c173d1fafdc433d2c6e02c412923285aef3325932be40fc52722b03a712cd3f6

Analysis

max time kernel
70s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

330302235b135a6995b26de402a6a352_JaffaCakes118.html
Size

6KB
MD5

330302235b135a6995b26de402a6a352
SHA1

912c28ae3e8629846b883868c5688f84b3308889
SHA256

c173d1fafdc433d2c6e02c412923285aef3325932be40fc52722b03a712cd3f6
SHA512

82728db6f9f5074089d9f2f8fe07d4a8ed8c8bdf9d566802f5b55c117f3276ed38348c0abe85f6db23c109e5c97367fcc5fabe3cfc87f28ccd8c6ebad21d26f9
SSDEEP

96:uzVs+ux7B4LLY1k9o84d12ef7CSTU7ZcEZ7ru7f:csz7B4AYS/Gb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000640f027fa949c97624b832c7c4a4664aace857b958663da6b0e867accf2b49f7000000000e8000000002000020000000ac6abbb766af2e66064cf233de32d96f235c034d3fd35554b4e7ce1f5aa13c1420000000377f91e00f470b5804d6a71fdb4179bc5e6f8442e2b0a9c0ffc3268c58e2f10a4000000090320e1d7e90a4349e85dc2a388676b9633485c7207547bf2960859237215fd0deaa4c9a5a2e39f6ae508b41e02786cbf298297c9d240d0dbf0c65b62916ccbe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805dd21775d2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426742168"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e2af0a72c99700f1fb4983ac62a6a6a9362eacdfe3ce801dbf2d558f5cebd760000000000e8000000002000020000000b7a4f70557d09eafa8860b393922690df16ebfff345222fccf7b6094077e4ea69000000096f0edb2cb590cb4c0a4933f4834729f4e2033a5ba67750ff86dd9dab4cd0f755c6374af8e5c6dea310c17ad92559c03532afddcbc52543b4ff11da657b305daad45dbc044c51d7ae40e25fa16d3bf78538a1d862b3a5ee7eba3b4f9f50030e74775164de0d37577705d32eab547453ad7f80aed37333d09d9ac758197ca34784d2f51a319369b1239ff25fd7199438d400000005210f736dd9ec7c0b21b1680973e2587239d06475b6bc78d2c319c07efc13a1d509e1b0f6d64b27252e94b9bb0cb8d864fae8d34e6966df9ccfdd85c7cc1cb73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41A647C1-3E68-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2788	2928	iexplore.exe	29
PID 2928 wrote to memory of 2788	2928	iexplore.exe	29
PID 2928 wrote to memory of 2788	2928	iexplore.exe	29
PID 2928 wrote to memory of 2788	2928	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\330302235b135a6995b26de402a6a352_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a25b4f402d3ede1f80f5e0e3b897c16a

SHA1
e8941ba8cbdb5576f9f8cf8b2d43eed690ec4f42

SHA256
0843443d5999240b97ddccbc3dccc273dc711746705738f0d5c6a60d22f1b844

SHA512
b3960bb40dbb511c71508fe13eb08d99663a1ee4d8050c4e4af37b1b72b393800736b24b5d73d33d78e91d9ca5ef48943788bee83f2a878593da967b31efe17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b39200d007671a0d56cccf33b2650338

SHA1
79c83abaa92518aaadf72fcbdb6a4ac1c06f207a

SHA256
43b435a1db52325440be5a8fa2322a2ffe483b8dc83903fc776a0b77b120a798

SHA512
a41bdea3703d19d895900b948848af74b2442e73c153f5bfff73554d122e5238f20b4d09f2c626bb1e32c0373419d4f2f0cecaf1bdcc8d38acfd41e1e7d60e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9095a43de0c89d09401885a2416d8c0

SHA1
3730dc9a9734560f5db898b1985f93348d3be73c

SHA256
926c0bcdefb7e7b04c806bf7fb54408dd5a42c8feba86a3cc39ef54aa3806398

SHA512
2cae081180bdbbf9a9ea02a5ba33fdc21e99de4dfef4ab0e2047ff708ef391caa7d3682272f575fb823afe0a63dfb0ab2ab4745978fc05c7403c2289fc0c9dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f222124c7b002bb0ac51a2baad39dddb

SHA1
28fc8651d463360c516edae727b8b6360d4f3739

SHA256
7a6b898e010984a05d57f0392c84c9084806bc08cd8fbaa269f15498efc276f2

SHA512
dc504b79dcfaa7b572545d89136266aa99c402d668dd51d9f9e8e21f573215493dce714b2691118f6c9882621ae582cf4c4bb99b69261a8378456d03aadd52e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f08aa628dde1afb852ef30a44ad4acf

SHA1
6906bb1b642e5883faa615c3adef9a99503d886f

SHA256
12deb411ab14258760d1a1c6d74f40543fc77c5f7202cfe46378df0efd4ff36e

SHA512
18ee9127142460a784a71569341ee8bfdcf28e27c3429b6b12acaec20f61e48e2e614435c0658fdc7007d90d366567cd518b454a6c4ebac18f650202f72a5c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
891bc6c7bab15f242ba0fe4b569f61b0

SHA1
df0737e5324d25d386a73b7af65bad1925bd6da5

SHA256
a9761170769d12fa053f8865aa1620272caf32db04e5fdad9abe6b267b9586f1

SHA512
f70b9a6e51d0d124fefdba1d27ac76d9a2f11f7eeb0d467f945ae545666c7433d4a0f83b7216afc069f01b2dc2f6f6b6b58aecd11191442fa02d75a055f3e21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a8a927f2c08d4c120d17887d969ac98

SHA1
70bcc7158779edc6c9a7137fc8b7b85cd8bb704e

SHA256
41e2c2db421ccf2683c73d32183c28fa8c321ceabcde8dc9aaa62304e2680d47

SHA512
e196f478740a86101016afb19e4fdfe8ce8adc01b91fb60e1659561810fb02e7350c63d8529ae5e404c2fe14dbedacb284e15c1c33c1503f5bca1f976510d049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a052620f504ff7528979937732f84ecf

SHA1
c4084e803997de257e68a6ea4a9dfd8b34b6a4ae

SHA256
ca18d4d1e489f1e3eb1cbd29c80d2fc869fb7af723030639f2bd5fc4ba9680d9

SHA512
cebf8fea558d60a7be40c53686fcdb88f0ab7dfe7001a24ceaa06ef3fa385d04c4e11c36ef4a758bf095dd347c57876f9ea3e10b8229f38b5e187d5ea961640d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05da1365d2089e651fa163680730110e

SHA1
18dc2e508378bac81a432126a88b1bd9f13d87aa

SHA256
c4feabf283269c37f4d967bbd26dae012c25b8fd7702866683f030a74b1bb113

SHA512
99b2dd8176967631e03a07f701b95304f3e557ed0afcbd289c2236f2b17d2dc0ed93284e4cfd25ddbb52a78bf2d2139002bd2256386b361f6f77b826323f1a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5004f2468d399c4151b151c0e54cc502

SHA1
18b19a2edf994f66a195608ba47f6b0a6ced7fea

SHA256
a705bf9e5bf768d3a8884d83ce9ef011f69c29d66449dbf1f359673cfa2371ad

SHA512
103b8bcf54d9d9be74934162055130365a783396ce9c77a6454ef78317d6c90a0d3cccff1e727f883c35850b1136dc2c144ab42ea843205b2e7fba769d78c0e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16177defd817f1bc01a7abc345f751fe

SHA1
baddcbeec1f877d11553581c5aa2f8afe11e38ac

SHA256
04744d5aff78a556257992e900cbdc662eaae4a832f29e3c7bfa378717551b44

SHA512
90a3839912a73a0c2239ef663859e86106a8ac9b8d10ac557bfda3df13ccfd434800e78ce4010872a00ca265f0222c9bdd655b6ca85f3ea27bd02d634dc9d44d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F56.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2005.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit