98f189d00443c42b31c587e56bdd36538b094a141d0df1f7cb284e5cf2627249

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4742c4f064c42930dce01a1da3153a_JaffaCakes118.html
Size

11KB
MD5

2c4742c4f064c42930dce01a1da3153a
SHA1

b1b5cde7148f6fe1ebb6fbc8156e6224c1078e93
SHA256

98f189d00443c42b31c587e56bdd36538b094a141d0df1f7cb284e5cf2627249
SHA512

dc069c2edfe64422182be5db58deca05a6221c9b5813ef107eba22271f33bcbf18c254fe2414fb30355c30bb6519a8f9f1b6ff79bd4a1a6033998789a8443fcb
SSDEEP

96:uzVs+ux7aa0LLY1k9o84d12ef7CSTUeGT/kZ6pzeekwgKLR/ZGYhLd7Z3hlVHcE8:csz7aa0AYS/3mSnKLRRGYhLdXPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44559971-3D60-11EF-BF10-EE5017308107} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000007c9ca0f86e5ce509f7ccee4f7401860b007280b0c8a15dcf285a7a57a702255b000000000e8000000002000020000000528c92efa4f436383d8ffb8a1de17e7f6ce4e64b44bf95285423dde326e7249420000000fc9c25f3a9d66d86e83fad4d39faebe788623352365220cb732c5864b31332bb40000000878f5e3d3b3e90bf8a5bd12c095e43e8d0f28a3cd3aec1b5fa72891b1a626ea23672c9c627534a8d79bf757b4a244c043bfb2a50f8d0f5b63afe97a80841309d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e058cb1c6dd1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426628782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008cdb12dfa9af453063576e911fe5294a8bd85d1c7012c80c2900783cef683f60000000000e800000000200002000000078f905a37e06b77888dc7f7c0f600fad8329ab838f7a7d40294746b2a632db5590000000192eb31f889d562cbd1e9e93f0c650617ec70fab30abceea56faf7a70329d46365ed3f3ee10da6c01d6b2b310b315b0bfa25f579b4c00c03c9f7098c350f7b612ef9778b56588d72b82d3edf50500897d7e90ddceae96c9374cdfdfddf3dfe87eb30ff46e5111a0b5a444f3a48c32743052a618b9027f12a613696f35353a0ec6222ef9d205124e1d877c43ad46e569c4000000085ccfe6ca967fd6d69842799db1dac552be91109d811274713c901176c9de5fdcfb497713dac44e15b7877558b9b3651e6924205a3950c2e6a6bad36b9bf3b02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2188	2320	iexplore.exe	30
PID 2320 wrote to memory of 2188	2320	iexplore.exe	30
PID 2320 wrote to memory of 2188	2320	iexplore.exe	30
PID 2320 wrote to memory of 2188	2320	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c4742c4f064c42930dce01a1da3153a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de76707ba2137adce24a7fdb8b0131a4

SHA1
e69b3b928d98ca4af5fff73a8f285ac0582ccd44

SHA256
88ed08466e3858647f346f4762b5a92e802a5935ac906e8d00511e0ae72ff0a1

SHA512
a3d118ce011f079c8813bf923031df6bdaeb920c86c83a5328a635730491bef17da6f5e0be52c211e6c22ace3dda7baebea2858d1bf6930551d6a05764bd98e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af68f3678639d72eaa65ffb82a61cb3f

SHA1
ec2cfa4fb28568cf7964633f1d0af832531983ff

SHA256
9b6d0e7e252d2ee055d2382bbc65ed9bf26a2a45aa969db959cbdc2c62793a62

SHA512
6b84e15a5ef6cbe0df33857fe886b41c466fa7554517315114b9b94d6301796e4bf1f93d904aceb503c7ac06b38d94e228eac0b0431ce727e633aa5b892c9e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de9c17b53f834046604ec6bc6c442151

SHA1
93392659db3b1c7abb0b781101dc81b8c66c7a61

SHA256
d6c1f395ee9e3be44dd5b9e464443e75ede35fc38743f770898350021167c9da

SHA512
0afb940e2c3f0860b24cfc1efde40fc07d03094b363ad18185616477ebd6933947869a7c13ad234a30641c580d6d194dc63b9239b65ba58fefa5cff74dca206e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e41c06bc8439449c285ebadd7cfb1b3

SHA1
ba395c2224976dcabd76a1e83bf86c55f549ab1a

SHA256
fd7897fc1373dea93bb1f234525e9c54edca5058950e8b55cb538a85612a9634

SHA512
84f6c7cf726916ab33d77966d93fc9da6119e3b603c76850e66ff67256a6856f5a78f78890ede6153527aebfed1b47f88e3f97141a7183da4ce54c8f6d03f466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
660fac489bc4e8130d97562b40077c46

SHA1
5f76afd56b2953402d7b20c87eab27f19d1deb2b

SHA256
86585d3b2a390d06699ac35ea79325e6beb9e2a8342428c50c003a73f129dedb

SHA512
590bc2a531b0567cf28c7577cf33ebe11ad4d28c92c850f644828571913cbd13861976d27e9310401972c973fd7d910e6e93a360e8271eda0a252982fab04a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7a4676b9cd05bb0a969f07287d7adc

SHA1
ab1727de2b8dc5d9a69bbc43a622f355937e1d9e

SHA256
e3e2a45c00c6d36218ca7e6653b54e3d2c778938112f2403d58c242164afdfd0

SHA512
a36b3851f37d55cea0073b5cc96ebaecc13b30a1a0fecf47d64c3a93e6fa0f6f8d45574036592f26029ebf402f695d3f854e3819b04094db69563d7351f45edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d216703da87d961eaa2fcd5a7a3c79c

SHA1
6ee53dcf8601ef14f585acd69275a6047b27ac8a

SHA256
adb064585718572ee949c87a01973c42357b74152fac2ed2871cee895660c3d4

SHA512
e73c9520733e44313e0309c9b54f22053d9ada7a6a728f1d0cb2684b64af72cb942c0f2452da0f291d472d2dd5c48a7efeaaa2a7f7ce1f0e300c3a420f491aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9646cf139a53dc37f101236c26e62a5c

SHA1
30411062665ea781de6f5ef966f6c8b48fc1beb8

SHA256
3f13e73327fd76de4aaaac9959d2fe8aeb101d88e0bdc6e9edabc7774e0f7286

SHA512
2dba8dfa4424404dce077c6050c3e88fa7d883e9bbc2b040bcac9a75606342b842948e1256c4e70814039e3c787d2185d0062cd7a7c63106f6b265bab9fd3b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
881ecd5cda0afc0bc5ea5b7b4d1cf029

SHA1
625c298423221541c53c822e75c7b607d6ad1077

SHA256
d3cddbcb71cee1199630868be165accca40cc85cd4c19e78676a09da7f345060

SHA512
67e1b52442116c12eb93492b0817e07cf982feb5455adc3662c5555ef467edc6d5e805ce7d253c92f4bc02fe7710fff6d9337c218f7cfd83bd513d0e317fcdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4fabe92e0e1cb7321378e06e36088f

SHA1
30a3d9e2c9bad62c686b46855d2d2fce195628b0

SHA256
b155c65288b4ba2209134e0e39c0601d9fb918f98b827ff7fab1a0ce373ab86e

SHA512
823cd3142f2d914d3e52634282afceb258eefe5ede0c6199d38529670e7fc49ed2189e3d06ce4b4c2d730acdfc91636d166f5b0cf78e562dcf8a8410d762b2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
543f81e6f5db20cc230960087399354c

SHA1
b113f3d441e3f0dee4f542f871771c7a64ca40f6

SHA256
80f1f9329fd69487de0c644f930e9967db4bb4d88287aea68911a283784961ba

SHA512
fe14bf4caafa38d1bcb663f04dc6750b90cbb172ef08410ad4085acc75d5cb3d04eb7b188193c8d0ab33df3999007f39637cf40bf6a31ae220386db2b2ac7c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da67d29d352f5809d378d3d6381c8ed4

SHA1
1268542c4f7fd9bf7fe8592785a701cafed59a5d

SHA256
7fd1a9e8a9db370b3c8afc749b8dbef491e194640140acc80e5e5a1dcb9ae3b3

SHA512
9500bf038739b1821746d602bfa174474a19e074b73a46c5db324c26aaacd14d5884046c7cd4d324ba0a9cba5e5438493be73b3cd80ee68aca775a96e56cfe7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00f45948488da4ce593c05a739228e9d

SHA1
cae0cee611cc86225423ec278e891388585de75c

SHA256
87bb381a04f1f3a7ff1120c2db59413c4f8ee533cdab5108584ef519a56bfa08

SHA512
a3880fae94c79cc993d7d5aaf276281a7e637f651a5926fa6c7ffeae25f1033366f960234bb078d66a210fc0902bbaf692d738853bda14bd148261113a11d1e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f8d7f65570724eb80f3aaedf49133b7

SHA1
40fa23b655d7243ba878a0b4d1ec396f9e967e3d

SHA256
5b0a2325392a2ee4bc4c80ec823f971930b2857c10e6acf4c0cbbfdabc2e46b5

SHA512
0129e1c50df7abbbee17e640369b2d37654e82af062aabc4d2561238568e9819953ad6e51d60e950b8bab50d1fb230e855804730161bdab538530006f2b05593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b593b1d32fba6d7323d594b017b1ae7

SHA1
b9b57aae68c2fbc08b2f55c281c88acf8b0a45c7

SHA256
b84d13bd8d53769b5f3a87d5d6d473a5ce127f78920de27f94f16882a25ffcb1

SHA512
29ab854b3e716ed97da3bfc3dda8f9206f33cff77b631ff932ed69b7c20e57e6911639c0030966d7b5c9df1bed042c3da16c6f0e531f3e98984efc7e113c37d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25f554d194270b86d2531b70218a1109

SHA1
2ba8846d2441d5b9b6c8bad5abe201959eeac02a

SHA256
d501b56f863138134ee19a0b7f28dfd7d0d3f632a07ddfac0071aaa9700be3e3

SHA512
42fc974fac939c93db82a690568ac30df977b6d5fc065d78d87c62a18813d6b49e69c71aebed46f64bdfeb08afe8bb092ae28d1b94ef2303dea72cb397544b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a2e90c218da1477392895389da81823

SHA1
8065d047d22f3b1c184d4ac97b1ab367a6658c0d

SHA256
259ba0f292a2d24bbddc37a4bd7071faa93a613be4ea5e8b067856eb4718eb15

SHA512
adc105b069d99fbd158f8039b64667a31817eae64ac4b8442577929da8d04b70a7d0c5e72babdfc93b63e109e5dc1029ec82b43a3ae5fd2c1d3cef660c7f7a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4FC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit