7dbc45f823d312af899a76642c98d188b88f598c8f0c56b738a9f844feb41669

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38753905f95b97438c539d264d8abe97_JaffaCakes118.html
Size

77KB
MD5

38753905f95b97438c539d264d8abe97
SHA1

90757d57779ce7f045741531595f420a8956e7c4
SHA256

7dbc45f823d312af899a76642c98d188b88f598c8f0c56b738a9f844feb41669
SHA512

2a3940c4c46ad3ef678c1d2a3cbb514f0ebd15d6a2f1d45561b87da65e7d632877e7645a74c6eb7bf7f8ccce931f5e1cfdfd63bfd964147c33225afcc07dfc9c
SSDEEP

1536:jx1p/X1c8qEB1Oduzd4BZkPBk+bmfgic4XGSWo0AUjACdIjz/pFAJV3uhOOgnwtf:bp/lc8qM1OdM1PBk+bmf9c4XG3ACdIjT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D7CBBB1-101F-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421653051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38753905f95b97438c539d264d8abe97_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
22878ca0776e40dfe0d6c3797e663eed

SHA1
8036759adb42c218725804b72b5b1570239bdf64

SHA256
77e2f01a0cce72111c23f2542e3665bfe0e92ad82f5abcd614f8d76b1fdb807d

SHA512
9b2dc61abdf43b32d5faae0611f07123cfd8c2a12a4cdfcaae62cfe6e98d5f52560b060bf631df83abb28652cb97d51c234743b8e6d3eecc1b58df6f72693ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f1cd972f475f567a3a416c5c48e7f2

SHA1
c9677bb387246ffd7e0a86e7235d92a46a2ced32

SHA256
7a14a193f2eee0e477a765d1b08e3c3e642df03d7ade1a7b4c3e4d926a4b8a20

SHA512
db5ec38979c2be9ffa234b5985ea23a713b5cd9102c340615add0ef6e5a26587b21f612b0c65ea63c47eff38691bd23df837169753c54f6fc9ae8c3fd69a08f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd3b68ad10137167d460b16b49ec82d6

SHA1
8a65bf535c53b38b432de370c2dd893d123b18c1

SHA256
7357e90bc995ee95908cb58811c48f2e3a51e4cd5d808489b9c3788c2cbc7799

SHA512
a310e560cd936dbb867418f68e4de458d89dff960dfc071b16d0dc0e7710baf573b60d8e23ee75f7f990d4ec8cee7cdde71f71acf6a235e3c50d86af941bb437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc7e7a70a8f04646b0f79a91c7e16817

SHA1
9d6f3c9f51069ea00832540ff9ce0004a7fdb440

SHA256
29b95aa9cf15db23f3cce7c4231d109690c7467244a284d6a72f800b7cf3478b

SHA512
9fb8c2eec4647f546e9ed6ba5ec038fd51da4ca62f92b5f864623f169bffe81b7af9639eb6bd236d271ae682897707194108108366a79333960ab003187bf0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d0bae3bdc43f43c0229054e113398e

SHA1
ca18e68fc4f6817a694a615f49d1e68c8cb0b990

SHA256
ebcea5a399d72b8a94bb1afc1b4eecbce0902597a301d9580da4ba602a89bc0f

SHA512
62c32a7dbbff6bd52b522908872fda2bbaba31420a43fed394c5d3b5f6b50dd870369fbe37d9c82d5e5d42aaee61662c325268e8c0027cb60e5cf2f7679992ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9433079513d3ccaf512e42d5bcad7ec5

SHA1
18ed29f58565e2ead27d795592fcac1ce1fdc282

SHA256
a7bfc9c9bd4b52c4d7bfc7c43116b6f99c9b7b7b08f341fb1a2c2c1e044d4f7a

SHA512
55a0072e1a30993f9a7548e9f80478a533c8d5a49d0cf34736b7c9cbf45d28db22ff2f1a4b2e494d2728d863f7c78f2e6dbb800589d873774fe2d23686f725f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89f2d851da5b72d532c530bb58fc5b3

SHA1
7aa2ecc96f44659390427dc24d03e08dbdbc7fc3

SHA256
782866e99fee35dd5c77d1b85427ecb577dce72eda3112828b1ee9fb0fc0559c

SHA512
16bba6e06816a2911e41d6fe151e730dcde2423fe78e05c8f8f01ed0cbf032277ac3f9cf50883ce19adceb97f9da45903c91602519f5f145af0010463ed474f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15557778ff8d761a11dd4dab3bc84b33

SHA1
1589a5f52e9899f9cb2b440c64507cfc2b9515ed

SHA256
9776dcc94e7ba65e02500f9e006c30094ec1f7bcef129ccda6cf13a8fd9e132e

SHA512
33173caf319adca91a4d15e74353009587d122213814e70bbc73b83fcb7dcc4bcf6ca66b26c179e919af8491a74fa2b6151101963d805f4a856a942cb67807f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ae381c67bd30cb2e3f62a495fc9c37

SHA1
dae96672f09c6d6aefe90592b63db6f475ef4db8

SHA256
89d998cc9706250a6bb4152fdadb24c759cb8c824c5e3eb770606aee23b7787d

SHA512
074ea06421da56c6ce1c0848b8ae0ac8b76af75347b30cc456060b06c523453309868dec9d7d7ad1c69cd37e1a0b5752b38b95bb34e4c3f675c5e6e12b1e88e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7811c784b0ea5e27c9e654e6b076acf

SHA1
f9230f2da16c0a0d14c761d07b35b8a7fb06f533

SHA256
80e430bb109e3b139ffb434fd19fd7e583ac79500ef4050c1bc6f2cfa3b87fd2

SHA512
9ccc7587cc4b9dd38d6ec325b6c92e7d89dfe991dcf66e94d564eb6e13c7b97f95f139f0ba40697b2a065c687218fe81e1e16977d7b46079093ad8417fd7231b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b415d666c99dffea7580333edf0d307

SHA1
b870c504b3de58370a1f90f683339243c99b9158

SHA256
0fa3225afdc16fce016d85d1ac1ee8bc6de6b4938808e54230436906d9c9172d

SHA512
9495bddc4f4627a18a21b776411b287922f0eec406ba4f4bc30eb5f4fc3851ff7b57f7e492798da4b94bccf12faace2f8fe4e0d13aaa3d2024aaeefb912f8378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1e441d89c4cfe9c34df7bedc10bc2595

SHA1
cccc80973d1065e1bbebee3f2f9d037fe5df8631

SHA256
0fd324a15fb748e558fe0a690186abaaaba6a2d447aa6900dae3f881642db09e

SHA512
ed09df4f4aa5bce313eed7195f2a53e8a78ef008bd38e3e2c3f2d1ca1afebf4a59e2fefec9762b61b8dc88ce625ddfd7f80a4129ee6dd07deba67f312c481547

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D50.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EEA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D63.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F0E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit