81beea8fcf862b3cc73a5bb3284c587257014855e20b8098dcbd901716658d61

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39411265b780c8688ec6c76364121650_JaffaCakes118.html
Size

32KB
MD5

39411265b780c8688ec6c76364121650
SHA1

2ca330a752a9d29d37dc939bc7acfe534295aa0b
SHA256

81beea8fcf862b3cc73a5bb3284c587257014855e20b8098dcbd901716658d61
SHA512

e76e5904501ad78975e49e01d5e481c032e0ba37b55302f0d44a11400cd38f89243023e665be63cbe850d37b95cf5b3938fe91bac1f7d4944a62b76627c9e4d3
SSDEEP

384:imS3mrQ/zfMuqYnA2itOe2RUt6+XOoqP4h6dX9xrCoXU5SS4tlxu:Dtb2KtjXfqPGL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009234e4326fbd4b0d43f9f39b138f68ab737b23b6a3a32b127681d34c81ca589d000000000e8000000002000020000000cef6f72123e4a37370bbf19afed9805486df72f380d376c4d606b0ab549525d22000000064fee02f3d5227899da11b698ede8a78b93a05c131d54be01e05cf08627413a340000000bd0a2c44fd28aae6addf8b6b8940394223ad810900fa19000908510801e6c7b217ca7a53c7c5a3d92a5ba8d5e1878dc599b98248b9917530b22d7d198aa3bbcb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33B68301-103C-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ca8f0849a4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b828adcba608dcd6321653613c89689c909718b4a858c1eca8d2d826c64a899d000000000e8000000002000020000000c5d101c3410d8530c0a0e6d429ee9f9b18e9b81a2ee7f73cdd71ba49f88bf75b9000000034459892bf026eea1fdb7fe166e0a4e46e0150e1202d7d36a7b3c14f0964d1dd5ddadb15e3e335dd01c606f4f28a45e8dd5ffcc832a66e972b0ae73a330784c4a198467283bcc8934320d68e8e9c85bb3f9562e183c2b3447eeb61d96c483472ee7fe3ef97e5f7771303b252bf63a0cc54e4ee8b1693fbdb05fd237a839eb02aa4c8c7097aef5687ac0d97613f3c028a40000000c42df7ab98951b42460add1c46a39c758675a305ec75463ce7a1b73d1f62f33bca23cd5bd8de2d909da39df564b22e4d9e1cc463c74ac9a95c110493907088d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421665490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39411265b780c8688ec6c76364121650_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db28be86024a62e8c54fefe5adabc77f

SHA1
5d79031f49abe1048fb2b1b3f5c78b1657ba9662

SHA256
20cea132a9315c1bff666c0b10bf38ade9fe6a8c46430ee0c10f8033c29b9083

SHA512
ab448c0d83e94fb8f3b678d6540333e8676c30645dad0da08f8dbe80251e9a6cb653a969889cafcdd47eacf4e99c86b38414ff2a74aa245adb30d9978e48705f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a5a1443b98ea973aa7b9f1e961fbccf

SHA1
3008b25d69e01d63463c58186ea5697dd94d87f4

SHA256
7d1e3502670fc9df978437349f0dd0ab8cd4da08a46e5b2782493d88714a9ba4

SHA512
e385c8a0e3d539cbd11b430d61c53e365a2ddab70ddbe4464bc2c9f1647e0c09ef057d4c24c2dab69cfda3e12329b98fc4ca32e57e0c3deb17c55fd7c84e3b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f19513d71fdb1b2eb477275bd0a720d

SHA1
c1e28c062e1864ab1b03de5a83afea1bceeb9566

SHA256
519ab745b3a65e7f585e7a4a78863b07da5b3254417a739fcf2815c868a5df2d

SHA512
2dd7f422ca8d30c6523c6d79bf29446c504c7f38b61c123d987541353610fa7ee7b6f9d5fd460e10974be8d8f35a87031f3e2d03beb813741299cc5e113e5ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd8098b46986b9557c53b2057604c0dd

SHA1
bc4e4a39f725140fd98440120100e4fca2fc0920

SHA256
1a6721cb35e9dac680cce9b9f7a9160ace68f087c89841c59caeaa607fe4f67e

SHA512
36ed70af5800103f708b4a5581a6b42ce43b04d545002bd6a1dc084d8048ed1248888eef94cc2a75bb296972934d8b2d59b858498b5c2f13c15e3d9373cd6095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f928cc31d794c2d55c835510cf8d7120

SHA1
49d8ea4a961c9b0aff843a916ab64a5a112e658a

SHA256
6ab1c1938c3a1f56e9dc96ae3c713dbb0df93f04e034b51d7841f1afec06f700

SHA512
29721cc11fa1c3961f91931f7b752bc00e2b670e479e252534cbdb4431ef64c1e2e86e99f834e01b9625a8c627f2c223da30e9c27762ec6beb2f9f7ca2e59ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
239437a67cbbb7082991011961522ae7

SHA1
9034a107904c1ff5e6ece81873901e73def72255

SHA256
d33f8cead1dd20bd5edbc57818c5a6741b1c8fb6b27471cb9778f5233c766a71

SHA512
fbf9c7906b6e8682589c90dba79c0c2f0b3fa0e179395c2a3eb461f9b9ab1631b1bdb7009638eeb25375917af7885dedc9dbc76e1cb2c24328f381aac5ea4b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604dbc85d53d4a8fd6d43ae46742fef1

SHA1
9d90d543713b137b8154310d0a2f60a3487f2532

SHA256
d8b1159d0d81393e581e03cfd619e70f344a0af9c736996bd82e2a349fb11358

SHA512
ee53cedbe2a02ca9aef626e303d50bc1733b8194b4106d7ff96acfab6356162a34ed62569ce261c063eba633132de75ac9fddb785fbbae094589d6b5acc6ca94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
496c286f2ebf950284a5ef7eb9cacdea

SHA1
62e7ad4fc5c889d3e4dae75b696662fbb563d44c

SHA256
8b17e4ae8485af9c3da6edb030584cb355f468d334bff9fd3dc530735aa96ebf

SHA512
8a66405aa7b979fca75210ff21a252644cc5778b0b0683de16c8c7d0642e0517c071bbfdf3be6027bcf93215fb8df3024899f9840c36b8fc77ca08bb15afe292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7499b357a43b49737aed6e8d0637ef86

SHA1
90028a6dee687db9af59076a1a6ae71167f7b147

SHA256
df0025e92ca078aeb7dd871952259688115267271921076696d145c3e3c430f4

SHA512
e4242bf9424f6404de52cd75776420cc1881041a5cf990f4355d0663257657a2b2649abbd07fb189f54c337cbaf4532d57118609d94af404aee49e7538f6cbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582c3f7cd5b3612901197218fe8d46ec

SHA1
38df8804960ddae43dbc71c03b480121f18f2ce9

SHA256
1b4526096cd158ab72a95396c3e2a05e8f87f720b60f60d338639688ff586e18

SHA512
b928ab5b3d35c98a8507ba87c21831a8d48658d1b2e95ca9248c439105880c7e1eb1c396bbde687a9ac80e8c055178e359cd52e957e73694975f87622bce1ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b01ff21eaffc4e1d02003672b578c7ff

SHA1
409b3980e60598260f3ce9f67943b977a303025c

SHA256
20f7428e8c0e7383dedd0fa16e708110989704a133e25e8a3af08e07bf72bd3d

SHA512
243a10dd2317586364140979b7f143a03ee087db32535f4fbff05ed546b0d764eb42dad4d1c1a543ab43066516333a6b0049d4549349436e66d7c8122516095f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35ab845550ed36ed856800ce200bef77

SHA1
02fce876c44f9c56c88ec0ee52fec67fbab9e6d8

SHA256
bb1cf30ca01cfd70c0c1f66555f2ade01b70e051289966368cbe176e07be78fe

SHA512
8aa4ed287c405e71eef5cbcfc2dc51264e6ff4557c59424cbf8383f6a9c718fb3b4242506199ff6e5f30888c4bd531346bb19980a30206247ef32ab65ba4ab6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9dfe0301e54123694b8122ec6d4c782

SHA1
897e16da8cd39d2013be989006be3b9ccb675dbe

SHA256
d6a8492127031e2e184d00a89eb01a2baf37650a76d07fad9851b8939bd9080c

SHA512
8d7ae829256cb0732ce4f1913b0911cff19a1cce0f008f73a2d9244d2ab864a53d999d11902c3c5e1a5f74966b700026c053470f95c24c2e96379a5911e4cb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d38c3434c8cc810cf95a125aa7aa55

SHA1
5a0a0f2cf10db6f02a0ecfb8204fc18594c0ca08

SHA256
589c595f7bcd49e515acad16f5624a1bd41f895be5753610dee3c7c19d20be73

SHA512
a284cba67d1ff76a51205132119e3c557aa05d4c0c848d6af695fa76655207ae060da473599efbf3982ef88eccddcf84040f19a1065fd54743f2eeec29ae7a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee853f9fa62e096f417295ebd007007

SHA1
d229310771a58c855b6a947b0c31d42e2aa6e687

SHA256
9974f4037db4534fec173335e1fa6c2954961021277df26cb1efbf91abd0ca30

SHA512
bdd0d9980b059cf0fa37d7a277fd3b3946c5c36300839e8986f81e8b145af6794cb8b27635ca7e1167f510cc1a773f8370abf315ebb09795f2e4c389e001a494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2cf9f6450c4b32b1111a2e1b829922

SHA1
a3fb2ab3e2ec1fac89ad84147c728daca648ae3f

SHA256
a88df8dba44f13a4ba903492e10ee3127750b73cb38c0b6079a7ebc4d8263ae4

SHA512
413e21d4248d909424b2059bc2f8ae4fa053a47ee61e50f571233ca506dbc19636a3f306202be03a76482c6b8b498f44cdc1f950531d7276f56761e1bdd45607

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A92.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit