4fde79db157a34db72a60f3e9f113ec8ab18528a328361618968608eb65d3c39

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24c24fc6d99c01442cd5a140c94a0330_JaffaCakes118.html
Size

4KB
MD5

24c24fc6d99c01442cd5a140c94a0330
SHA1

f827ca3466ed5e6eb864ebb21127299dd2a173c2
SHA256

4fde79db157a34db72a60f3e9f113ec8ab18528a328361618968608eb65d3c39
SHA512

5a5a919ee6550f4fd5abb2496f30b0f629fbabcbd52c8d21df4d7f43795300fa54ba83785755a4c9637c9b4384fdeb70026019719f8897aebcc41574591fe774
SSDEEP

96:4Y++SIJcNSvBB19VEQbu1mJysQyhkgbiqZgMN6Xz5Jd3t7FJX56aXQT:0VI6N2B1/ju1m/n+5Jdt7F6T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403a061c40a1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421331803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009bb5292463fa3587a062b40acc4d577ec98b1d92354df2fc4223b3214c00737e000000000e800000000200002000000052afbd72b75935d8f2a42a17c35828222ea51a88a856418151d2f784627c535e20000000be0cb88b6e7c89b8cf321a6b64f38ce66b047f54d64fd42dc83d95da5b8b765d40000000a792b4447f68b7109ff17778fd8b8812fa2eded35877ca103c77263a09cbc5963e2659f3d023a2bd360f05294780f980216d4310572014206f94e29aade8552a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000070bd304a0afcefeeb2f095cb6162aacfb07ddae5ed94c6d6477f4c69353849a2000000000e80000000020000200000002534f56d9e6f2de2a725c2ee6685655319d398da685ef941a486d6400d2a50e9900000005e652fda7ad9e05673d5f268f8adc86fd2812b5707b6d1e0904e31d46c153e601031e60ba49107dc139ef36c823a6512e1f33daa28e3eebbc78902eebee9c81d66eb4b19e77373f676a4a0c16092d6c596b6591b7321065ba31efa57a2710ca606e887d93fad1ca3b7dc20bd901a9e9e4a14e3d67c8966a1363d0202ba2f5a47ee891968ea1778880777cd866f3a303240000000f1e1537e6e6e638c281ca6609d08491c5b78f3490820ec6de3cc9166bfa4615dc93e3e2bc2a447a06b1e55c9db0a46953a36b567c3529cee8ec59295aaab3abc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{475BB3A1-0D33-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1972	2044	iexplore.exe	28
PID 2044 wrote to memory of 1972	2044	iexplore.exe	28
PID 2044 wrote to memory of 1972	2044	iexplore.exe	28
PID 2044 wrote to memory of 1972	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24c24fc6d99c01442cd5a140c94a0330_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e107244fd41a2bea26d56b7099fa1aa

SHA1
8639fe139bdcdcee82379d87685bf71339c9549d

SHA256
a3fa0af44dc62d77302da4e0b1432271147e8fa0bf03d48a641487182109279d

SHA512
f323786674dd5f0f1f954e497d312b710054081c5538c53af69388656b1dc11bc1959d6f2272c04e7330740a8c76c18ea86076378d4e577e939bbe6b6ac4cef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77bc674f9ac0aa4a26170c4a33cd5f5b

SHA1
c82009bacf2e41fae822caf8a74b594991a68255

SHA256
0abfec0a634a9763fed5eb5e7ad9866da81d0449a61d83fed9dc7bab87981d1f

SHA512
67fc56a32d47ac7e702ff5f935d8753333df124a415a02608c0ddce085d860183971f35019422e44f86db00e4f477ddb29eb521669c2d13171cc1765743d9c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b881af704902f8e136f22f88b29f1b

SHA1
94367e2f64c73b9246420f425e9fc8068dc2cd5d

SHA256
89b154791a97cf8bca73680601ec7f53effe0a8df1f80793b6977d64d2683c98

SHA512
9d9554e89b5ee28cc60e32be656937a181a2c55f4e10ddec0db651c0e213464051a74927280005d83b2c898fb0d45662f261be2791e4e2f51e5639e257567ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974e1fdee4bc2796c5f6631ea7bf41f1

SHA1
e17a200e30e48e71fb9aa6a13337f59c565a38cd

SHA256
197ed66a6f78fea07f090ea53cffe80e34a41e0588f031d0684eaad87726b4f4

SHA512
c7c6bb4ddb329ae1148d98c0d9257f7a851ca806183ab8b8c335d881142e016d1d64881ad0488efe8315f7be8408364adf74670df35c3290835f1404e41ecd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30c3887d9cb3d94fdd5c823143343683

SHA1
b79566ad07073ff045febda7b053857f0c546c1b

SHA256
c42d1f1291e2e0fab600079233f3ffacc8dcda39b06b3b92f2a1541682edeb5a

SHA512
7f0c72ef5bdcfb29bbf589d3557f529509e650b3e4f1ccb044a3109dd4e840dfbff89e180c52780d0cc60ef504da9bf2005139eb320b67096fec2dc487341c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
033bc15ba3f019cac46d2d2f75b7d587

SHA1
72216b5f46d3b271c374eb1eabda83c60176eb8e

SHA256
013bf3dfe498add02b9524e98d206087821967aadfd7c8bf1649331f479f8e46

SHA512
f01287edfccc8f5cc668bb5cf9a94e2c063f985dc2d7aafefd996adc477ee774c04208c619272dfba1910a62de45779dff84568db31612a793df8fd5309b1747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9cff9c61f1f229a2ff319dbe87634ac

SHA1
7bc03287e61700dfd052d6f05d21bbfc0c4bdeb2

SHA256
69dfbe2f89dd742df57cf7a5a5e8ba60fd2136f514522fed2b3dc5571ac1a000

SHA512
8f365da7ba2fea0e56c34a147f767234e992e421bb6af36cb8aa206c661f785394ca9e75fdd0d77b13f2d8b5a16b53fde06ddcb52e30e10d99f4815f7fcbb518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be5fe080652b7a3b08873588dcb1a39

SHA1
697e38ae54e5811bbe8bffb86705f33c63d65871

SHA256
677d0039cf9490960b26f61b70f79746356ab8adbed20c802b2adb71770e7b92

SHA512
73c1debd6f39bdf9a0a1716d95bf057dd58e14df06d4b84f11771b053757abd64cf0b7bb7c316b9ebc0888f8936e0431f8b109f3d6422e6b29f10cc522e273ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a4605745250795c4137e94dda06515

SHA1
892463180e1315648869a5bb370510cc0efd303c

SHA256
3257f47b7b29e3fdd7da0b82f898a7885e365d15f0befa2ae6fcf992596a7e00

SHA512
6e924c6625e05d585f801f2676bd23338e86f03f9af4362b616b83584f8732eb1da19166727c4991863e9503d413d0ab57eabfd65a4e6ae5302737acace57d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42773beec9fe7b72f4c1ef1f7bd717ed

SHA1
592dc475826a37dfb27e387dfa70eb4c865330bb

SHA256
bdfda7da8484ffc9c49372c80cac73016279c587b1ec566e0e12d7d988903587

SHA512
a2eae98f348574d3eeb9ce86d81833d3858cdf8a55971e97b1d311df65767a6079a6037c07d6c05022d0089a7dcbc77a1e782d29145170f50f118c6b3c61821f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36b6d2440aeee870f8f2ae71a380b0e5

SHA1
f480e53bc14fdaa980342281a48e25603100f102

SHA256
5c5969a900f9946d56286b887a2a96afdae0d5057a576fd7975e60175f343394

SHA512
9f1afe96b650e8294d4f4a6c135451bb1d0c936419617daada1db60ee3efb6e9de3a98d9ad3f170f63ce42fdef871fb4de76b376913e1d0baaf4042f117ab67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e72ab3c2a291e13960dbdbc3842e77

SHA1
30c05897cdaded3964b9d4728cf63d82a0bf0592

SHA256
a51e112241c53766ce157c15f46cda16099552fb0303d3dd9c04d7abdd5a76bf

SHA512
c7fa69a92a71d4e0a65f026eec1809c9b74e69449f968193afee53cf632dc4d6e6a164c7d5c311d8d88f1f3c99394514c6b0fb75ff61672eeb7f01a471b744c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a63960fd417e88244743ce43b3a40b5

SHA1
b72f6676eae86a4d4c8a4fb681fc3f83b085e644

SHA256
2ee9eb8b54095f6c912f2d33a8eca372d39895c4b063801e6b2ae5a6b016ad7f

SHA512
94771af79ecf33b43f5220c43f064d6092329a047a932dae96e3dd9f61942a921d00dfa308794d7d0f32171519c0d2c558d2980d65e53ad34b3234f44591cf88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa73304060e43e3eff84ef2beed79197

SHA1
11c459e64be9e1aa75a273a81ebfc06f8c176eb0

SHA256
e4ac17b17d85b3f650aadd2d3dda708ee458d6b5238bbf8fc1e75d3c6bfc421d

SHA512
2442d0a72affe919cc95d54dbfdcbc16d8822df82f6e3bcf63282337bb324911025fe5610ffa1d72f73cd1a3d033368a336a0ffc96d5bded8376de668b5981c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dba267c35daea6140285f12ccc849be

SHA1
07c394dff4a756543ff340f93ec2585a0263897e

SHA256
c2cc2084c6b44b33fd06f064b2b3e2f2dd10e70d9e37b07f13fa9c9350caf8fe

SHA512
91f2b5f478be0ae84e982b9b8662337f0455efa09696c233928707250be68de7e382843d09039cae038108b7a74a6984ffc61426880611267901258cb01ee00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77c44772a93b522b8fc4346d56052b90

SHA1
a33a841a0ff30cdcb43e61684ebddcd2eef9291f

SHA256
8b101cf63f5d772aecf2a8e7a174d5b7b96c6f9b68b17ab0f2fb869e69c8d624

SHA512
7d7b3816cf62c9685390edcb17370c1f4bbee7bb1ac81231eb885e2b6812e90f45335da075c76248efe5457b19b6e6ca90527c19fb731b530801e3c3c6d348ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3035e2b3bd129fc9f4f142fe31355563

SHA1
6c3590e8d7d1aa6c0bc84e4d5b1e430a0adce3f2

SHA256
d3d482ceb04d9d4c8b49f8a284db37a756fabdfa12225c232bc27c113f7951b6

SHA512
99cf51401ca6d16ddf482e351108db9d9fe45eee4e57e50d589f31a54ae5a71c93a92c04afb9d23acc60a954f9b7a25c0a352d54c3b58b1b3d3e9e358e708fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70985e00a6b3b83b9e396411c89b8b60

SHA1
20337f456b689787206c7ee76af523ee8ceac7e4

SHA256
10b6a1a57dabdcef0804f68f5490d4d015b6e4af73f47c82a11bc157541fbb12

SHA512
817cc6caf814290e1c1940a1905932d4d518957142d1e116df56f75ffaf6e6a4afc14b500138794d937a629a491122aee405fbffb9380bb4f52c72db1c26a9be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3066.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30B7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit