3d0f932f6d8a99292b2f3f979cc10b804d19b3835e65cbd88467f49b22ef7535

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39ee1e5867f7cbd288f34e0752b3854d_JaffaCakes118.html
Size

34KB
MD5

39ee1e5867f7cbd288f34e0752b3854d
SHA1

978f962b318ae520a627e95b314240f878aa7a3f
SHA256

3d0f932f6d8a99292b2f3f979cc10b804d19b3835e65cbd88467f49b22ef7535
SHA512

c2b5e6b43e732f9482ab8588285c2fb807531d63493e590bda4da54cc9644d630ed05523b2b738cbce5bf603fa7d1cad361d2e8676ad25b0599dba5595f6e52b
SSDEEP

384:BKZhsOs9nwnzUcUXUmKXHZt/g5rZU/nRxQwIAj3iTEzV:BVOs9wnzUhXPKJtFP5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7A391A1-1054-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421676127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE
1904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1904	2032	iexplore.exe	28
PID 2032 wrote to memory of 1904	2032	iexplore.exe	28
PID 2032 wrote to memory of 1904	2032	iexplore.exe	28
PID 2032 wrote to memory of 1904	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39ee1e5867f7cbd288f34e0752b3854d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5315cbe1192c532f6c1aeb3e5698d23a

SHA1
901545d2442061d8f9e0d28f79e9c5e8ddaaabb0

SHA256
7a8775ba030bf335cbedbc9a022cf27cb5bf2c565d032c9d5402bb43c87902c4

SHA512
e7c3ac321f50dac852b32da982d1cb5f7656728e64ee7a5a564a3824fd5ed8411f86fc68d569ba8c09bb12c938c33c8332f4c6dd7dbe21ecb031661c5dba2ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1f3749b5d2b1a8aaed4de4934e1d4d

SHA1
7ab2025f22627202055c8ff08a06d2772a40cdc1

SHA256
b905cd0b65717b19b602519124299f4b3100166c6afae12126b7c8fe82d4e58f

SHA512
aecea5f4b55be03159ffed7bb160fdbe6230e45e242ded32d9162bdadcfbec61afdc4d773184206154b38b0226a76f9659800abcd4e12e0dc1470a6925b6ea74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e8a062458233a942dab8c47a6cfaa0

SHA1
d9b81ad752e7ad7a21b126e380995ce329d0e860

SHA256
1fe53e32d24605bb0c35117aa7494565e5ae0dcefe7712e2aff62467841541e2

SHA512
e17ffbbaf67a8f19215bd266ca70e651e0b3b161f85cfd82838730ae8121fc26fe39b725c565ca3e1f872cc6a3b80ade287eb653112ff50eb052acd209aebeec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0496a929efcf60c4fd6dec0a3681c44

SHA1
49d1178cfa543223f39fe4bbcf2a5c83afedf836

SHA256
08dfcd0e89b280ea64111dd9ba77497222aace11a232e82a1b9e853a8f23d405

SHA512
2e897a887b5ff664ced8e9bff747334bc02a21a88a81f40ff2804e6e294335171238469499ed41d0f955ae25838cb29d058a3efdf9cda4d6a2f87892c6d7ccc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f5e7b917fa6c93865a00532d2ee231

SHA1
bae8cc5d8d8f820ee873aa8628e60e8cbc228fd3

SHA256
c36542a84fa01ca6afe7e635926b724f890c4915955c98270c58f8353e7d69c2

SHA512
b44ad92963e9ff44b6d3f66176abf5f3eb815420a2cfca3742ba00bdb9875f10de60b2b850cb515ba8b88bc98e93599da95f22f828b62e44b8a1bdd4cc82679a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575e2c1bcdc12806187597e8c3e57e4a

SHA1
3d336511e26b165f4d3f6849faa82e38902f8369

SHA256
d3d25dc677d1ff73226b6a1a4ea7466c4d843b49a027e76a4c18ef136704402d

SHA512
07ac7458ed39d62b730c901472a54987e7aad6a4e0347cea80155f66e9b6bcebaba82576006c56aa1568eea396f02e71c58beda4bdfc1f01815731931c9875e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d397fc3965f817c7f25f75056a4faa75

SHA1
c4af3f411d68e115c69f2dbbcd22c26c5c1faaee

SHA256
f87b0d3abe2fe45828cc0f0504814b7e54ef9f0a293902c18794940bdc444212

SHA512
09cc84613998a23220295a44d7f8ed6de4fd4c365a5f70c61c1b6a7e03594494bf5c4438da4bd71a128a5b004180ee36588f1b1b3163946af55ecace0573c5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0fe264650a4efc631d749c05707631

SHA1
72a22d73fde2eee1d321cad53c12e19429751e86

SHA256
02eccd9a381987c0ec60420037a67d7a00d4a58ebbebe1d87405893276a1983c

SHA512
9339ad8c8b0b63b9fab8c29db379bcc184d45c77ba474c23e4ab0f7b57f7406ba436f9229bb5bc15a4c07a30f9dadac536940af03076e0ea74482d2455ea17f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc36cde0a12b23d8789862fd219adb7

SHA1
8e8cba03c0f801915cf2aeb1bc4ab7e17264dc4b

SHA256
37f10e4958fd720b41769e3a4b53ac2cb649e21df03199a03dee1a9b15561562

SHA512
81d57fa89219457eed114467149798304c65c0238ec1d811e0c740cae73be142567ba8c683afa62bc1c5ee300f2c95ac33c4228c645a3c0882c90e2fc01edee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dbd027163e1c109431af236349b8e9d

SHA1
dfd204e6500a00ffb5fda858ce88840a92055ba6

SHA256
828b6a088794e0d8926d19d108306dd62884e5db9f19b55bc7abbb0934681ca7

SHA512
ee9b51356c4f5bea0e44e7deb5e159450bfa3b3454a94954ce0a06580de40cbba06f6a22018c697fc0d4afce542d40b7952680249456fbfac8c47d00a979efbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar739C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit