39cc13edffc7d13d0748fc58e410a9aa3c6d9802f0459decdcfb68c745392cbf

Analysis

max time kernel
136s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39981ccdb48390b2efae5b0fc6caeb63_JaffaCakes118.html
Size

139KB
MD5

39981ccdb48390b2efae5b0fc6caeb63
SHA1

97e492dc50ac2f582c196acf39b347a1b0526f3d
SHA256

39cc13edffc7d13d0748fc58e410a9aa3c6d9802f0459decdcfb68c745392cbf
SHA512

3af0636c20b669f89e0e5a4f1bb29b57eb3d3eb031cd089efa29ce6d915dbbbd82f8065e38a8ffb7b6064c9def906153c6677702c9f3fdd7009f6f7b507904b6
SSDEEP

1536:ScFtq2IxkltyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:ScFqx4yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE058FE1-1048-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0aebcd155a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421670876"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000907c8f8d70b79ac8186103c4af57ca291715dd26cfda745e611979e9174842cf000000000e8000000002000020000000942835635d391b3922099f5b3cdb577dac1a952556c41732274f3db7adbe69a8900000003074ac2ac2241b2dc182bc829a9f02d1a087f8857690caf5c2dea514ed541d7d012d249b8bc073e58cb1d7db899f65c149a7f2b58778ad9a9b998a22238b8c390c7b84d0f40bb7772ebfbe29331faaab335967406e1c87ad74f5fb39dd1a57b4fc4872471f9298693c61e14c156136d6a2a0ef8362a00daeec734f0a6028db84621c6bdef0ba6a9a6c1d00ef9911be8d4000000011bf401b15266c8715cd492944b450adc0d9cf63e7080239e7b6d3b011a780539f264a7ba8af63544d11ddd0c7005caf935f12232ad771c7a32e15cc4e95c778	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000334896f3cd02bf2e6326d91f3d53c0b9d160402c68a40a0cbd9930dd3887af9000000000e8000000002000020000000a76fed4c1ce332eeb94d5897273fba6de1f861fad25dfed9973fd45b44473c7420000000b43adac4c19aa5786fb632208972be96880093e21a60af3daccda2b1e8724f9940000000d43c9179cdafd85521b91ae7d6255bb8fc7a1f4a8659f65dd80314e5bad1f714ea7604b9c8a6a90252f49ca492dd055ac38c03f17885cb3217522be3fb0d7af8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29
PID 2140 wrote to memory of 2768	2140	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39981ccdb48390b2efae5b0fc6caeb63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743a3f1390748e001a8e5847a0076866

SHA1
662019165133191f92f257cbab7f7477d8f88d6c

SHA256
033231d9f6c8d66313279a216cec2bb1a981644f195b01c021f3bda72d432c8f

SHA512
bf424c887ae2a48cbc25f834ac8a96d18b2279a2fc18a3076a230a8bd2dbe7df65614de890aa47b10be3eeab4b73e7e3c37b3bd148eb6afd18fbda1ed8cf9e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f56edc895a51abc952bfd123657cb81

SHA1
f0ab20ce0de6425e5e33ef0750eac9314ea2a8aa

SHA256
ba65fa5d4d97e09e1b8a1603353c12691f240ed90c894f4dc68bbf51b8bed6ac

SHA512
fd5516f98382e8cbd51118932c7ebf22f41ac565f73dc6180a0d01981766235f010725c9fcf3212310e03da5874a959a41e22bdb7853b7999a742ce2ae5d7122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b763431e113ddcc6d80b9b16bec0a085

SHA1
ffcb9182a991d31888ee03aa6b3da7c9f4e90d53

SHA256
c758e8d98765f2048e5b90d0399bcbc1d32cfea26333b440c6b0f59a4c968e24

SHA512
5b1d7f6da0a1ac8a44b42438e699ec947e774656b1a4976bc3704fa36539cf076e5c33990ea3b5204c4a71c20efc9e9a29c0d8efe83a4ac29cbb86874c53a033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828dcf8fd031fb428f7557514fa61cbd

SHA1
9fce1e8215512ab1fa149b3c3015d50bc26dd4d5

SHA256
981a42cb0b2868ee44667508393541b24df855a306224bda6e343164bcff97dd

SHA512
1afa0ea3cc6e2063963cee436fe45ac729c005971a7e8eca0454d69d6ba3886cd8fd2c9332df741df74715315167da25419d648a41a58dbcdae4e074ca2da426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f043afdd4d068fb35660a5f00097d5df

SHA1
363c7de4127714e043a01287d3aca116ae1ec5ef

SHA256
9038def5b5a25a7daecc4b0322ddfc0fbf581207bfcc87de16ad4214a0d75fde

SHA512
43f2623b967d21ad26161911d24149fade5c25d5830a02984108155a7475b6944f30e0f2c8b32c3650ccf93751b6a008cf826fcb0a92f073ca7cb94f6e260e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
117397d02be96f880fc50e829d5ed0a0

SHA1
4ffec0c218442abb8da5dcb6a93fb1e48939a6be

SHA256
a29638c17923fcb3a10de1ac65cb2ff7e0612359743488fcff78023573bbc6fa

SHA512
138156f8a0fe74e2645bc537d1180ea9de75185294303870546e3e3b3620cab3b490eaa8504d7025f41551459d222794c0ef1eb77d3b4cbb450d85436c169b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
362cb703867664559116d81f3d49d627

SHA1
2d5c70c48f411e5a55ed7261d438364c162e2f8e

SHA256
40e08ecb37fd82a6e1d57d408300dfdc53c2c8fc458056ed0d3cf31c67bd4001

SHA512
09f178ff067d28b817f129478f353bc0cc82ab51d517669c35bd2561cbc1831e00f54ca658b9c25bd885530df3ec797e6cce72bb7278a884604c3bbf21200167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69e7e467e988f6b404ef3b176acd060e

SHA1
13485d3bad36114b3b21cdc90ec9882e42a9415f

SHA256
822aa58b8c6fc938fb9644eaf1d6b60f3cb7aef9341722d57239ced652fe4ad1

SHA512
11034cb252f914f91b711af4ac5a75f4383813370e318044f8c24ae0d9ca750e4dfba3c2095e9704d8ab021eec208fa8342afb88a267d375c5bfc4d1a0dbcbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ff2489f5fbc1a7eb87fbd395854e2a

SHA1
57cc31eb9aaf3e414e70b38b76df75539d89ac95

SHA256
43823d2966cbf95e8a11ea50687f7664913e3014444f1d0cd31c95f53f697c07

SHA512
e18d07862158ac5b9b7a1dab4c41777fa86fbed8da9a5ab9730564d832e0eeb328202fb8b42caac2ddee17b5474f8dc477baa4fef6fc581a782f081ddc812eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76dee5680dab4971162096a8368b0614

SHA1
7fa628c2a9b9811356df3e4335a2c73b4cd993fb

SHA256
a4edc012f29c6aa5af0857c7dd5570e9af94bccc725c73830cecc5f88d022a96

SHA512
5d920bd8fef18738ab7cfa296e76cb85058b8f40b41dea464880581df090d787b60a983da04bb00b78d5e4227a659cff990c37a38acd63d218a08beb47df6056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09aa5743e106fd331b3940ca4f32fc6b

SHA1
4cd5693108699c6987db48f728376a3af24a725a

SHA256
8143292eb8b9ab690e3de71de654753ad49a3966d0c9ef848973a8a8a3581336

SHA512
8d50a9c56d6392c3a165836e21a3bdca8081ac82ddfa3f78a840f69313d59b6581e27afc1cfbfac302b002c04dcd53d332eb802de380dbb42f49fb7249be7823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8534bb844f573cc5b8bc7006d0147f9c

SHA1
4155bbcb86be5da720d4b0dc21caa85eb64865d5

SHA256
94d85a1aa9fd6197e3e803467773bfd834ea6e1ea3da6d14d80495aecfb4099e

SHA512
cb9205b61646933dc8818f29f726659edd9d2d772537b70dbea0aae1301601758a35b2ba449884c197e9303d5f79541ec96e6e178348ca01c32a75432b271637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cebe42f2114c844c544b19b8a3f21324

SHA1
653cd7e3ca7b860d4f23b5edc43d7ad6ff245f1f

SHA256
f81ca4baa8ab6da63110d0cddcf6f18e6030e5df8902e04b82eb96151850f3ce

SHA512
78e68fe82224742452fe079dd19c251184f3a4d6c9c7dd9e57b6ab22ae1a013773e755e89b2c04b4f6c2f9b7e57ded14581654df00519ced65f0269111d9e7f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e94f7846db06f3a9a9615be05ce587

SHA1
946ed7ad3a176464357500addf8acf95f0d72819

SHA256
ab086a192ddb0a3e97f7061f7bd7eb1791da156be2085ffc27a100e82a955f4a

SHA512
7ba285fd67a4b6aef0736fb62e668b5cbcbb73c06362399369f981c5b55ad45d7990ca7360b187e4e28840761572f48feb678c2cfdcf5daa82ecfa64dd89c00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\ads[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D81.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DF1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit