430dc504863e2393f2b03e92508406c5094e675cc9c60635d4caf1924e68b643

Analysis

max time kernel
133s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3976af38cf2d5fad840a794b7194e9c5_JaffaCakes118.html
Size

23KB
MD5

3976af38cf2d5fad840a794b7194e9c5
SHA1

4177e5f63460b0012812e2cf050a2fc3ce1b75e6
SHA256

430dc504863e2393f2b03e92508406c5094e675cc9c60635d4caf1924e68b643
SHA512

0d12cb48140a2cbd75defa301e08d5c91f0152b90052edb0921768e8d0748688bc1ab8be79c44e25afb8ff8993866bbcb2835a90dc0d689bdd7e9f194bc338ef
SSDEEP

192:uwnNb5noCnQjxn5Q/DnQieiNn26DnQOkEntF1nQTbnFnQ6v06J4RnQNjMBCqnYnC:cQ/06Av06kAeN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000094fc489d908e0b315faf8bce7a1cc224d20a740a8b079c8e61fc053644f34ea7000000000e80000000020000200000006906a65dda3ab858aaf682a21962c33508e4054a1a83cdfe222ac05ec57549ad900000001da239ddd2eaf02246b33fe52f58da5a10bf2eba9b673b1eea79cf3a7d252f667660cb08b632236ede769a8c539ca30e883711b5e8585a03e4dcfd0f6a428fba5b7706237c5b135c41afae0c10efc3981ed06b583e7fe61e8854a2e6f261c75d2145c85155a1a2270fed4b29dad70a9ffb1b615f59c8c1db63548731cd22a05fd22274e4b2167eb5d99b96d9451c8e96400000005cb24053178cc1165c9af320a0b2189a38e163c32cccb137745ab6aa5daf5f963b0ae585ff6153a8e138d999585ab8dc19dd81be3898141733ccd43a3022243d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008fe0499967a92394a838848f3c0de037a9b1fb24e6cda42c3260cb2c6345383d000000000e800000000200002000000097f3ec5ccdb86841d056bc1051603ae336849ae320538488cf3da80749fd1aff200000008db789ab4ac829216ca9cf60fef55dfa452cf05415dca37b4fecb7d43786af6c400000001a80a7a207adf512bda4958d6fae1e18f0ef8e7584d40e07b17b983a68eb906b7e3c7ea2cccc7da5a71ed1d92c499306e08cede0a8a3031db7b58461857f9427	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0662beb50a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421668876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16824F51-1044-11EF-A48B-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3016	2060	iexplore.exe	28
PID 2060 wrote to memory of 3016	2060	iexplore.exe	28
PID 2060 wrote to memory of 3016	2060	iexplore.exe	28
PID 2060 wrote to memory of 3016	2060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3976af38cf2d5fad840a794b7194e9c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83dd7127dd1514a50d333a65273d6379

SHA1
0f7317f3ba9eb36aa70748ed3b2ed7249fc95e7c

SHA256
96d2d182acc72fa2cc46c43ebfc507192d86be09bd780fd9fdb563c27c97bf11

SHA512
b301f8850f4054364821b967370bb38a4b9f9c057b76e3f17257aeae0ba67cd9c82bb978c303251fb510f8451cd1e08709642f3256674a2aa2d2527b389836c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e72f3951b2623e795ed52f57b6d803

SHA1
4fa4d3ac0b03f4a4014e63ab839684f6ff80651d

SHA256
f319fcce3e7577c79e47571734def98494c81ec26219cdfac1e41f426acbe5bc

SHA512
cbdee4ee842309c0f23559b4f4dabe23e30601eda6256b24625b7939d13a719be30f116cd2620ff733e11076c064d38bada59f45d9173caecac7047c5910d42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d56e6a39365f2af56444f94a2d697088

SHA1
d4aed9ec09a33b8fa3ca8c1daf6c7a107238eee0

SHA256
ece7a7f5378f59162838a2fd6fa377fbb709969ef1fc3d1902bd7aa073efccb4

SHA512
1fa7aa8519ac1b89aaf62f24b7c5605133966708193d32864cdc3a485b25e09a8e9e30a965e1ebcf55d2d45742f5b8ec5d4a53be01cb0b8a4f9bdcf589d52e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b21e421ada774532403125eb7d0281

SHA1
e0bb2b440f7e274f5b548f1cf671a00cdff4719c

SHA256
9779a501fd7e4ee9d3970add51decd2c269f3a03bc6b12086693e29668ae5e30

SHA512
eeb0b793c401506691a6b4db2dcca2262c4add574392627ae5911f939ff4f6bf3e6914dc569051bf46130547d15f8052cbead410577dc66933e0cea561fd9672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165e598bbb6ea727a241fa785dc37cff

SHA1
26790cd699e6af6b45b8c2e39cad56e0b91de854

SHA256
93a1a8a210ced3ee15ffd4ef487d4adc3d65a4ebe250bcc2f94788571c6d22b9

SHA512
98dac9122ff91b9e32fa286f308082ef1bdab80bfe7982102e889a6f4065fcc262e9d364d20a9fa2e263f5f11f57172326ab8486c1b45f468348354de804b7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f4d8866172b85fd6c2a68988154d9ad

SHA1
354fc7a72a47ce0c9523e58ddd5879890bb5b366

SHA256
6101d2f32cdf475bfd876f9063d2fdbaa2af4f28a1076db43db610f6b63ebf44

SHA512
a42f95504d91a3ed26d598128e3b8eb5b9aefe06665f2808e59f9a96b273c352f0b84a01007b6b31b78d0d9ac0384ccba4fccb29096513d2be6d18b4121a8ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af2c400a0c5750610750889e17ada00

SHA1
59c0e62746bb2839eee2001b8e8dc023eabe8bf5

SHA256
1fcaec021b2f7376e9ea417f23a8e12d69d51944100232a9c871031eb13a73e7

SHA512
fd62c34a907fb6393d1facff8d763485a024f6a93bdf4295152fdfc98e9f3ee9c687d70a248a0b5f907bcf8ccd56a37230433dd5454a7a9f234866c098139aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ff6a5fd1363a3546b6ea4c1e31213d

SHA1
bf1fdc9fc125f8c0714b3e2c07d22187f06bd408

SHA256
8627691ac223a33fa05e1966b36b9d46c90d1ab11b1392ecbaada69f671942cf

SHA512
317771d5b78b12b6f65c6e20fac6d78cf529e7d12ff2d8e4c9c64d9b008f53f0061babb357b5c06101067a025b009f185b2cf8e2d58a94693e559be747105651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6eeeebdaab24c2b248b55d3e01f99a9

SHA1
44cad56c694cc58c6b261db650269a03b442d51e

SHA256
9654049f249a0e69c4343e38444c089b435740d397e69c758a7d19a71ac11f90

SHA512
d04c47d1d4e863c042b4a63fc6460ae58353129ba487953ee6a1eb7486a8b7fe3b5c929ac48f963720219e173b7a0ee4acfc865784173fd5815cb0efd94f4618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e1ad91a4f2fa35ec3142a7b42d0eec

SHA1
60993fb73a3365d1bde7a703dae1c83990a4bdf0

SHA256
717db0839e084a7c7d57802bbb7b48207f2b550f634d93a9d5ba43bdb0ba54d4

SHA512
464552e64c7f49115c0d35bf22e398e9263afa237aead9c4b22f6a0ac0ae55c225491e473d610ffdb41074be1f5a479f44de3bf4385bb92bf75981de14d98e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39850a40e2979b920dbb318a76254daf

SHA1
7125f8d673cfec5658e2e67fac0ca11b4d0e6a96

SHA256
739fc6c4a4e037708ece563a0d4a612f5cd8388fd90223b6443a28b2a6cd1b73

SHA512
5245b6f59d3584b2a312fa25f4a88cd3b1569667b30566e8a046f4c0bd76c362a41ac7482637911941e1eca6f027ba3e88491070ab7074209c2c996f6c8e146f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2723.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2784.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit