f6449b7a56f4d876a49909ba178725b6d36ecb7eec083973f55c684f270eb52f

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39904fd2623d90de774c62c78e9675c7_JaffaCakes118.html
Size

19KB
MD5

39904fd2623d90de774c62c78e9675c7
SHA1

1052bef98829edf29bbe9de73190636595651ee9
SHA256

f6449b7a56f4d876a49909ba178725b6d36ecb7eec083973f55c684f270eb52f
SHA512

66ad33251d307ca3878abc936ac5c9f0970320182943abaa4626f1b9a42936c5a52f722f8f913091f9c870b1e38e5c988d98f0b83c0633c0083e798dc14bbf32
SSDEEP

192:uwXhb5n7fLnQjxn5Q/KnQiexNnCnQOkEntusnQTbnBnQmSgHMBRqnYnQ5gNnlnQz:YQ/5qyLB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421670421"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009eb36c65c4ddb833609494899a4d73eb3c9dc76a8fcd1f20b70c2cc267829aeb000000000e80000000020000200000008f516aee142711322fc4e6fb0f1be62063b944c7886696d4a0885ed4302eab8620000000d844b9d24d4d6428c7985d985c739caeac115d117740072f25aa7e9edb219a014000000059c8e10f451ff1f17cb4682e9750675609b4ad5f9bd05156e2207a2ed59091ba4c9a00343c062bdb0ad1d9c223c9146994c4e965b02ef749f0b5d5a54c4616ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000df43570bb06252710f600f9b7e8a01bc64e5e277b436c4b9c302b9e2b7d266ca000000000e8000000002000020000000a3a6ccc800260ed8f826fb77b61b0e7603c61d44fad5bd3d55e9b9dd25263a32900000005f6bfbe32097189b35ed6f4c7c9ebdf0c45534740845d5b9d54827e2711d4019884414f5621e1f3fa607d6cf8cfa6bafda2c98b429e17e60447c388a4c2b0005a0a0c841b122d34e50928fb03c65314c31c8a0e02841ef60f9256f2867cc7f5686452e3a96b8dcb4d9ee336c3e958445b564a883af497dd23cb05d1732e15416df0a52eb9745e5b2f9fc9e06f38145ce40000000bc7bb1e8615120b25a0b901ee972b7c19b849b0299c255ad2e1fda4e71490d7e6d17d9641e2b8a846967cea77ee2a98794e6d31fac8fbd48c810584442884e4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09a078454a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF668261-1047-11EF-B290-C2931B856BB4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2116	2432	iexplore.exe	28
PID 2432 wrote to memory of 2116	2432	iexplore.exe	28
PID 2432 wrote to memory of 2116	2432	iexplore.exe	28
PID 2432 wrote to memory of 2116	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39904fd2623d90de774c62c78e9675c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6ba21e088a22dda4da5efe81aff9251

SHA1
0c3c0cfc028c382247e25d04771f2a25dbaa8183

SHA256
18dc8f5fb82d2f534767a3633a8619416b286fb5505c047f1196b95a6b11daff

SHA512
304162791b9e7b25b40c87093403e9cbb26d1547124d0a402787acc30ac7536fa1f90e0bc955066b46bb9f6a7c1c66b2a279052d62bbecd94dfd43462bfbe7b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3284d7d928ef503740168642b4115ee

SHA1
2fc99e2aa4a4fcd37544a01e8cad4332ffe311bb

SHA256
48f357b113523bc9b287bc94fa6844b4d0d1aee6309550b30a7eb5b6d9c30a58

SHA512
20e096c80202acc83637173c7736f2daea7a42b1368475d5887c8f7e367d919f512a5bcdfa2bc5048ddecf87b95483c232868a76cd0a0827f4e04d56b761cce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e1f65d24b3b104bf8b8c22829072ed

SHA1
2daf82c832f56cf8e57bdc66ec861dbccdf8bcc9

SHA256
0f4e56a1229c7f6c71880777009c4c941c9d9913658d0dcf4db80268857c161c

SHA512
967ab9df608d0f4516a0dc4a83d59805e008833f6e52c2b7a208b17623a4362583d270674c475c85e12446f17e44eab32957c547dc3ed57563bb8e9edbe39a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8198d53a654809d4a36fc2f04794d3c2

SHA1
984c15c1c9d9cae8c8ebb8e162a5f98bbe609e4e

SHA256
653882b6e600c9a0527cf044b4ddebaeb4cc5890acbd6113d07662b2fb434989

SHA512
5275a5d7adb7dbd7186a34e39325ac269091fcf6647a98205c89357fcf3921208eadc83d0c16b86061fb7f70a65c5e2a9b92f3a1e70a3b73ea03e88e13400755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00376f4c666e4f0b2f3e11e3d2eeef13

SHA1
9930b9b7c07a23456907e01b458226bf1448af99

SHA256
0a09b30371afa616bf5f14a5ddd45533d9c84e32de1727b5e2b113a1e15c794e

SHA512
f8e34b35c1485ab8158a66903eaafed4be4cc29de4d8e72dc3536a3dce2f494cc58512287ef092081c1189ceb1cd401a1fc0a0626a0d4a31d7177da3118036ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff8cc86d81807327784c2b2eb2559c5

SHA1
93695127b38d78366bb3fd7f8ab42c51c192678f

SHA256
a383b3e050f1ad5c6e9c143db4d859542e2c366c9ca2772a3a861f0fcde5421b

SHA512
6f9364e36c2da3985c09c63a941683a2189da7b801fa59bb9ae9dfbe8f1fee532d95c5c8b90e4d168a7e150da65841a68f62ddb6a14e19c4de651470cfb9c037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84734c8f2270cdf0c3ab0da6845379db

SHA1
791b55ed3ecfb8ffb7d117cba7acb19a39cdcfac

SHA256
e8172716b60e8810eafa7b2aaffb3b2b8cfbf145a74f2c32536b2b60ea5841c9

SHA512
238dc8bcca1565f60eb2554eb61866c835983f03b0e7050f4fc30c12517ce6281658516f789361ffd081fadc541083e1b1958756d333029b5759c87af70143ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03267924bd6f0aba955925b6151ebe61

SHA1
ab3ce0cb844c8456d8347cce73041605e383d3b0

SHA256
9059eb738697d2eae65342f08ac875cbf8902eca1fa328cb11cccf9bcd167d1b

SHA512
40948b5366f54a5274412a2621ef6054d97fb3583b0c5c53c5f47873fd88069ced3e34d166c39847035b7df8f933719eabe526d6cda4a8c87838fb02aa5a681d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87ee77b939a3e9e5c1286483a78410f8

SHA1
cf92015b1b9bb9e0902261694ffc5616eaefb5fe

SHA256
1108d80593143697f852bbaf3e0600ef3c5b78b2dfe5be513e813f19252727ad

SHA512
272b5796f5b1474773c1ca6023553aa1bb0bd2eee074ba6073da8060e3cdadb01cc65dff471efd3546c49e8910d264081f06f86bdc6b6c5d76831ae9e82e9ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c77e4307c2d4928665b0d568bd8e19

SHA1
b956659e1b5352bd7ed72a6deda2c6d1d6f83a5d

SHA256
cca4c86e7083ff62cfb34ed1168c7da24e6b9b8a1b73bdcc6f1d7606afc377ef

SHA512
efe9deebe53243a8a541acc90382bea9d77e2491ebe9b26b63540e6c50e7dfdbcc124b30740bcb3a2e84b00a965bd9e13897aadd89853e7fe393c38624166c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AA3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AB6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit