44fb0ff1e2cf7adc0d333e9150f414134f804b656f7a133b80c9d41d2ec7d260

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c42051749fbb3ade942564a045a5844_JaffaCakes118.html
Size

213KB
MD5

3c42051749fbb3ade942564a045a5844
SHA1

bfdd6e52f7f22713a2d44605d7511fc36c72012d
SHA256

44fb0ff1e2cf7adc0d333e9150f414134f804b656f7a133b80c9d41d2ec7d260
SHA512

4a5c9e3091370b05a72460e27293a157dd3fadfe3a51553c69d4154991dfe5b4685248795ac683e666a2aebb4bb9bb56ba6fe5b65188df7009df5577e6c4a775
SSDEEP

3072:SJg5mhYdyquyfkMY+BES09JXAnyrZalI+YQ:SJlQLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDD389E1-1158-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421787810"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1300	iexplore.exe
1300	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28
PID 1300 wrote to memory of 1784	1300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c42051749fbb3ade942564a045a5844_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff041a3ec7e24b0fc6ff7e03158571c

SHA1
a126e34f4634c13d4ac5f445aa9955691ba68445

SHA256
d454d04252564e5d73e6e0b98910e9824ddfd19bd53f6746d45c00cad6d15a7c

SHA512
2e32722cba87687175e75870c0ce043c7a2edbcc5713840b1185e1ed4d351a1fc5db58e3c0b998697f4b16da80439f050bf2019ce792868fd27a367c60462aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d2b1429d799c576b700882ff8495410

SHA1
58eddc4d9446611e3bf9806360ea6fe98d9dafe3

SHA256
d0aa7b05ede92e64b005e58d950cd06babf613d0ed8f8ee42ea6a6f94cfa2bda

SHA512
4fdfa9cf5ee44c051cd5100c790b66be0659af4dbe514ac818ed0adfce5dae34ba880ff9e3eb88056b2ffb2e8540f1fa656ada9c345ce896a163c45a7946909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29e47cf713a7c27a11e03ad8c0ff3390

SHA1
715459072727f82af445cb665243fd306a2c5cbc

SHA256
a3862f890eaefe03ab9dab150ee588b930780b10e1460534905c91c2b789352f

SHA512
8bda1b8de10753eba56ad10870a8bfa33bd1f1aba10d68aa88525792f57261496fd32254317bc9e21e15e44cd22fb388979c8c58b043a102fd32544711f77f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17dffe73d324966c782b9c8e84056aa

SHA1
ca42b808e5433b4d476803bfd07ce95378fe3bb2

SHA256
f5d67b27f0057caa3d3896837761b3a8a8f48dc6dcc7dc6790ce3bc0d4bcc307

SHA512
67df0a57d019f7cbd6ff422beb4dbb9c6a1c729eb8f1978b2d59747aaab2fd1f042cea1e39944c3d498fa6007053ff83a62bbf9a8c490a961e551898e0b311ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5473d96542bbb0070420fa08bf6c33e

SHA1
c96cad78758b6c0dc5b29f27711fbe3d61549fef

SHA256
52627c061db08c826ca44c165d616a0444a581f5d8b730aa75d3a40ec2aba7e0

SHA512
dc63af3fe240f7426f63cb40020ff32a77f3756fc257ed31dae1e81ee702c920c221126791890ef6c2679389c9b39dae304f944223f57b30ea17979213212486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
821e2facc8d45d68131c55d7278f9d86

SHA1
60a8813b321a9e2e36c2ebd482dc13ce30713f94

SHA256
436ffd8c700d5d4aa984b4b870afde194d067753e104c91cf1e9d01a10f20605

SHA512
84331f06b8ad944361157c194f1c8adcb128eb640682b8b9a6fe40700515d1f15c3c05d5bac56c81b4d45c69872d68da98a11cadd29a6cd55e213f6fe2021964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87bfa6539f51e1bd8f9dd5fab6ed89b3

SHA1
6d0974470ed1bb50952e01be64c70bae8e417d71

SHA256
2df17ce45ce8ab4813a5d3b36915006fe5cafd6d023247bfbe6589e52d120db4

SHA512
ea6b11b9843a1c065414fb342e9e75ffd7b49c9751a2448fd45fdc2ad3756c262ce8983cedd459b3e00a6aea1d397ea0ba8302996f892d89746588961930c15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829c21549404f935184bf7fb5666f106

SHA1
4374e42315babd892508c6a1c457bfd28f0ebcaf

SHA256
856ea8d1eec753ccf8b8b249f92955068dbbea706398ddfac806eca776fec3ba

SHA512
d53c0aeb1a84269819f5e08992c1080b9774f80e8940fd22f66ce9c0a58d3ab183a187549c65778a5b32f207d1d62d291b46fcb24d26630cc3b4e9690b817b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17029192f6b3df221c4dff95df03ecb4

SHA1
225c95e5b2cbed0520ef83670e3f1df6eb6c540e

SHA256
16fa14c4ac190fd518dc490f438065d47fe6f21d0f4a2e2584b526d354cadc4a

SHA512
2cebf4df13cc68ef4523408153634932c781f5a04939a7a8b498babe437228d4c3c8f4a60f85fbd1c52916163ebac0c068e64c9d0df9e7db12ceb71ef721d4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4fad820906f68528eab4e6afc96c51f

SHA1
4fe40e1a1e614bbaabfe0601e650f8b28666dcbf

SHA256
f75d8ea9f3ce73776dff9fb8597f9fc484cd794976c4b86191ed36530bc1717e

SHA512
5627079ee63313ca9c6dc9a6f84c8a673adccd25f05372d5e2156aeca39dd7df6eea35f2232f6b9b05334d9c765c3f1976c42a8b300f6ec87de7c66e8934ba07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7647ff87de504568ac65d9bca6c03c

SHA1
aff671a77a702b6ed76c9a51b4f14f3772852e19

SHA256
65cdbbcbc03544337da2848b1e0908d5c4ba0f00428c8fecdda65fbd3300152d

SHA512
ccb3ef3f798cd30f91d83ffd56b1491c79e1d50c5478d74f80f8730002a1e2f17f9eea9e919bc1f06dc61525ef7659fe8157bbf63616b09103402f4618dd5852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d029583bdb9722046dedec693596d32a

SHA1
89b86f3f4c84b1a4d7901465ef1cdb6987610100

SHA256
ce68ab58006ed609a529dd5a1fa91dc0f68065f26a7dddd04cb21b1a23b1df3e

SHA512
efd7630e035dd09c7ff57b732a472f962757ffb891817f72003f4e9d639732f5579c4661fae6d604730b36bd63a584481052b72b79bdc95c2eacabe68ef9ec4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f922d5cd4a979e4f17dc0a82c0be53cd

SHA1
68f3fb63f4d428b8c4fd80377078187fc91415c3

SHA256
759eae05852c39b0ffd60e06b61a9a24e5584ee44c34220f4b3e367fd70ac017

SHA512
0c80e5b677a36769680ade08942c1c8a79b42c621569c3993ad4614c261d325bdeb6eae221196ffc7b611162e8544c1326b582d2060d4c1492a2b2a5c31dfcd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E0F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F9D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit