179d074ce23ce08cab539a509169f967d5578d8ffb256a4a55f985cd1b1e288e

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42e9ca4bdd58a5950c2224e708b67c5f_JaffaCakes118.html
Size

43KB
MD5

42e9ca4bdd58a5950c2224e708b67c5f
SHA1

05f9d272f022a6d34b873ee604bf61de21bb64a3
SHA256

179d074ce23ce08cab539a509169f967d5578d8ffb256a4a55f985cd1b1e288e
SHA512

5ca8a6ef4623710f9dbe7267e4814a5d4f5ff13d0e17d47c8b342f6cade1a55bb61b5fb3d00f42a0a2aa0b9010fa1b7a389caf2c618156e75aaef117b95fe83b
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstrFOs/wOens:K+vt+0U+v5ikH/iOgOHFnYON

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000dbb0c5e430c65de38cb0ea2150a62dc9dccb9656f908c236e3d591d2dff31b4c000000000e8000000002000020000000b28f2657880185795fad4b6082012f0cf33d87be2178dfe39d39c5f8f7d82c402000000006569ec12f87dc1f2f09de82d13ef5ba4fc67e8a0a1130a36bfb6ef893bde893400000000350e79644ca6889433076e50a8b8c92726c538ad89c141a90eacb3b56616328477164f0f9e7e3c71af46c1ce42c012ab056d41a03627adcddab02ec5a4f7771	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2DF3A21-122F-11EF-8D50-4A4F109F65B0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009ddc064af4ca593c6d90e1fb63088f24e54548c63618774ead705f88b0e6b5c2000000000e80000000020000200000001852fb0d507456429b3d29fe9a0a720a358521698fccbbb04e4f355bd288a01190000000db5afb549477e2093036062947b49d9c3e64594a6be972760f31f65a4292efb1af756c1be4123f8ca66c17cbb09187f8afeed8dd3b642f96872950f1a522eb0898542aff720d82a5725fd927e3773ec14e356d2408bdd86022f79658618f24d8a1faf8c7fe42a465ebd0b7c0f98b5187794b0a08d9ef50605e95bf954f260ac4892c244a0d262732bdad6ea35efa919c4000000002d1c477a383d3af43e20e5803273ba86142a2460db3f430fc81a1c7e94b1629ce5a960dcc5b92950e29e0be3f7d8288ca94f366ebbea935885a58e89bcf7b6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904ce5793ca6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421880001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30
PID 2236 wrote to memory of 2340	2236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42e9ca4bdd58a5950c2224e708b67c5f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5593ff65943b1ed5edcdff61e5e5f45d

SHA1
66838e56292b25ba5243c3ec3cc14794d11a35d3

SHA256
58869c12e4786c6e6a63f5720b63d37ed341a8c58048d2c7eccc6e18e921838e

SHA512
51f92546212a1e0bcc6ccd8b00947bedd7138be93bfd57ba9515e9863d49775d48b83eeb781ba021f41c39f051e4fbe9122a25732a3869bf8dd37c35fb7aad8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f412c315d1dd2379ad0316bcd4ef44b

SHA1
12f2b4ad75c75a75b78127bd131f04129cba2377

SHA256
8ed79628fbabdad9da4fb665c6f38bf797df36aa17097e4dc11df82121eacc6a

SHA512
8c84267ca5de622d1e266b9b6cc0cb07d734515b40cc150e2003da1459167ab0dbe8d1b035b2b973fae8455ab2783cfacb84f8926362a22729ef768110332682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1794cad89bc0e93a16cb9e3914520e9

SHA1
ffe8362c195b3f5ed894b4b489c6c911c86eeed1

SHA256
253c2a4fbaa11cd1904938d75cf68fbe73141b3cf08f438418cb320368e15e3b

SHA512
e9d97708a5fab97facbec4eaa703063314fd9a1fbc38d87c3b4ece2aeb5271ee8275cc542cf23f17f3aeb0ce0775fb25edda2d443516db5a26947c04bedf6e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
310857673fe4a1399f1d8215c3861d2f

SHA1
1fae332554ab7e759368fbefe882f4339caab8ac

SHA256
c6a06758467e1d9178f073c6f6380d9574c5eaf304bb03d99212496265b6d28c

SHA512
bf397792e981881dce3796c6cc915ee5d3e2f2885b1ed79dc23916758bcfe09d53bfba2918f7ac175c0554122adca162dd0a66013a40260e4dd0f49cea57ac0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58d5e992d319c3059d8b21f66c9485be

SHA1
8115794cb8445580b56876d2541f4f0e53d2c58f

SHA256
609fa094d564ce9a1bbb606b31775e093b201ef4f59e03e366731c9f31c94c27

SHA512
22b031925c70075ed27f94a0353404f53971fbeca38d8c893d1a45163bd50ba702c74f9a1acf4e6b1e89713acf66525a541298d2a4f576529bdca6eee9654d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d55bda0043119ad55c28dbb851d81ba

SHA1
e3f1d1c940b6fc7c4c4b69cb01ccdd66775ea4bf

SHA256
90e6b33edc0e815c4cc60a76ccfc2481081406e98f2ba2eaddcf2fc59691a89e

SHA512
2ed1561d5586592957bd1c37181b6670db9163961832fbcdf82dfa502a35041ef66a1f19a3cdf79f7585786c577ed593c28b0a67a8f7ff0467fc9e2ddf76497d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c210ef5248e1b1f69e9663e60c5bd6a

SHA1
446ea966b24f70acd3f4c55aaa4a8ded4b09d3dc

SHA256
231c45a909cb8ed42b9525f297c10c686eb50ad71c62b3d404ccaea8e9bf3cd0

SHA512
1375dd00432d8b9809fe8c92c199783d8f653f6f024e3c68eea3c657950aa22af2bdc465be9a3dd10ccfbee92e8aa5ca0334a46db320ed7d005e6e38db3fa951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85538aa39caa45f03803af30b1d656c

SHA1
294124e3d75761446fdd8e365d855041987b74d5

SHA256
33bf10fc6718c4f0d7ad6d53f19be7a2f634208f3d43aa2c367ec179f9028389

SHA512
f6bf88dc3b5c2e332f2cc03aaf1d0aa2401890f013fcc25545d0e106da3c85d4a6cd746e617f32d4db4ce488869192982a6a68a6ee20637544c21e04788cd25c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d50352b455af21bfa04dcf8bf8d6ad

SHA1
33e60795c5d3104a74d423586f941767cfa8028e

SHA256
062bb7d80d3f6e913d1883e71efd7a17f1e67caf29dcf9e9d8e2b5cc503bf930

SHA512
a9d3edf28dace6bc15442f3a1b27076d00ae6a616054575870521e48d2aa967e372230ff7646ab07366185d834035823cc4fee4f434a79e5f576c85262ed0fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0141c5bf5ce4d4d621f2f8f890365345

SHA1
fdfe799006c9aa427e93c82c3eaa36e822210b89

SHA256
630889a29e7653327c4f4980865576b9a4e6bed4da6887ed3676537a1f89cb2d

SHA512
e0996b14ae8e6a9f19d0ebadce3a372dd376b5f656dc9d39c5747e186ea3db3c575e6151a7e906ec7213daa5fb9c9d704e4f672ad0243f76e7bcedc38c833f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4111ab18655e5fc466c2006da2085235

SHA1
55752040280977855de6efe3ee6e82f6a16242e9

SHA256
2ada156fa2d840d6cf11afaa0ec8bbf5f8d585e622e016921daf6320f1581bd0

SHA512
db644ae1f0cd3cb195b398aa4b7567f1891eed5e05841b23a84f2ad2af77ded5642b2c60982bf34d1716e95d3b68f67b5111be13c91f7d74ee6d6dd00f4a8128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c6934de5a64c38e364cb1451d86997

SHA1
91c8e819d321da291f92ff57e7d73db3181e03c9

SHA256
9a0aa32fbac659f8c03d1402edcd1b61ee13652eb390cdaac91022aa3adc20eb

SHA512
87d4adf3df8acac02f9f697853132b8eab0d3ba71d8fa549f2bb68c6c27bd1eaa01902f62975d40b458d9413e79e0c7f4913c489216bd42b5102a9a1e1acdda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d467f176241063e000cb14713808dfba

SHA1
7006d8fd0ea7fc428c3b87adb9aee4af2355cd46

SHA256
f99e08f322b9c2636c59c360fc0dd367d40d95a1366f66506da84c06cdd37da6

SHA512
07aaaa1bb3865410ab54dd15b3f6566526b134a96a61c31dce1acc9a7f7fe122085e177a6ecbe046f4d073bc6fdda683b4e37c3bd782ac6199922a6463c1cbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31fe42177765fcc0902847feb4d9ef03

SHA1
99bab4680fde230323642920a2fea5ae687ea9bc

SHA256
1f553585a35d072a6561dfa1be9abd2ef466605df93e901bb311f5856f036638

SHA512
6a9c1d493744059fb3a87926ef6d7bc37c5c781e7c29daff01be355c407cf72ef542ca7aeaea7d06497b07ccaab97b1b4fc674f2c486b6272eafa39963752268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab846D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85A9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar860B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit