39f9897c69e83c92465570c428b3ea91be4d03cacb531662abe737788e439688

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3967870fc681f19699ebfac785bbcc1d_JaffaCakes118.html
Size

4KB
MD5

3967870fc681f19699ebfac785bbcc1d
SHA1

0e095e459deb386be15fbf3922df8c092692ffcb
SHA256

39f9897c69e83c92465570c428b3ea91be4d03cacb531662abe737788e439688
SHA512

d29ce9a25287a85a986d7bd0ad8cadc2f5d055290733a95678b8573235cc92ab9e78d5465492a3cb027e012b678ef90c5c03c02a3fb75e660f0688a50d283ad3
SSDEEP

48:ZdpxuFwJHDOxPZSYbF2ansclhPvEhrYdYd4Z+d1orXHd17vwzJD4RPDo+yN1HvSX:ZxH2tzyYdYdorXs9k2+G1HKbHD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D927251-1042-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421668002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000053814127bf367286ccfcadde68d04cc1a5aae509c3e5bbaa79a9ce274e0fe7ae000000000e8000000002000020000000bf70383c1c669c0ebe6f93b03ddfc90d0c70c9371dbeb1d52baf802b0018c950200000006a11fcd098c51866cbde4eeea3c43a276412c0f6af4403dfe5a50daa51f68e02400000005b4b01915094e982e7a08228cad185a8982c6bbe207730cb89118008db8f5a4e9563d626c1bc4a57d2e3fe31a503e61d4c672f59484c0ce069e0bc4009bd7e9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007eaa5441abf9bf4713208922665a35772b735606c6f32d9cb01589b4a44f65af000000000e800000000200002000000044e537c7ec5abc69ed639ec17c68076243900c1645152476b83facded0984d0f9000000040e03e4ebf7dbb74c6b4357b8a43b4a86b247b184fc4addf22b073173f4ff51d27c8ca1099cd4d497df33dca4058bf15fc291ea20aae8614cf57cafafa27582aaa1263d651954a1d236763018383395d54883321782c55e333f7cf9dbc40194b3c39db3b1142e19375fd737c967f83e4271d4648d8ac6ade2fbe8f76b35a95861d1da8dfe2f1c8124ef7f947c2efab2e400000004fe3f4aee11b7833640048c76bd603f1192813d5a7de862b1e50392acc0fe24faced14c33f0714e4e9d14989423f52ad814875f667dcd7fe97329b953f32791f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902bc9e24ea4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28
PID 2300 wrote to memory of 2984	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3967870fc681f19699ebfac785bbcc1d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9adb7ec26eab06f758a4e253a33c5ed5

SHA1
97fceb7b8437333610121d4a675e9c852be152ea

SHA256
46bdbdf8cb705e2b7cec346720fb3879a333d3145dcaf32ab331e8dff941d218

SHA512
7a40dfd59668526e33d4dbdbb8f55d9bf8123a82bfe25ec723ddfe8b6b8f917bbb3ab3323afa9b2ebd36ee3452453403be2b6fe6ab04cdae6e7287528a0994a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5f0b49d320b6b2c193aa33e492d21d1

SHA1
281b6166d77d2b53f412fed6ee6713d2405e254c

SHA256
7b3e21cfad35dc475a6bf71fb1f983433001b6e43e6234520936a230efb71896

SHA512
ce45268d63017a0b454d7e542db2a6e4a69816c1eb0dbd0754dd03d4ce71f654065985df800533ead10013e38552f34dd8ad4536a434e1a1ac5d775ed09ad85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c29e1555310e3c25692dcbed7b2fb1cf

SHA1
2a923a6c0a0ad4d6f0e83906a66d54e89dfc8d89

SHA256
302c43bdccfd96098e76ade2a7c54ea4c4ae7600041b340182e60ceaf48b77ea

SHA512
bdc7aeccd9c7b40798619779ef0566421a00cd266628e4b07df000314790253114aa59df6b4cdab7435a1fcfcea4e889a80239fbb891f1f633990addf87dc366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862816c1f21879d1c28d2eeda7d3eac2

SHA1
43b60ed2627a41a0de8846ef80a7b84fdf58bcd3

SHA256
d34e4fbcc47b12443506cef7362a07b7af0dc2c1f9da45b919d0a6c7977ec296

SHA512
d7eadefaa0e3bda4ddd0247849adaa52eae5443523b5a5c2bcd66762063a819a84eb71d5b6bec93abb10e22a0597fc2878a348c6b308bf0fa3ee12b29ca6e99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c58fc6e472972a44c264d0cbda9509

SHA1
564f48e718e776d7b0c59c82874e04f2d2256ab5

SHA256
d30b1cf0d7ba36cb6bda3d52ae031412b46ea7bf376b6fcd8f173714375d8a1a

SHA512
b4bb4d85db56285047b9199a4e51db67cf034a74a8e645edafcc50f92427cef4612944855986f80f4406981e4e05b73c930e81b6c25693141388bd26ef718c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5fa7cba14cc959ca4973f3ff6982c03

SHA1
1c5f08953a760e217e8f8bcd0df5551f62d67914

SHA256
af2d3d6e634e85627e5a2612c6fd04ac92dbd1cd62f6c481f3f1c6c217e2879b

SHA512
a2bf4f32b467fa7647f8998f2ff8772576764a91e088c5ead5f730ea274e7a40dbb38e68c58d68c83b9ca88ac5880f838c145bcc18aec9de7db7080eed6ada7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db714dc119191a23db6ae06ee32ea110

SHA1
1d24230585c9566533f88dc2f5beb143b55af0bb

SHA256
c2475500b3fe03ff8ae122968c4795fca1f9c7e0833fe58b33d4c1ef4f1cc58c

SHA512
35470e8ad18537732671592e4c3032750aeb14fbfddeb27e5f6e38508ec5268656d879d488b3d7e2f72822024e15435ed3cab1f809fd2c1c5e546a4c296d8ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
026983aa1dea0eebcb9edc70823eefbf

SHA1
39324e912bbc6b43563793330341d2c5f9eab444

SHA256
f3b37a9ed331c3b1789bbf5738d42ce001fb30d64f3e40abd1701914c024abaa

SHA512
9185782feb223065ed3ffbdcc2989afe24e8405a9b98381791f96fb3cec95d3e23069da672b8f4d8794aff41931503927fe49ffdfee57ff14380ae17541fdd1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab7d29736fe6a3ed7f52a40dbefa4f5

SHA1
b4fd6356d3f3e52a340ece993c3a2c3a6ef22d79

SHA256
6c9dfad3699426835708950b21ef60831303ee447f925c7885abdd908b6a57d0

SHA512
8aa6f197ea46221ba9abe8e217298c268001af913f79d9643b7897ec06c3a82ec68aec3235fa5613fc16a82ecc4e916eea6b81ef999243fe2cd8b62359a6bbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
733e23bb214545a166148434b263b59e

SHA1
64fb4570eac421e7384bb0ed4bd26d3763deb8d6

SHA256
b7f18d5cd0a7e78aa59a69833051b9d88793af67f3161ec20265a7621d43d6a9

SHA512
7ce1e3b5512e39c74948958b8ceceb83ac1e5cd236e4feea892ee42a8d99f656ba708b8c6625807a41a1cf3b96f4c45b479115cd44add4d1d55cb93a5749f820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21c2cedd9f6f2c74f394ff0a3464bbc3

SHA1
06f937da01175b10b67358ecb47d13708ed77cd9

SHA256
f1a95e172af5f43a4ac438120bbfe7c10219181f5087ced58cc7e008e1af3a24

SHA512
a16dffd3ddda3b8283135753ef87e7c09c552bf19f58654e966a8b61c3bffc4bef13f00ebd9b1de7afde35bb781b4d143e300b4c2db5aebea0dd49472fc70335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
457452508b83264c2edcd224713451aa

SHA1
930240439bf1723379afae3102c835df98146766

SHA256
f8697cc4593e5a2d52a22df6139d97e21c1da040d62471e2583175be997ac410

SHA512
eaa7335a963f7a664f5402723cff4fc7c4d17cee80d4c474fd2587c871ea59d50e7a8224e2b2a305ea29e2db0c9d573d594df2952e15344d0725792dae4d5c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db3e7daa4bbbc59b7a5b303b1c11bfc

SHA1
657406e58b0f7cdbc44b7ddaefef3b745a8b22cc

SHA256
d8f0329a3455a737b4997a3d6c8bcd96460a580040eaf4e7bc34dbdfbecb82e2

SHA512
0037363e0024a130bf32c4b414d8041434795cee0e836695de7a2441412b3cadca239007b63540245bbf9273f0ac306cd1de7f1ee48b478270e0aa9d1a3f3c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F0F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F10.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit