3a1e6178e7d73f0c2ca95fde12359afc06dd271590a58e72eb57a25a8730965a

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html
Size

10KB
MD5

39a4565cf50572a2104b37b0b970e4ef
SHA1

bb99afd0f8d803c1d4846ed63ed908c79142ee23
SHA256

3a1e6178e7d73f0c2ca95fde12359afc06dd271590a58e72eb57a25a8730965a
SHA512

e1ded895ac0e42a830895d8fd88584631917412423a33229a9909729aa8dfe4473a8023d06ce6323ed6b0c489889d5bd7a16e3f083563b82b25cff76bb0ec752
SSDEEP

96:YiJbEWOWskSgaY1hbKOkROstquFa4h47VSGBL2jMZXTDNmgOWyE+hs+yJDTIjV0W:ZKLRvtqufCQGBijMFTDNGW1+2Q9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b841d5b8308d7545bd101f36ff73d411b1fd717f1fde5b641e697a60c1e1cb8d000000000e8000000002000020000000924d7e47dbc1257e83a2efd75f9f8422f0cb9b24445a8c26c17c4567aff7b9d9200000006d79e010d787b5b687272a598ff83679c2d918f206e1b6dfcdf4c454c9df94c940000000c82b525a148a212042430d830f754d3960449aeb86450dbb385f6facd3f22215f69fbfc0cd5fa45752993c9a911c21cf7cd7b2762a4ec01051b7b6d734f2f821	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f036ea4857a4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009881b91da8f428ec0115f3c8d244304c9e61233c2e1db0f34b28c289697d4dba000000000e8000000002000020000000911ca05260bbd39c8cc787c08d19b166ab3612aa9d42a4dfaceb33bd9204ee4190000000ff1b71c4dae7cbc034aab031436fe8b822d6a9298ed6cbdb612bbc82709922a92e29487fdf29ec91230fb383df0506d1a23190f727738971fee53d565f56bb0ad6c78033cff995c1bdc13cb134d3338dcdaad814efc34b07d97f7126ca8c09f5e8287be8b5d326a4bc54f4200abc0283ada19d2ff502e21c3c173852782f9e6fa077bc1bd0f271d9fe7fe0c1eead74b8400000008db74954f3c88ce9aed8b1dbb186d13b830312656c9657c622ab9528fa7cceb19ae114144ff6b225f65781d9ead6b982d3bc6bf0135df1bd6c35b6189bfe120a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{741FFB21-104A-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421671611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28
PID 2928 wrote to memory of 3052	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39a4565cf50572a2104b37b0b970e4ef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a0bf4df48383fd73c439e9f6b5404a

SHA1
f0cc9787300feeb7b2e83df630db404db5674078

SHA256
953f53ab7bdecb6289018f8d1da820fae39b54eb27eece2231fef842cf3dbcdb

SHA512
db98131ac8f03fcc2c880ddd6958891d5debe9f36dedeb47a359d1f633144a12c89a47c742c5aeaec9fbe9ecc28978452de73979b2d1a3e611b19a0a40bfb9d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
416a0312c216f6da979f97ea43c3403b

SHA1
12c05b800d4b9f8d0c29a15963831d3964152114

SHA256
c8503210ac85ddfbb649bae8ac84e559e4747267ba25e85490a471151cf850f0

SHA512
381b4a9c628a77c6e33236a011dd4b6fd45122e8b05aff7f1e61d07657e062f41e26deb3bc7d41a1f16e3db4ecc986653a1e4ddf86a6de9b4ef468e4fb997f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b98cc20a9e2a27e584e20fc72b9bc795

SHA1
ea5aff55774abcd02dd2d716127f2c8a695112e0

SHA256
615ab7b41cbb9e1207496c6170e7a9c3b3d14aa13934487906721bdc99b565c6

SHA512
5d59731bf49d8b97755a1e66dfbbeba4ff159d93923b1505585f3d555940716eade708f453dffe8df4fbb2dab7c93aedd27865221e7eae059b9dc77b5b0b9df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43bdabff189e51ced3ae9316ea5e3f93

SHA1
9ae6923162551cf41ec9affa2d1f230d4718411e

SHA256
6e43fd9073a896a22ba17354203fa5308d18b63c73bf6b14f3a578cba91ed7bc

SHA512
81bb34b71589fdc95710b3585baaddd9bef64fa8f51ff9d91532f7d863b09f7da79f5bb85e03ccc552cdbed9aa9b2192dcf16048c412b9a0482509cd43f0ab2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165637811eddff43f3a58dd4478ff571

SHA1
7d7ef82a9616a3acb3540a7126b13613e90ae05e

SHA256
026d15659253a93641678625eb75c762ea91eefd8b3654af7340315b5e6a1905

SHA512
b4b5244fba4da0e67e8b198e32d224ce43422ec215230282968074cdb98bfb26ab7a5b99246132f8079c1cb8ff205c42782796948f016d205ee6945de6477f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dcfa374ba8811089879ecc8c6b608ec

SHA1
3676d2ee23c6d504d70819133c6bd6ff0b0ab373

SHA256
3189e3173418e3fa35f6b39f43e1b7e181ebc110054406dc0d383be965328484

SHA512
394fec15c1d2545dc01b172b0c0293749adc1f9dae569e28093035f6c44c2851ff3f7e879e38c07915d386d4e741acffe5d23025bf51a84a6d5213ca73818e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
661e34f69ac5ce477707e5b1dfaddeba

SHA1
98a826e944e24ed2b5e40fe6905627f0766eaab4

SHA256
1924effffc7ff76648adc0e640394aa274059bb04ad836429da9267b2a024410

SHA512
b228ed4f15d11ad9835c79acbe426b868159709b31696afbbdff13c7c40751e0ec89363a8da162f2cbfc5868b22953e63a465493acf828c7be13ec96324b41e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52eabcdd5cf5e76dd86c0caba2988703

SHA1
64f31a018659cdf1403655d37c9305c3dc57bf4b

SHA256
a5d63a7def1be33d0e808466dc8dff6f26c0c06436211221ddc559f7483cba3c

SHA512
2c6a8cbfeec6381b1e2e2f102f192cd3f9d53b7f649bdd1bb94393028a6ad2319d41139e0415b9c1d233dadd904d9d5d626609d72d3113d2b308ef1618c50543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1b63a719284dee8b7a7b056f6857a51

SHA1
90fde4261a63f6048990e8752916e571da8f7e04

SHA256
7bccb062bbac179aa2f5e39039300023ef6653dc1c3d35d4d8d9b3ef0a4d2a1e

SHA512
2d5154ea5aa1658bdc9c05721389560e89dd7d53b47edc8793fa71001f463d0b940ae696c3f620c1e06a76e23361786e4d15b444ef3419c33f0bc1ac1b1500db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70674cf5ea75a46fd01fea9531dcf3c2

SHA1
5cf5c7e83d28d2e3802bcfa10a76a19faf3017bb

SHA256
5f0542936690ff998d4d2b5b92420452d186a094a8a87d905ec9c87df88c193c

SHA512
9029c57245c28dd47e8b16e28019dcb1cc61c40359e5a6e03bb60eed051be95792dcd2abcf56f1614afa81e5d20e31242df4215beb07c7c5fe8444a85cf8cf62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f91c09476fbaacb2d64072f6ead893a

SHA1
0f56cbdc868d73bc1ef6e60b418e893a908bb0e7

SHA256
3f8077cf42bdd4940bd49a25ef5ff320ce192dc6f7128694d046f559187cb2b5

SHA512
1f6bba3c8a455a34200a4a6f540f846457cef47db4ea65839e2583c655a14990877546c1115f43c1f2622510c6441adef66c084099fcf11d131d396904f92a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0056355600552119ada2e7d287b4d3b3

SHA1
e72a6f5aaadd900a0f980695e6785c60bc2aa139

SHA256
91d0a44196e238e5eabfaf6d2a56743463e05ab81ba2d76ef0b2d797e7c16515

SHA512
1add4a76692991710b7ef1b094ed41b9b275f8225ed80b407e4130d8f657dad4c365ad589946cdd081996bcd5ae52cfcc19fb33615a2b6b1f3bfb50aaa8c0790

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3573.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3576.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit