f617ca0e938d7f667343787090d95d0ded001c142bd86f8cd54483bde71bd0b9

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30cc7c31515643b09b611d663988be05_JaffaCakes118.html
Size

3KB
MD5

30cc7c31515643b09b611d663988be05
SHA1

b48310478f0ddd83868297ed846bf7cb8a21a18d
SHA256

f617ca0e938d7f667343787090d95d0ded001c142bd86f8cd54483bde71bd0b9
SHA512

c89c41607e1f8955681684ff4e095684257438b5f06e0e050a2d75679985d584095b1cae8fe290ffffafd563a14dbc5070e7ff6f1d394bd23db235aedc0a8c5d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000ec0a972117f9d37a2dbccd06760ff8524c7c8b4f91e95b1605a11e5ee15de64000000000e8000000002000020000000965947e488e7dc244f4fb2f1b6ee0871232d046af5175218c9875562ff18ed96200000008566f626ea3faf54731b626d9fa7911d9c427529fd73edbeaabbf507824492c440000000a96206db62953bc89dabb3323aba1112cafb40d763e834f7048df8df52854c3b759d579ce5f6241be01c143442506df740c2178f5f28da3ad88690a280b9ec9b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421533120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d7c682e415c0a8e02aa9bb632a29e7b2b7db171e03954af361d651edd1991acc000000000e8000000002000020000000530fe76967cccb8b650b6b383b9674d1d4dc7cbd6dc50d2ebe3612eed546f35e9000000037f7b8ac773e204ba30ec9340c847657ae025741d2c6effa508d757d23f633c19ef019fdc0be6e1ee2492fb354dfcee3b37c4ca611808138ef8b939f0dae74d7f141b304390b888d199956d1f26bdf9c4199705c73002e6c92811e2f64084b1acfbbf7dff138db1200edd22bec56da63c56cfde8e9fa4c834122d1d1e3995556c723a5100aaed0e9a020bdf38544529e40000000c7bb7909225dda134a13adb361c92c5dfa6d50d57e2d25a3e510e7d8b5694568221800c863547429d00e8130100c0e7fc1d2763a09ecde3f48ae5df5177e4e3e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{010B6631-0F08-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a055fcd814a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30cc7c31515643b09b611d663988be05_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b90a478af738d6b79a01e251709f59

SHA1
9385c4cb83dcd298928b01fe9459eaaaa073b423

SHA256
967fcdd44209a6ae9eb710e5cd1766bcde90f41d9374f241c39e16e61b087504

SHA512
d6bc2ea08e6b1ce9cb1f344cba109b4654d4cbd15ca627f7ec1100e428c7f6a8bdf55322b2bf5c28fbb1e5d7832eed3cfb3d182d0bfe618ee1ea626a6111c627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ade3ea719c61b684f691f005192360

SHA1
19f01ac009bd543106ef244d56ee1aded946cc5b

SHA256
2cd1498935c280ac69bb9cefe977c3f88b06a69e6ebc742402a152d6034f2ac7

SHA512
15ab0580223507f5b1a54ddfa6cfb3f08e96cb475af7bc0346e66659a83e7740cf91bf8f4c4dfe4188d71a033147172c3496412a7c7e588e5767c1fcc56ceb20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec311e12b6032594c8d7a2d697ad727

SHA1
a4b0e54ccd0271f27f0739002da7eb7106e00bbb

SHA256
1093489d37ce98ffb15e5e1e49280d2b68b6014eb771f94d00d980bc8b29b701

SHA512
c41d6381edf42dc5feeff3db90e88581023b16272c6aa855d67cd3e2a3a902da0e1f4ee8641d1b72957cf73ea9dd47d4aa8ab16f3c5f941129ff47565aa737f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76588f7da82b1757583063fcc554b442

SHA1
668f1b0f0fc50d3ba842c4fe57961351ca03594c

SHA256
6ba12fc711241a8f206764808dfe47ce505d84c46c773666b39004d8cf2e3a16

SHA512
91e43b22639f2f6ab8148a0bf7768d34a972449f09f9c0a5b1d4e0b479f963e4e3b53919cdb47dccbdfdd0c06b18d12a17c5dc020f34ecea94fce37b193a136f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ed5ed5b7453d0380cb7f05eded385f

SHA1
dcc2177ab54742a131df08025f42acefc1d33af8

SHA256
89106fffb1106b69bc61e2e3a78484fa3d8feb4e5e64703f8fd540a50bf0acfe

SHA512
641a9e11ca599615c562cf099d39f9c28c03cc263594b34c846cf1b12935bf8b8873c6e53874f5b031f71f5eff4bbeb90ce8b5d67720498d7a7d4dd2dba85e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2995ba3f0c01234531db8020a5adf5ee

SHA1
db5d979223ad0e17929e6f4100a8c2b806b54a71

SHA256
583aa1ffbd6ba10b60a1d3af77e9c964ff3c9b4a3dc632ae8aa97c05d00cf222

SHA512
4697e93e291c4fe1f45d98eb7cee332f024feca114afc8c723a5971d101e2b56dbbe0791488bf2ea35edae6104488cd14ea30be2871daf25ad7fa6feef475ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9eae83c24c236742035a624ab035ffcb

SHA1
c2e2eea72514b966c3d698bc70076beedd33e9c3

SHA256
ca773011184ee6e48a483610c105a45ac3a5fd45263768b1e1f2f9f4780b5b8f

SHA512
ac4cf029bb78620a17de422452fc106bbf26afa2a0321d765410467835037210390ba38b84adf4afeb10c5ecd87ced625fdddfad7748790d5f020f627ba4cdce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab73fb9cf0e386b1fa38aaafbe9364b0

SHA1
81727cb70238fbc2d474a8d77d110b6a5b8151e1

SHA256
462bcf6cb804e39a773bdb1b277c735d4e3ba3eda93e816d948171e0c56b8a9a

SHA512
235bd8f128810fffae039cbcb8677493fb25aa8b579da28b0b21c85748aa2a789c2ec6742882b1a752633b8bdb30d9ea230dbc123fc243874f36bcf711c615a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d16ea55f36c43878dbed27348c8d507

SHA1
7a63e27b5b3f9074e08a11f8fdcae318672ee144

SHA256
0990ad39c78266c4afed698e467cfe83ab9e87c6aa71d52bd4a859ab0f3ead17

SHA512
32e04f1ec01e78f2a2ed2b013f334bf388570d00fa771e8b23b6a049813f90ebc50e6d60eec5105e79acbc8b4eacad096c03b480dc63f5709d888d308c797563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4628793975ef71a72ca284d9eebd4e4d

SHA1
1a2131ac364f1d835d0cacd9d9768eb25e3bb637

SHA256
b35bef979b864682d4315a26fb08dec6c7fe764025ed95e9437380790a84c5e5

SHA512
c789c2de82acb164a612323240ba0fe3fdd985394b6d6eadb44b26f6db249e6db97eefb95153db5c8d24a6f573f5037bfbb5ebbec9dc033828240d4c4bd85f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D0A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit