53da48780d471017e66047eeb4fd7fa32172ddd0679de7665bc690c5e397e68a

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1a5dbbd5dde7e58e1c62740e21a85b_JaffaCakes118.html
Size

139KB
MD5

3a1a5dbbd5dde7e58e1c62740e21a85b
SHA1

eba7cb52e56741a213e247061fbe3eb36cd079b5
SHA256

53da48780d471017e66047eeb4fd7fa32172ddd0679de7665bc690c5e397e68a
SHA512

53a01a96095939a16c3ade7022c856c8031db711ac99a512b2a083b8e3a4d3d7fc4f73dc17c524192321c1f7beed9799ac8004cdb13c8dd3d0af73e51550004f
SSDEEP

1536:Sh37bEhoAlZryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:ShnUo0yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E26CA231-105A-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803677f867a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421678679"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004a632427384ca2ada5ca2f77454458efdd54f9d83a7518044ef6389ed616fa3e000000000e80000000020000200000007ca5b704eaa8af177ad286630d50400715942e7ce253dd15a8bb8ca1b135283390000000133dd46efcf75d404869150dbe17405ca93a7eadfe619d7be459064bb61468c80e166a5643e4028f3e943db851a8bade4db12468f39664383e376ff6ba51519055ec8506e34c3b44c7f5d331c8815d66fc22c79ecb7cbc5754ad0a1d2327fd31487c2f3f9c1365cdfb5729c3f089962c30634fc298d689e2a702bc463284d8a2abe3e2f1ca3142c2130788d01ed39598400000000377b628e8d9c4a241cdf64ba1bb84c0a9fc2606ef68dd2d13ad61e9388d61fa34ea7eae549fd50cba34898c9b9973a4349b035fbdbe7cf9961901e563d4eedb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000769f11eecb93d01f761bf99a85ca5b2b75353bff4b777c13c3e3d18385879cca000000000e800000000200002000000000d7bb6999fbf67a6f000ff582dcc1737877e74146fd2a07bb08507b96be6d5520000000918eeae2d462c3bff46b01bd3aaff4c3156d4ceec569af7403dc21390b87297140000000d8a3a3689d84afc786251e2eb380ab3c49670cf3f7fba551cec02f6228689ce96e4cbcfc262bb3c9d37fdf63131e9be9b7af349cbefca5d55678abe114e4b0e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2716	2908	iexplore.exe	28
PID 2908 wrote to memory of 2716	2908	iexplore.exe	28
PID 2908 wrote to memory of 2716	2908	iexplore.exe	28
PID 2908 wrote to memory of 2716	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a1a5dbbd5dde7e58e1c62740e21a85b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0713762a22457a9c4582ce3a520a99d0

SHA1
3c4deed18bb146c50c6344d4713d8b904a945f7e

SHA256
95cf5b11bcf93e26bbb74c0aa5e83f302bd1fb2f6a2c5cb0f00e43d0f499e4b2

SHA512
d4e9986a32b321cdbe0427ff7bc1287b4dd3508b3d11d0b36d388abf42819b93d43ec28b399eb18b6b9f0f3c7ff05f938cd364b012ed31f9fe67c2e971c308e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a093dc54f3963a7771180dc76eb015

SHA1
55e5b70524af0e0c1c9f48e4eed2ac4af9635cd3

SHA256
cfec0f0ef108454fab6bcd0946274dec3716029a03118900c13d30f1b335b81d

SHA512
5870951e30bd3860fff8c9efac64e0083db2b99f5c8742315b4c7c05c664b93e640084c99561a857f402f2793a70998e287c88d648ee2962699dab9bf540f9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f927e9279afcfff2c9ac6c0257b419

SHA1
0570e47e09bfb091b71e25b308b416d4b56c3d5f

SHA256
ef5e802fc5e9b22823985f324b16fa5bc3baa9c40489ae8f4d8f199b3cdc414f

SHA512
b732aa438e5b31d842a5e62020a590789c456630f466a8f86bfdd80fa5c8c4a4c7e5839bf218fcc2576b5a81ac262dc17abaefbea12eb417a487967ae453ace8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
026f6ac489698463936304771ae88a58

SHA1
99c44ed659956e690f9c24a5e00495887128d36a

SHA256
b2dc6b2aa9f1a7b102275c862723f8ea576e34f7e32a9b7cc334f88d053d2291

SHA512
ad77d7988ba965737bd4dd6780f0c27fe74ade1fdb13adb7fb43c0b4ea304d2e7244271df36fb8f348ef2eec9f315a9e5e73f71cd22e7ba258ab31818dc97261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe60fc7544fb04ecf7a3e6b91f0b0425

SHA1
8a5f498419795bdeed5c97ca839dd55df7e7b8fa

SHA256
5749e6954a92640dfd12bd26e38130f6a2683ab5a4a4d8530d6953e3234fbb55

SHA512
7c28047f8b2a821f935b5d8bdd656b1017f3fe7d51fafd30625a4c9ce9337b6fd8ce85a1089e2d1a0b416d40e4a2b91a8561afea576be9f3aa2d10446063d1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2dd6e749a02e1aa386f5d47afcb25c2

SHA1
38cadfdd435acacc3f4ff4b532941a07ced732e8

SHA256
fccaaa73b20bad44f83c369e8427ca62341b10580fb78460633f82bc5885b92c

SHA512
961a4014edfda6ff6ede52a00c9f90e668e0bb8ddb5fdf39736c951aa6fede3f6744d4ac23121cefbf572c897f0e5e08ffb01753d2278f7d3b96c50cfc596158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a53f052a81dfa68b4e2d2e8bf329531

SHA1
32820198352a38d5f3bb7fc988376f9d1add1cb8

SHA256
9cce94f7a5da8a235e61ab9bcb3c629bb44df17c1b2ecb4ae4c21f499c684a0f

SHA512
e50540081fb1f8a20bae74776d66913454f7d9911f4eb75f242c1549f0b1c1f2a691ef39a8a764f11ecd8e9386395287fbe4769debd863931659ec08747dd937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
641913c082b5ee71a121d3ebfcffe599

SHA1
99279d5b3a961294d157a781b5303dd0d1d1481f

SHA256
42b24d2b5c10cfcaf88cefbca9d7a25f2aef4f4668638021732c573b6f4f3ac8

SHA512
f0d1e69e7228169a11b293059ac9873e47615f59181c0bc7d5a0e7ed095b56272cade41d0d23d78538c3b156197453434e0996971811374f45e7810111a55832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1d34aee909ce9acbd47ad1cd272bb4

SHA1
3f6d53ae2890dc1654b173e1dcda1388e46775e7

SHA256
aeb4ec0582ead2392291d7b2ffa0d540c428d074fceed68fa371e7de03b289eb

SHA512
1f2a39b43a7d2e80ccd4cb2be5615df9c247d9bc3200623bc961510cfef699e179872fd64fd498588d979186df28592b79a54f4951f7f2e058ce3cb50996fe4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff9ccac592fd6ca2a3f664c4c3715b85

SHA1
73fb43559a7dd8faa3e3bf13f339b2ed290daecb

SHA256
2564ace2ae63faedc3e2b4bdc9a692f5690a8c40e0011d4a4a0445cc1bf405dc

SHA512
255c53d3dd947f5e3f88e50f69e219a5aeacc42b2c0e718252613796026993b0a774ecd98333b3995aacf739de29e7fbca3ac605ca6e08ed5248e27963820f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2864f6431766d403003c18d3c99c1788

SHA1
48fc536c2615cfa096f8763a6b09d829631bcc72

SHA256
5bfc62376d095e8a71ed6df9decd8f23af86e042ca003c58b987ae5027e6a7d3

SHA512
c6a34b2c7853c928777816b6543a60797e95d87d80ce544b527e9610cb02a86bcade19aa951eb7eb490d6b5f886e10ff57eebf84c91be2fd8c623b5175fbf768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C93.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CBE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit