42c4233c660600eea0007952147d1aeeb1c9d36a81b00461d9722bbc9acd64de

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a44b37431dc585fa7e61aa8e4ec50c_JaffaCakes118.html
Size

139KB
MD5

39a44b37431dc585fa7e61aa8e4ec50c
SHA1

211fac8eb0418f11d468caafa7a95e069205eec2
SHA256

42c4233c660600eea0007952147d1aeeb1c9d36a81b00461d9722bbc9acd64de
SHA512

f0a5080521e19940c94825ef400ff9c6b608d9748386e81f72bcf93c82c3b3278e6f8eda3352cc6df3deaad2ac8bb58ad33541c2aa80017a7ecde5bc683c8c41
SSDEEP

1536:S0jnwenl4XNyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:S0INyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71BB10E1-104A-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421671606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000019c9d3ba8640d1e755d88908c59901ce82d04567442ca7a7e6ade34086816dd000000000e8000000002000020000000268cd4059f1ea9f763e4d96df216e9e4cc3b3bbfbdb7101eb21b243e3f00dd01200000007544625bb02a07633111c210144787bc2be41cefed1209ee9ad4b9a2d513f71c40000000c4d6c39e2ecbd44e6ba2a363fd87c4da2b93eebe5cecd1460e0115715ceed43eb1cc778117ccc0daadd9eab9cf0e703c5c4855341e3a0774644eb3355f5042a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a52e8a691025e96a452c8a802b07f2148d380972643595228a3372fcd9a3c12c000000000e80000000020000200000009fc8b4ceba956c84e27e2bc0bccd2f40939ca6c6c32e6d5a23ce650e223608d69000000050262ebd3d0a37588b1c37f57470752b615b17183e74516e4e5f809c5dea088ac135822cad7108bb262ce9d09a3eb1d62353bdb104a5cdfa8636e8b6b4fcda19201840eb055282cbe364076647774c11031bfedffefcda883c6b3770b9f2b60bb75462e65b90552db444fef2655a2ae69f816a27c152b315e18030d4a0062da8df8b61d850b35e292bdde5d8c721f7b440000000e1eb11b0d96c88ae86e46db1a8404d8de61d32662377228611a3bbdc526028e4862936a09b5cb34394868314d2e5ac40a931d0312039407f0931412ec864a548	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1081be8757a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
108	iexplore.exe
108	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2556	108	iexplore.exe	28
PID 108 wrote to memory of 2556	108	iexplore.exe	28
PID 108 wrote to memory of 2556	108	iexplore.exe	28
PID 108 wrote to memory of 2556	108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a44b37431dc585fa7e61aa8e4ec50c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b62de92f4e4fc5d687a6b6557c7c9c

SHA1
b228d6e6165cea59353bcb8b7698d564e05e7067

SHA256
d6034638b83b962f3293a7a93483341cba778f3808e2131d427db50fd11c71f0

SHA512
134f379dc97584b5bc2fb1cf4c1790033f548877f9b4e2d60f183e96bdbfb272d0fe0411f3902529426b05bb305478969b124cb1a5970ceed4316b33438672eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59565c3b364d07bb352f3fb8217dbda3

SHA1
1b6dd97860060f8874c4cc5aca36ab32498a8590

SHA256
23e9fde357762253bfc5ce82280262a58b2c08474a28cda99ee1c9b9051cd3ec

SHA512
eea0a1de477239728aac3c7040f5cf2dc2c3cbce2a155afd40ec00919ca736ee0f8a92180283052da7a86138e6d4593bcf5544d3ef20510ad97fa7a2309a583c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3be4249730a345c666dc360745f83940

SHA1
909c7768e77e59e1667ef1393bdaa66dafda3bea

SHA256
3ad19bf0b7e6a006b6c5e9f6859a770fc8a5b180cef8fc143a07b42184ffcef0

SHA512
288c863ecbcf3e1ba85b571582fc8de9b1109a380dd60a53afb20c20dee2aa40ab8fe2514997d9c8331a0da8f5820ba489386ddf5ded0896abe74ca9f56db337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54e86d77704aaee1f182c38c68eb6c9

SHA1
db304a84e399bf07cfab6f30c9dd037b32042639

SHA256
a1f1a347c7c47d87fdcf303e75a9ce18eb689b83faa9042241354d38140a42e6

SHA512
531117117e35ee00d42d3d892a1a5c6756bb8956f37da48da7a726d7465759b1d055cca2792c048dbac5f4779c8ebe7494b28e927dda8a312f5d3cc44c7f9cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4dd7c1f0040a28681cba44b6db609b

SHA1
a855a33821429eec768d506d7cdea21ee5e2d8f6

SHA256
c7614f9c5d9259c83667aa9f5d98d4ff180af3b85eced92369cbf1ab40781c1b

SHA512
82042576cb2093a562f6dc6f685ef2675ea8a7a079b111dcf3172fd684791a549674869ec0defa1bc58bba079529d5a693567dbd3b5c66c816e3942ac13417ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3c99e674218ccfdde4f72d99d8298bf

SHA1
c8c3dcaaa28ca5931ff7f926892f79cc861a5ffa

SHA256
9da41f35cb6531938f686c9e193046142609e92aee8bf3f0027b195a793ccedb

SHA512
ac074bceef9c373c40832d83dcfed3e3db99b9468b8887d2395bae2c81508d7020909f81229755011c9434b049b1dd52c5d2e9511cad830197bd613b5e0d8bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e2b25bd09259de547b55323f525286

SHA1
b65ff806e11e3f0aef78bb9701600d2c5c358d00

SHA256
023cff68f3ebf4fc4dd825277889160132b82fe542502e5a7a3d5ab6df19fc35

SHA512
354ce75a84708ee7657bfa626e68827a46a4c66eddba4bdba048e250df2d097977bf9b41beef78c113817a5ef6346a42fb17591ba4794487e3171561b6d9194f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48eb63ab941b2758ea0f38e70e63a93f

SHA1
9fcc9ff70e4f46004f678dd96771da131bf9419f

SHA256
3819be54d87fb1a4f3a0ccfa977111885afae04dfb5eaf3430f5bf7ae8302abc

SHA512
a53638cf160a8f31510743febd347676da76d87e8cb8deaecc93f753ec53cefc06ad9761817136d687da46a7dcf829289a91de95f07579689eab2545cdc3bf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754a816f7ed3f762a0de0b9065efce75

SHA1
02bd375f13f5ec2b9d8e811b1cf37e6ad2c7e8cc

SHA256
74ccc8e7a946fb533b36914eb353aeca18c55c53fb75b2c02723830de49a2803

SHA512
8bfcbe205f7aab3651607c21e5de0c0a6ed2cc20e0a1e56cf3dd766666a614f1f059c345e1623ccff06154881e9e9780e8d7f3e2a8f6ec7d4c623dd1fb43b692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefbaa821cba068196738c8ec6fafbf9

SHA1
99f34b9fc93b74523101302b33c0c61c71a6542c

SHA256
b001a00b200398908c5be0ab691f27ed9ae38d0e11e6e1c8e7de97fb7b3d0bf3

SHA512
b978bf16bb80c732081dd031188471002856859481ed8dc57b047a89362e5d67636a1e7ceab44c62a747e3093877a9f5e1643736b73f78618d6e706245d380f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c25292ff8f1bb230d80d380b58398a9

SHA1
d1617bbfc671625fdae75eaf06ca3c997156e792

SHA256
23a145d354e88e6ceb55c0ebb98f0f1d1ca2ef44ed71f2621ce9d582a6a686fb

SHA512
5af26a57cb9fb692bb40bf2e2af756c9a1aa18f3326cb45ac7d4232becc1c097ee17e0b3e6120ed67103f17bf8b5780cba03cad117e7aad2baaad0921305e357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3076616a79e304079e548d88c1897c13

SHA1
3cefe2c542b5fe3de9fb81f73a63f12ae5bd08fa

SHA256
eab511e2304f3e60365e86ff958859eb5d33a6dc97fd60fc4efab48461ea95af

SHA512
07d0e0c159413f35713fde347f1140061c255540b43f9762e26bf9c3796664d9badc3626ac0a92b210238734d7711f6a623e4761173aedd83fcc4d636e2e780c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebf77a2e74c977900a452d9fbfa2655a

SHA1
a0103d27e0b1e5dedc57eff48b65381521894e98

SHA256
59d89b465ca6ca6793f26e3878574bf2b728b476944c102526728e403a658801

SHA512
43626cdfff230e0bff5b25405d72d03ebaa072530b88ed7891be4fbfd31817882aac51d62b20cb65a8211984fde981bf69f07c89e71c6a27a3cdfc5886ff7905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14cbeed01b81ccdcf66b3b327a948a80

SHA1
b91280efc472d8905d0a569a684e80193427c0ed

SHA256
d8229d8978b07a33d50548679a409617aec6e662dfb8d15abbff26a96c240ed3

SHA512
9725b09e549caf6c4c1012e384ab077115c11c8e60714ccab338cbb5bb06ecdaa155ebad93f36f45443b4c12aa67706e64c635a7d4bc5b63b530797de8f2afef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b8862e696f11e76653fc650f523b61

SHA1
7b9df06f5bfe2aa3f871f7923cbb00d08e05abd1

SHA256
f5a9d3acacda1bbf211715ea3d1dee3ca9133fda0c07f365fd988054e294de69

SHA512
0bfe9983e671011a9f20e37599c1cb5e67cb2134c55566b81d36331e8689d9630cfa53599d6266d2a661d2f2d3f1b749c648c255868d5b54461efe53f9cab8dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DEE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E3F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit