46115841910e851bb05e83b6b837c4abd1290f26fb58bacc91bfa64826c3d6f4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

389d8c49b0421225169d469489c13336_JaffaCakes118.html
Size

140KB
MD5

389d8c49b0421225169d469489c13336
SHA1

bab1364dc028494167640368e48eed54e70fb1e8
SHA256

46115841910e851bb05e83b6b837c4abd1290f26fb58bacc91bfa64826c3d6f4
SHA512

1f90f789eb70018ec9c468e69fdae9744c55a19bbd50cf0c63dd73b69ff7bbc1ec9a742071bbe1874a042a6869c50476bf2fb97bd325f2472756bd0d5299c44d
SSDEEP

3072:S0UucdIMOx7dyfkMY+BES09JXAnyrZalI+YQ:S0UuLx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFEAF0B1-1024-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421655471"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2100	2224	iexplore.exe	28
PID 2224 wrote to memory of 2100	2224	iexplore.exe	28
PID 2224 wrote to memory of 2100	2224	iexplore.exe	28
PID 2224 wrote to memory of 2100	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\389d8c49b0421225169d469489c13336_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994a6a245bcc340f33f2f4796fd029db

SHA1
5e052e021afceb23af7a47e0d118eb9de868da59

SHA256
e7539dc571c64403533dfed818f4cbc8654fdfbc959d0a8b8f9fad0ad7f92780

SHA512
4d74e1f72225093635b6655da3477958a30292aae7a8f9505f7cc821359943002a58a9a51885b2806fa4b3c37b23dcdb0b30b4ea0d0cf53af2ce14e4fe0f6706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe164ef5af2d36c48ded690fc1d3b60

SHA1
422e996778943434304ed2068fc20ce08f039f62

SHA256
177b2539413c8827b4c76695de60d9bf7e169e53559383a13d59e8ad2a11ea81

SHA512
bea338a6c5afd759882eeab15550682bb434d95d21aa2e26b888d4aea663273714299fd49c1cac7ab9088c515546587e0147c2b24455218a6ae504739b98725b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd78a89e995e9aae723844b9ca88fbe1

SHA1
e951f9e7fd2a3a6cbef09983440dfcd5ffcbea1d

SHA256
e357f9386e5e349d80591394acc8714d6d4ebf9c7d6fe0d34b5146ce8667c2c0

SHA512
b4413e565168537d80e6645be8b0081260b844aeb00d91d8102e1790b3d2ef9b4b7f291c5eec6ad32ef81e70b865b4e1be0ce9a876cd10693dc2f59f9479afb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6142fa9d5d52e7330453a0d159da0f7e

SHA1
94d0814610101bb1d37422e5ceb159501405b8be

SHA256
c3c0eef786c6b6ae8a74db9737f2a776273ecf1ac03c1efabd7efd2bd212a2f0

SHA512
555a30719241e8f64ee4180ead7375345de28f49f5faeb7d35c121f6333b6a76a5e3369e4eece6759bf0777f848cf32260c78a9244bf5cb35aee963600104553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
205d97050cb7a8a39d4ffa2f71e1752a

SHA1
9b46efb3143896b3eb018b5516608517e0261ef6

SHA256
e89c037928d7349c33ca4b9a2c4519497ff50ba4cfafd5597e895aca0ed9ce05

SHA512
550626493335a6ac90429e179a6debcabb0299db9815a3f2397a81b5160238c02a1e8545ed633895ecf33fc763e521252798fd699c6c0b60095a31c051a47968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60fcd932ce26591075bc20d87af20afd

SHA1
7a730a52fc7e3733de6b086b8747fdadc6cf2336

SHA256
038f64b3aa0ab7c266731ff6ad56da10c91cd6cb95784126195ace4e2c38b842

SHA512
706ae533ac5957fb50e59ac3bc846b0c9a8aa890fd961eca5be47af2221730fc2b0eb4fca11a604da7804c26773b8dfbe15adf8aae2e764f198d4a7ec7602669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49512b40e334159f07ae73694315b0f

SHA1
5da36febc697cb7adea5c3933f5d27498a6a8259

SHA256
de23167c4d6cef5ab2d2509e377dfc21a764451292c30470238b3703c1931d31

SHA512
185dd564bd1a4a1095b469fadea6c1d9ce5987589c28c1a3f205db4b314639f482a891433c71d6303df5f4d6ebb322fd1e7c01c194531b33e51d33c099f727be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de105942f1eae2839bbb6ebbc10c4859

SHA1
c2a5ce5e08dcf322b72e5c7ac35e1f68c6b0659e

SHA256
0f45a38458c4730bcf2fd14d6b921cf3a124aaa33e1e9341a3aa0cf5d9de40ff

SHA512
f1d50cf3a23dd5c457977e24f7777942da241e3f26aef4f7990f90bb49d3e609f8e84411ca236c78ee95330d26b633212231a173be9045fc0c60e087eda6350e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5316489390bedb3e79efcbb47c1473c2

SHA1
b7cab8ceb698b018e628502b2b160f17c93b1c87

SHA256
55461931c45fd65bae895fe65da837023c251a87c01da197c0a8c1373c12818b

SHA512
8542e51ce62e8fdd508332669f24d203c306193f05e4d8180ffe066fcc3121cda3aefbfdf53e05e23c733baf25a833416c5c980b7f52ed7a9bd57f461e32c4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8354e9c53bf37874f9675f7a14db6f

SHA1
a4bf3316867a474fc5ca2e59a2d2421585d13780

SHA256
cfc9683eebfb58b697f8fa7783b6c7bdece0ad1728890f60f980da3efa88ee03

SHA512
267755fd6b08981f0312823983f5b758f4ba1ce6292d98f2ffd536fc18a41c3bba629f84a6a757a22ba9080195d7b37d28e08339ce0f5cb37a4fccddc88823aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
328cce917fbfa9cb29e35bbbd6dc7920

SHA1
7c185ebbf6d88527fed69bcd69b7be8c1e1942fd

SHA256
f450396b7aa481125eef90cb2ea16ff6195f1549a7237697ac1589e3a20cb5d0

SHA512
bfdba59049eb23dfe940eae74db440929306b1ea33b08cdb4cb26a3e7b65daf20b5040db6c93a0285257120348a89b95e327f5bed54aa9711b946e12b7926e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d8ae021527255d0967fdfa4c33f6d8

SHA1
5ca4163fee84d2c418f109daae0f1d43d86a613c

SHA256
eba1edc1227cce1ec8547f7d93f5ad060e7b3f69185a9ce5531d916adaa13f03

SHA512
73c9d9a6c3ef007945b93e99695af86081000b638251db171f0626845e5739649ef94c43c7d41ef6435d92df89dc424a2195fb54f650436c8ac75b4c33d8b70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f68f9d9ef593901bc00db0914d60dfc6

SHA1
3f20ae0046f0f39c3d729427960832a8fbfea2e5

SHA256
6ae869d0c6a89b16f4b32477e132bbdf96f7bf9f28e41188fa2bb3c254c62e56

SHA512
ceaf4d10b60a2722a2ddc8c6c4d85a0cc3080510d56383ed38d8da8bd84b9989eceefd863f84a8651a493cdcae4d52c54109b0685420d882eaf31b2455c208d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e378ae0770668cdd0ecbf6dcd6b730d

SHA1
3716cf448757787eb90c477ffa75455ab037a152

SHA256
42d18fa0efd281df24fde2fad93970948bdebf6bfa642d45ec04275fb5ea44c0

SHA512
f0d510abe160ff3fe6bcdba0531cbb375e6c3bf0fdf94487423b341368c15eedefbcd06090c5d440f5bcb09b32ad8cac1791f68f446c64587d1534a2f80590ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a947afd6381efcbd08a46c0c307b1001

SHA1
3345df175faf105d364121ec012d6db80d956be3

SHA256
3e16d6b8dffcd92b94b72c0dfcbf0e26e1c2e9ab6466b80e12ee0cac859b85f3

SHA512
961ed18a451a3cfa799aae4ab5a6855596e27b3b598629d654056e05d343f591afe43d397012c2cb553e215e0688506624c085db246993c2718375ce36395e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b276d8dc9b91c3674ae2d36e3dd43b9

SHA1
148e31fd3732f0fa64e5cd45d80baf3c26c81e8a

SHA256
337f5c7c56901c555f333e76891f3b26163017af2e15ead48a4ca6ba571b1dbe

SHA512
ccf49849cd6a4986dad4ddf8b23b311aa5f21891b9b8f1d32189b08846d4ae8c28d8a3751fabba9e14ce0de392e7936d59bb08d0296be7bb635954cf2deddf29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3460aa2f89025331a66e3aca11a719aa

SHA1
14264efcfca52fa389862344f68c96db6fa4a6d2

SHA256
861a262d556adfe89059399f5be3fcd2185e759538fb493752f061c1b1d7212f

SHA512
a2bd1a9d47e512586bdbba210bdedeadb3bfd747bdb62df9d7a244d2539cd95b0d7d5828deaa47d4de860e5072fbcef4107d5cb99e90d6f6c662cba206dcfcc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35e05d4397e83453d46a33719ac4faaa

SHA1
c8a5266e52b248e4ab9b899dbad92604bae985ed

SHA256
ecb542625fcca45548253c5a4a599deb6661e639b769294492a8573986b9d91f

SHA512
b78483742c89f822ef8b99ed8ddec6a8cdf25316b791301344238a382c9f70602710ecd7a3f6a0c6a8411d297dd695bebbfe542ae9623a367c9575366438c247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7479076b3697a358b5dce13afae593f4

SHA1
0cd84cfa8809e406d8ec958a540dc1b8edb4d935

SHA256
6c11ebb23d88ab3232ab933d3d19add1620d98622a27ea2d3fe18e153eda74e7

SHA512
5a752249fdaa064087d72913014f57989251a232ea09f19d9ec4236e215e6757b98d7ec7048a3366e719ac2ef40a951d355843dc986d8e34f0bfbe11e2308447

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FF1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2052.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit