046003da36eb3dfcc34cbb91d53d8af3f20031cb176b5d10e22612aa1e250887

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

337bb59399bc015560dea8e72bc73c17_JaffaCakes118.html
Size

80KB
MD5

337bb59399bc015560dea8e72bc73c17
SHA1

a3e87c53e89d07a8205ba6caaadfb5dfb8542c68
SHA256

046003da36eb3dfcc34cbb91d53d8af3f20031cb176b5d10e22612aa1e250887
SHA512

e6d153c03933173023f11dc067d0a000622f0c7159224a824c1a396e8976510f727e016f3e18c4d8bd831f6c7335a38b3e2b906607fec22e71c74eeccfb5dac2
SSDEEP

768:UeaOn4B2kLgOG2gggggggggggggggggggggggggggggggggggggggggggggggggD:jaUGbgjP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A903B571-0F69-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005fe5f4a97d233a1418d86703ab3207eb1e8cc928873f01dbefb099c4a2199701000000000e8000000002000020000000209fd59cbedc73b9174b1955a0570fd9f7466ba4997cf3a7963878d638deb1da200000003c60f6a78815a6594c680c179ec4b6ca964d4bb83afb6b46e953242542ac11a740000000ef9c2156966f83e40b71b328a1072f061e0c76d8e2a171bbab3c2267b7f5bd16c89391c14e4c2742df50d824350b52258c5910fc281eedec41af3f56a7141c3a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000154f6961909695abe47dc0b902925bfc46b0449a8e36e1baa81f57c06f7ed0b3000000000e8000000002000020000000fb47317fa828e43b8141d35276bebe7c8841fb888128bb5c0b0afefb196944f7900000006bd4a3ada1133e0b8e612dccc23fb4b1c230aee24c545b16ffe85bca6bd92188bfc3a59399d8aef0e3433ef60500d5eee1d40dc9fea4ad202bd53c5bf9e19be77c53fc4f09b0c6e73135ba78340a0bef4597a1cff7e93affedda47bb5b56811cbf21b89396df59d775918028feb5a4570fb9ffca5fe0d6cae4f179dc45bcd8d8e2fb3b16840d626bd043369d367e1ee2400000005fcd86248e4f9a1101d7873d67df6be33866d80422eefb90b5a71ac3fff0fa4c11e3b7a40a2a04e690d73f513fdfec4dbfa5902f13045aed0ac0210076cda4e1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421575062"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0091228376a3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2564	1904	iexplore.exe	28
PID 1904 wrote to memory of 2564	1904	iexplore.exe	28
PID 1904 wrote to memory of 2564	1904	iexplore.exe	28
PID 1904 wrote to memory of 2564	1904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\337bb59399bc015560dea8e72bc73c17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5792f9aab3eb5b4d4a1d92bf3716823b

SHA1
8458897d7e074b93726af746242ab9c7b99a4974

SHA256
7e54d055fb8305b778b260389599601ad0d2449fa96f9d966c6551824b31fd50

SHA512
61186774f7c95809772172532852c8cf9e2595b9686fb70974a6dcda462190a04f956a927bad39788355cbf600f408bfc00d859a58d383e30a8022126efbbf15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c09cd4def61a3149fe4df4951f580f

SHA1
d424c2dffaf18c542eb77c8b8d050b12cf91a1fe

SHA256
9c1a1e38668929377bec76ef8ee4d3501a3a3b212e0958ed65b32caf19aabc56

SHA512
d02e47ccebcda54a64f120e0742eba08b697e12e46b426f1360b97e34638ec43339ca32971e55efd37b570deac37210c5e3f0902d4f1e6adeb6901514f247a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
547b834b5d74afc914c2db8cce499ced

SHA1
4a8590d8e5a7700c275e1ed29870c7a1ad0bd734

SHA256
7826303991b1b746702fe152d284ef05e7b55b9625707fb48e964a7f5c763481

SHA512
ad6e205f09c1d7e2fb8ae2f52a3279de4ef5e0e53bab448578c1557322250703606c23b58e15d9ba638bb5750032a37744ccc3925df5ad171f70520062adc913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98135375b990a6541149edc90c9b2772

SHA1
6371fbd327a5129df2908a34fd3cdf9c9fa55238

SHA256
7dee93365dd5a5efa94eba9673281ca69918aa03f8cc6fb9a3c1fc5a9a4b8a47

SHA512
7d104ae203d69af3bafa152a2cfe8cbf90fc34cbd983196e44e0392def7e56556552c2f68ce8edb08befe85139041d4ecc72908f6a049b5229f5f82d4cec0d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
941ce455684a1a84795895b0b7190039

SHA1
124b147c158a7ebbad2e61e533e237ae90f9fcab

SHA256
305cc68e563b580add1194a13de5696d5b5ef843db03b0ff8883f4096fda216c

SHA512
6f8405f98e92922225537639fffe2a12182b38d984453863a168e71563e923e5177c30d3e1e1c4f6f978339385c84bbe8e14c8a7c80153f9875fbe549b24aa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c7195b4c3b69a548483c81eafd80ec

SHA1
1654cff6389bd59142560364c83b5c9baf3fadb5

SHA256
27121ff5f013003d3c073983d102800b896ecaebb8cee5d8077ee4bfe9d73267

SHA512
aaed6bcb615439eedcf62bafa2daeed1bea5d3ac561f662700a5a17263a18ad3e275bcabf2ab95e3f025a7f264b83fb4c61e113aba8a47afe544be93f779978a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef0e1706042aa11526244364bd06afef

SHA1
79601463798a49a0e47b11f0788faf8c016436f2

SHA256
099a7b69159e4db94f59f006356fe81278e6daf71aae10fe28badc0071ca5953

SHA512
7a8579791aec4c5628ca0fbf92e26a909dfd683135605e07f66627e18cb57e89613fcf1867169f4eb4fa374d39c39ce06a6bd2752db97379d08f5d29995f657d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26e4df1737bdfe5fe8ceb1905337e541

SHA1
d0a62b21348a9ab53aad082120075d180cfc0b52

SHA256
7aacaa82e0fd6fc8465a956c7dd266bb2177cfba971063697d55e12b1220be81

SHA512
1f8f344242001b095cf8549db87c4177027bad7f88a19bdb510d08db818b80b5cf065d450e1175bac72ca0a60e01303d391f9b6e69ea86bc39e8ff88d7900413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49fd6462d0cdc6cc09a69282595d71ff

SHA1
0d040b0b84ed47645b4b10a1dbecb9ebe444ef6c

SHA256
1ec25f64c72ffc31ab09e6b098c174cec94366a4c798fc263d2a5e28ee04a18b

SHA512
ab29e58b19a5db8e0dbcc922909cdd7ea146818d72c7915f83c0f6ea01a0cfdbfc85adb3e075d4922b7f2714aed98717d38a1222e839be1fe4c564111c667e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a98cfb3f921ce0f2bfd4963eddb77c

SHA1
fc19703150d2d14e18cbea0bade8f7aadde6fc0e

SHA256
b0135af4e93dc7c9fb9f6f418334fbd8609389523bdd901e736aa1f4a14e2f7a

SHA512
573417b2455830909d1bf54e12e812f8da14362ea2d5b3cca4df3706abac47caa8dfb4b28fea051ed398da0655f2af4d35c58482e265573831342848f453d6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
143c8743bf9370c5175f22ddf3432499

SHA1
d941c145ad799196c4eaf16a464b82035565e11d

SHA256
e13f5fd0903a6a97c4cbb558f04c2367c86c56e8fb4fc0848c37ee78555834a5

SHA512
be0612fdbc78507899898bdc0a2a867073ff9395aea9c48b372bf58d490d2714c770ab4a2e8df791ebd1de8cb1db4591aa823be05c0a042a4e705eff4f4a4739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61faf7b3b752d8d8c77278578a24db38

SHA1
c1a5e30d3cefc08c316816caac87812c3f6d75da

SHA256
b1e8494097fba6187734faec4202d904d4bc98c818e8b5011fa89e40bbb3bbe1

SHA512
550c80eb1cbb7139db8772bf487e66e9ff7638a77f5a7faaec7cb3f50440a6ed9e80c33006f6f308108d19fa69fa3295e817075b4ee7f08878db44e407de6775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab583F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58C0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit