6cfe3a02fd037b4357807a1d389c4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
900	iexplore.exe
900	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2512	900	iexplore.exe	30
PID 900 wrote to memory of 2512	900	iexplore.exe	30
PID 900 wrote to memory of 2512	900	iexplore.exe	30
PID 900 wrote to memory of 2512	900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4137a09a656b9d49e2ce119a58d52e63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7f0ab6ab9c92cdd38186a54afeabf8c

SHA1
0711bb0b454269f0995ddbb90d2c903b5d709ba8

SHA256
daa33725f9fe7dfe99183e8a8c1da5a6e1a21148f6a5fec8a6da11ab6f586275

SHA512
f5931d2892f347fc186c1e1a642d5e2aae38a3ba3dc81e2fc97475bbf8bc2702d3e5008af4bbbeef81120ab4f6f340fa3b80d998a8d890958234eb47a01c8dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e6dac95b1347066f8605bfc3c6f3330

SHA1
12d0ca8b7d9e2d1572c306a61a4729a122a6911f

SHA256
659c31eb2cad522338fe25237a76a6245ae609417ee7ab789a1025c9d3cef41d

SHA512
0b2bd2e7b43f6ebd77908fcb755757f179af3e9b03908f90c95596b80d586336cb11851db82dc79fed24db85a97f47324ba381f871cc6f5db9bbca69c29c67ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
794d3c2437c1d5f3201b20089fba7bee

SHA1
2e781f04cdbd79dd959f5e316453ae636be93c10

SHA256
5c59c9a1da1c558cf9108549098b9dd11c006c86e0aeaf53ec7a6085e2a84942

SHA512
0dc2838d5c872d17ea50d2b49b862ca45face47135d4fa05a6e25171cf097933f8e9f62f0582578cafd9be9ffb4dc1003f8f507e3182bb87cf85f424d80cc0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
650dbe3a530e1a95a1d752583fc126c7

SHA1
5bc78c53fa61c1241a61732a41e041ae3c8a297f

SHA256
8a937181fd5933148f1df395e4aabcec33e4b35653a6959b5202e316f8b41dc0

SHA512
29dd2b2ff8a355e144ff10d20c0ba16f6943ef881612555328759defda00f4853d73c624debfbcd392251379912283be253f2b350e6e79142ec168e24ecdea81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834f9dcaef7b2bb01191d884704d504a

SHA1
624c51b4e20da1acc98b35806c26d2bd4013c9e2

SHA256
9c9d8464b251db1b784a44bd7c923b3519c78372f9ada5a7529585f11e1bacfa

SHA512
86ca991308d7aede29bb5676e901eb6820a20b298db4c7555b9f0f707fe141d32d867868af68d4e6c798bb274fa56e145d7dbeb6e45fccef4682b0755937bcb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b71aa5fc21b1bf125b73dcfe0b86005e

SHA1
96b91e9a7f2d5f7b5d70a5b6d79682f8e4403216

SHA256
ca490b8b4c2bdc4c1a3ded2910e259c635c3f336fcc41e4f44c246726ab7c378

SHA512
2c4bfa67db63414a3ab6e00f8a59686fc7402d3bf0dfa61047df3a7bf3a1aeebdabb56c2b58d7d6db1efced4290004f28126be85813a0655b0233f415b147a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc5b1dd98929d487dae0b5dd0c509217

SHA1
5f789af29f55a7acd8f47abdc0fbd401e093c167

SHA256
6dfebbba4786ddffc9ad39808578b92abe2971ec494384ef7ed2b9dcfaded17c

SHA512
8c87fdc02c115e845b466b238f0ff5ecf99c42ccb82ae60cb7cd9feb3fe507c2fa4c74aeb57b96477fbe7058f9e3fe9042dbbadc49246a1fb879d5f081bd1984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55020352fefb115b30c0f928797c1490

SHA1
887ab55caa4832efad9ec7c42eccd5aeffb4394c

SHA256
a7c99dc8c1d9824104e556be8d6936474e5679ab59fe0b1be9d29565723ff111

SHA512
32051c07ab748987fe96227f7595f6d60f175bb74959575182ce0454df59bae3bd97cb0871f4dddb2b8b1503ab79edaf9823998783b811f1aa9485b91d8851bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bae29d767f7b132ecd17b683750774a3

SHA1
83fa9616529c6c9b774b8422e2e4745073d2a6b5

SHA256
365d17fabac9357175ad7ffe0b72fd533bf20fe1e290c4f500a39f9f70aa07ed

SHA512
ce44d6a8c1043d277311e9c3f52ff8fbd3d162749ab524856be5949021b930486c83394ee20e6eefeda984d24ae8bcfb4b77fcba78696d4201739f30750b512c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5916801175c3b431aa017111e9da246

SHA1
5a579a816a823aa9b48d06d61307c33904d7c758

SHA256
c0c2541a98762425970e09e755c25a01ad436a6a3e58352c5e6a7f47ab8c6f79

SHA512
fae4bedb35605ab767c02d3344dca6cc39c9f600cbd013d9852f99444cc12e1cc08f006b1c8cbcc1e7b022199a2a71196f176229e26b1b94af3c9737a7a45819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31d4ebfb712af8981448f0379a36e562

SHA1
32a72a1b417068c7cc6eef1087d35223aeff5482

SHA256
8811a1323e955059454b7d9473590b0f08a93b004e5e9d779c377fe7f409d375

SHA512
7747845232ea7b8132cfb11902d59b59a3047753958080d0efa153ababa1586d11ab9148dd167165f00fcdbb69e289ab7511913dcaaedc54195419578013ccd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d07a3c650e4294b63a22faebbd1663fb

SHA1
a3bad34021c44330d074a43388b02df96b089b87

SHA256
98205e8bb101f71c9969e80927e250629ebed1712c40172203edc489064c9311

SHA512
b19ae25b96020fc3d7cf548c1d85cc798f1bd75d7cd3d17949b586ee7f626aab0a1316be98a1fbd4a1e603b4b88b8d23f93622e5cb90192fadbfc3113d9262fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4190fc8505bc81e7ea9e28cffb9af8

SHA1
96dd132db5356bfc200f47d73462c1da33ce9c8c

SHA256
0832e5ce4f3eb30bbb0d63b148f877b1d74db7ec2d0e722a634cd7d937b27605

SHA512
dcde4a7da7406483d5c29d644a436f5af4e84d9f8d3751d0291466e87f58cc5d5d6586359b6d2c1e9c25b37e608c22c36dc2735d2be00c7dc35eefaf212bcf29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7559acf3cd5a583e3f00c2a5a3d5bc98

SHA1
903de3725bdbf7193a855338741ec8a31e08a357

SHA256
7372147837c350894d70e35b02bfe47ce2658855f9421ffc7517deddca4bad99

SHA512
4def21ce29aa6019b64517973165cb15e996751ba0c7dc735790bdcaf9b6b20a7880e49664dbed06a6f973cdc453be18eb00e15e5ae89f5a399f02badc8b0504

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD858.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD8C8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit