9e29a9c92f8ae531c7ede151b9355d87c02b7da0fb5dd8170319d17db3acb100

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42f14230e868c38749a9a54a137625fa_JaffaCakes118.html
Size

17KB
MD5

42f14230e868c38749a9a54a137625fa
SHA1

40b8d865c7dc7fcb7fa75eeb870c4f33f1382fb1
SHA256

9e29a9c92f8ae531c7ede151b9355d87c02b7da0fb5dd8170319d17db3acb100
SHA512

1465e6d9d9fa2da18d556d74a5baa934307a839960f7257ecd6dafce8e6508884e197acaac4ea613e600394cff25fef157ed649b8f39868f2f494240f87eb875
SSDEEP

384:Eo/Nh6bsdYKXaHiHRH9HIFSovJS8wFIGri0PxEvBzz:nVAIdYK1o8az

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000706a325462a09b8af168d7039bbf6d2309ef18a42e4f3f5d3038cdbc63d85ad9000000000e8000000002000020000000a31f769a445693dcd9b45371c2049abb0486a2dae5c7b5866b7ab1fdea15c0b820000000a50532152d9734baef1b65e74aa5d51985df775aa70252da32e57e3b37ff5008400000001823677551b7dec7e59138dd2476637db244a831d14532c90415577cfa3c2bf404d37d8778aff6048fdac1fcbddf0ba18ab3b2af413bc4671c51f875e1174939	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d3612d3ea6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421880731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{582A5711-1231-11EF-A233-7678A7DAE141} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000251fec2754f88138d8e11e0fb90e71b73f1f239a0b996304e38f6b9ab28bf75b000000000e80000000020000200000002ca65dad536349868d4e91497246f9065710e31c8a080212f671660a07be5227900000000ffa5dc4815a92cd559486e33f8349ca1b0f3204457230eba7d698452d4d624d1c4fd5021847f925e5d69201d50ecb2d22c39cd6d94f28d9f60090ec99bdabdd4b5225fdf685f61d427a9df707b636e3391fc3f9018014c490119b324a8e38c9cc035d563a0d5bc20074be7b047e16c5e67a9080653d46fdafbf85ec2b023df8690f579d87ba83ca70a724bf2f152abf400000007b95ac94eeea4a99c3af0aeca1224cb16736e83f0d578049eeaa6382fdb64dc697622b595748b50d33f73363e627db40e4d9dbf8f891d04ff1e7f3296d4bc993	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1300	iexplore.exe
1300	iexplore.exe
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1676	1300	iexplore.exe	28
PID 1300 wrote to memory of 1676	1300	iexplore.exe	28
PID 1300 wrote to memory of 1676	1300	iexplore.exe	28
PID 1300 wrote to memory of 1676	1300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42f14230e868c38749a9a54a137625fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91e2bfda5cb0f00ed759f8256b39d888

SHA1
80af18b7104ca7c238a601e909551fc348f95e63

SHA256
120f09e7ef9750604bc081aa20bcc23f23810a7534f3d61cc597239b84ec5bda

SHA512
36f6addc9e0f44a490f2aef49d5db648fa9567574753378767910ce076645a3ab9227c925545946c0e406aaa993be9a5085a6875b953078574c00366f9c5e47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0789fb74d3c0ddf85b04909456ef5ad

SHA1
ebab243c00b80b4374efd941dd82d542bfa1331e

SHA256
2e502c2f6f9a647a52b8e9be0ff34228015adf30c296b2adec8d6e2e0547e7b2

SHA512
d00bb9490070dd5adb186903d75a6fddf2cc97fe9d9e91e5a4c42f7929fa3e945d6bd1f183908ad7106ec0c28d59d9d62e3587d86db467b310a835f2db03a30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f5a86eb5e3bd6b01a39f426e3e9445

SHA1
f2ec1893027710eb90c4df0671d4b71b0eb2dcf3

SHA256
7f33217f56a74f70ed97a759adf8d20b2080dee34539109dfc284881d32ae733

SHA512
05edb61c340d8b0d49786631037e3bc5d159953abb8b59a9fe9ac6de03963fe56bd0714f447c8f3a8111ef76afb85b03a1f6b43c79263bfe36bc95f79964f786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c22178abbaeaeba677a7b10b157b7995

SHA1
a361e97ac66364513d8aff72f9d004274992c832

SHA256
6c9ee2cf9c2f2d2dba3733e03a9a7b50f7725676baebfd9d94ce81edab5275ea

SHA512
f26a4148f0b4e8e25283dc2d2f8c3b73a8a45ea0baa365c20c87d342d962b3a830978aa85e0043bbd8ac8764a9f6e261d0b0f7434b515709a54c7e374ecfa774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b048d4830e55a41e70c0a51a874d385

SHA1
b866907f503a25c629ef4300851f8c26fc5e47a0

SHA256
adb865d138188df90ab63a0b7a50e74071c53513776c75be31e1e349674a1f12

SHA512
01caa333aba14ca5f1c7e7d4bfdce15ec5051b81d9e8b8589c5a8e324060ac485f65997ff9e51433d78212de5143eb99968f58cabd8004192d7e79c8d85bc43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db8c4fdd2b1dd80c1d7a53ce52b66e89

SHA1
77f6eb151c724f6ad6fdac9df4b26772157f6218

SHA256
e0c7e96f45772eae916bcae8f2f94bdf65b09cdf291c82d80a0b89d7bd007719

SHA512
c05688c75d335f3366c1c324ec8dcc30a7624e85cdbf164af0ea33d623a1a2cbff5457fd6af31de9fcd3df2bc27f30a4972c7b3e977cf32f385470adb80c868f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e887695d3e6fba2657505b5b41354042

SHA1
3387b057b46f8af07f67f66b6a987926565e967d

SHA256
1bcd38b3b4da4817d908ea23f60a7c08957d548d5d635094151a27414b173736

SHA512
986857429d125e8b214f27a3fe9cc226bcfbac6b646114e778b0428ed00ce6cf8c7e16da8e7c611af94ab78c56c2e6ded366ddbd22b0e9bd6ffb864dc47d46a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bf4f0e93dfbfcd8426d857978d9419a

SHA1
eb67d4d4709fa4296d2d6b24affd2f8893b72b67

SHA256
526dee14c8603497a859bf11493d6e72b129305f5f93f95bfefb1d06c03adb4b

SHA512
afe892fac6343fde0454f55142ce3378718feb09c49995c0dd536e71260d3be7c64a32a57358060ae67e4561b84d8ab596c3a4ca2df33895044ab0147b27c969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee341115ae7de56edc4945b70f98f39f

SHA1
5c5d05089d07ebb6a64ccf6558ac2f4da05b2e24

SHA256
8d35fd05954582834b0a5b807d43653f682a5a2d8c1fff4db78d05686274748c

SHA512
5fe16b6eb686bc6ea4c08bd72026c70fc1c14ef3e1e6b5792aef62a70e280c8b1fc39052ae91c2e5cc408d2446f4eb90d4e7004ca985825d22feeeb2c0eae5b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3084.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30A7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit