c7c4f8c5d0323179f7ff59235ac5c4b0212502ffe5b7ff790aa47da46a5e0cf4

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38a7b9edce494741c867891ab8930c1f_JaffaCakes118.html
Size

214KB
MD5

38a7b9edce494741c867891ab8930c1f
SHA1

66bab0c3f4db7a39350e7faa996cb473514ad358
SHA256

c7c4f8c5d0323179f7ff59235ac5c4b0212502ffe5b7ff790aa47da46a5e0cf4
SHA512

f2b689c422bc185f4c08ecf43a45f5985d56ce19a2b48018897c81aa5d4979133648038f58ec2841e49d49ae376cee41c449b2e64c7474fb5ad043bbc6b6fafe
SSDEEP

3072:1rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJo:pz9VxLY7iAVLTBQJlo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421656117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{618DB7F1-1026-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38a7b9edce494741c867891ab8930c1f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79e27ef85bf36e104465b5dfcaedeab3

SHA1
9a6808fda9946f644060e1f3775036d532fbb934

SHA256
1e5f1dcc8c0b260eb4d8b5dc7a891c392bb4bafefcd01ce9fe092b756ab3d182

SHA512
7b4132c545a791d68fd324b300d70b9b1f076f680e7472ad2c7caace28506891d557204119b91acc51fec156a563ca29c565a259acef4cd07a5df4319975115e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d11baafa762cc9d60b2a16cb375c1c6

SHA1
8a846999031cb468ee1421851f7295c647c65e99

SHA256
6f497378883081dcab0068f6f846b6c8ee466767d7b1bbbd684c0299d407a287

SHA512
4d13e33605b35f2fcbdf6c734a0637fc3b220c9f4a085c87cc687a5b445d183d77052af0770c76e42971830ea8afc19091b492e64e5d8d04ad5e46029589d32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653038524217b403cd44503e4f9bcb94

SHA1
f18a5ef2e8e947ad5b49f7a5501d33436c6d11e4

SHA256
40da35e99dc3f03adb3e3a7c2739a471daf74bd081cd3c19eb9c24da6b7dd339

SHA512
183d64152b5da75cf23cdde57662951cef34dec9ae9db579fc16c9f453e8f27cc301cf106aba27d24960170a27a46b4dd012e213648ecccc20d455abaa0a389a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9cd67401094d28ff9b632a16469baf5

SHA1
d405c8a526ee6e26c370d9634a706b2e78a7abfb

SHA256
744b45c61a8a961fc01ae78f537ba9cec147ca07985bdbb0836ae7cc9274200e

SHA512
d9edf0e2c1b2f1dadc5e72fcf724b389d9c91ade0868d9adf8b3198b86c0a76243853866dbed46a33625611efbc175773c015af6306329c67d51251e45d1123b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52b93d51ce41bd583b8cef3a7ee7fd6

SHA1
ce791c3de8736f438b40c3d83bcdf47f3899022c

SHA256
264c4a8649e791db895f518bb245297f1bf989b5d6281a150c13ff51296cda61

SHA512
874c22122450f38179f6290f404ddb803171d2c29a21d9a07345d4e63fd5b566711ca2f7760c61309eef235340b6dd7b92bd5a65b1f30fc1cde4de90d4c0a239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d1e17261fb230bc80018686e14ca32

SHA1
a3ebcb4747c86f3eae71768b480f6c8ca7d82317

SHA256
cd66364d1c32dff7a5da9db4a5908eb0be232b14a694844fd53c4d901b3c45f5

SHA512
d6810d59851e522de81e93b4e7c7b52465c209ffd25baeb022a4342da91e9c09c6b699ea9736e53bed7bca0ed06af75a56ef1a065c7f86ac7d14f3810d44d871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf94e2a37e4aa8c3cf701a4600559eb4

SHA1
046800aaa4cbb08669368859e8cf61f6a3884a41

SHA256
e7cb792422b693adf1801fe84e4716a1236aec26c9a9c4b81c4f919cf023117f

SHA512
a02b316977089c1d426defc8f2b23d7d52f9b7c6c81cd8d8136ae93b8333e6af86874a49cf7a961ac97be75aabc03cb64ca2ef27daaa2a7bc15dc0c1f806ef06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0518d6c765c5422524da4fdcfe40b2e

SHA1
71ae1bdda30ae33e9429a0c3985fa45e25c321ff

SHA256
6d2c3e569f28de75c80cf9334642b1cdc35cb902898745274589270a39e4150a

SHA512
c76c3aeb0c5d88d16272c81b0d913ad58c3e77c16a2c471383f756b9c26cbda399cb9334474d12807c9eb228afb1b8915a2d406177d0ee1b53f873cb396024bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0d753b2cde8ae854fd43549e6a52093

SHA1
a7d1dd35484e734225de222fd1220dda8ead07ee

SHA256
7ba1b262c68d78803ba7a14992f5727461e37ddf7632e409670b488ac276d457

SHA512
60384446e94ca2dcb3f0ada633aa8b4de63925c90bcbc4bcbfb43b0ed4cf8409cd24a2d8c56ebb46677edc0fb40642bcb4e4e5ec27e7432f1389db9985f82ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2020.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2071.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit