fa7f8c27ccb503be9d416228ce8dc513c014eb47a5176cd203cfc6acb8886b00

Analysis

max time kernel
70s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

338bc9ea99c352ab29574f7f79e52003_JaffaCakes118.html
Size

2KB
MD5

338bc9ea99c352ab29574f7f79e52003
SHA1

5c0c8921a3e6e24a850a82ea69e653ab044a8574
SHA256

fa7f8c27ccb503be9d416228ce8dc513c014eb47a5176cd203cfc6acb8886b00
SHA512

b3f1fdf3c9f0d2447e0b4cccea7535725c132dc8eceb73ff4936d860c8cc40fd0718d75f0d3992e229720813d3f9f64b1d90667693cc39e0738e6dbe89c5b952

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426752731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f042f6ad8dd2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000090d954b9818e62f89294b4638681317fbf8ad322401bd595d220a922d963cb35000000000e8000000002000020000000072a5132af0295c6e3f71608d75690866914c55d5ba00b9ff4a77dcc46787f08900000003b900b4c37985bf4859add0f6848bbfdab3bd8466da1c97d693d3c17ddece2fe16a1df94b179a0764cd1acd9a9e85451366c7422909416ef6b28b6d3aa45bb3563bebbc70ffc987fb90e757f0df3612e343142e656661a905696972884fdb57d504fa209729131b29b45c6ab616564096032f7575b6f52a25e67445ac0d12dd2f5b61b4b4a242e15de66a563a5dcf5ff40000000e312ffb47ae82dd1235a1fa2d90b7430aa4216e9f0e4b86834942c918c574a40487a9ce9313fecf131a8f888429c2b714a42ab4cfbfbc2adda4305f1be8c3a00	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9489F71-3E80-11EF-B82A-724B7A5D7CD6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f06134ced2609705bffdbbe13ff2b72c8a6f6c07abcb1a32eaf8cb8a15139cc2000000000e8000000002000020000000727146d3887e412736a7b7fcf72e908ff0924d7100cae3dd617b5b1f8e4ca80f20000000576e058b39d3cc186eb5d68180fcbdf225cf69dced1d49aa05fbd8a67375782340000000e96d3321ef0053d35e403643859a7bf6e342ed7374803ba9966197010f19abeee51bde593ddffbe47972f9a5bdce930d4096782838e34773ac109a2c2f8538d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1808	2528	iexplore.exe	29
PID 2528 wrote to memory of 1808	2528	iexplore.exe	29
PID 2528 wrote to memory of 1808	2528	iexplore.exe	29
PID 2528 wrote to memory of 1808	2528	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\338bc9ea99c352ab29574f7f79e52003_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
424c20f395b0473e051adaea140ff6a8

SHA1
a8a40d48a59e125d93ebaed8675e7c4e470a8df6

SHA256
1c233fcfe56e71431a703dec33549d922a20452b8a6463ac4f8c9ee2d0875e04

SHA512
dc35cd251faba5f62fbd09786e590f6aa2be8fbd1848c4fbc0cc059795c2bf53e66dee0644135547b28f659e2f2834c83988532e8ac1542de908badc207f206a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36518d25a3f10e364d7f0ac3c5d7681c

SHA1
705d190202f35d611f875c184cfd85272518ef12

SHA256
9ded8baae5274d89a43133bf3f85563800f3da0b351990d7c4c8fdcd04344f03

SHA512
c6d5de6ff3920f44a6f06351981db759fdca0ef5136f779071d06eb9b0ed0e2563b38f195742894b2d1e42088bca158e78ac72b5f9636ff203ce770d4cab47d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a40034d85226ac992f7185ffb294722

SHA1
d7eb20d5c125c6ab3d0e319f84bcaee25e97bc89

SHA256
af9eee05bdb726dfa75dc03f6d25ab37ea7044dd1122e3f6a68148ceeeac30f5

SHA512
61b0312475bcc7d78686c6a13b82ba4e5c260e3ad0f6fb84dd7c2a4bb2f1359c8bbae8bdf4a4bab8d566121788b661759b4ed1b58a91c724b6290e62028acc12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c45791ac9188c7ffa19fb9f204a6c577

SHA1
8a23520fc8f3fd03c9c5a71588b100041a2f8dd9

SHA256
6a27b2351bb03d0e2265924968efa12aa210bd97592c6e001065de496ad7011b

SHA512
be83467d32be423da96acb6f5c6e3c0f9568d561b4fa87cd92bbfd3ff11b839528b5502128a697d083d481f4bca1e5a425d72c7592cc212176c46e73d286f7c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
139acd77eaf60710b83ec139fee2c080

SHA1
e4d2e38205d92c3b25a1506d694226945851a8a8

SHA256
542ed94f10167ed8032a65335b3fe92c62b6fc3a347fa30b7e94d8e3c4d48929

SHA512
c9c901c881b4ef4d674e7fd8edb7507afbec421c59c2a41304e3ebe5378fa4dbb3438c35bb38e5a8a830fd16a30205c5a354c58c08900ca2291d265e6bd133d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aceafedafee8f15921c6703ef272eb7

SHA1
d62ba4147a1795669fa3e928a481e2db1097443b

SHA256
218dfb22b7084501f271826dd1cf455f4c957cfe7347d31b98181747f5ac2a39

SHA512
a1a40035e6292278001fcaa5cb72f93200e29e72f837f980a3c2f525d6a6fa601ceb9c4f104cca3e3ee9c04becb8ef79010e6a0653ad887238e76c11264115e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ec96d92237f98391b9537b1f13f3995

SHA1
a35b2394223292af67c09260e1ec74c6237ba3a9

SHA256
c6000033c339c7156c03c30fe0f601fa9616e72f03171fe0264cd3cb8ff3bc44

SHA512
87b0c7a5257f29efa0a31f1aadf30975f4e8c0c0e706cf38dcd5c2563df976ec7d8c8f8234f612a1388eee1c47d9d666455d26e969f0738184de1109557bc26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
643481a44e927a2b0937fb066ba7db6c

SHA1
7e45476cf0e92057d8c521e8b239ba23d8663f1b

SHA256
9761e3e40a8bf402f540131cf4c6ea96d91a71eb5aa781a5a0c353a7b5994281

SHA512
bcaa36e969d1b6be22565fdb3cc8fe5c2a1c998bfdd15856db665c784b1174442d6595d43d257086b347330976624a41d60fe80eafd2ae0485ebaf089c7ebe79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c7a35d598a255f7b983bfb484579306

SHA1
10bba984000a576bd1c7540c41dc56f8ddbbb207

SHA256
47b3d70501b537d8dcf1ab8f3a44b713ef9bc4b1c2cdacf2bc198354a016b5c5

SHA512
21fc171c1158dda0c27e6b508a9d6491c95bce52ada3e1e33322e4108806a91c16b6da384f41dd3043a5884fb5412ade28f7dff651ee03cf47590e5df7a16650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa08aabd890f297d792c298f7ded87be

SHA1
585342e7a173fae59acdfae3783f834a0c241ded

SHA256
736d420517e7abde9410b2521103b82687d0253e52ce4e132df0aa0a0cda7a3a

SHA512
e1b065f318d263148db46e214c67f28fd70736ece1ce899d5de014b36bb1a8a004bac5f5cbe111462202a93117d854ace00d0e50d48b3f3c8bac7d1d734a1355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b278a00f6663f35503accdb62af40a47

SHA1
a79c5be20016c9dc24bdaaadd3e1ccdea94b226c

SHA256
2f75d8c4e6e88f7267d45142d5bce2cba6bbc173bc24fcba1923cba03b81c5c7

SHA512
60bfb6d40687fee3420765be63cfc7dbc8fe153c12b4ef99472c68fac1516460ab45c551e4ed21bd5014bb63cb965bfecdf46662ee4b753e774b1efe29853539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcbc888a02d54a6dbf6c0abf9797d18d

SHA1
8859430db47a6f6bd6fadd2907536bf363a6a8d7

SHA256
6c9d2dbc7904470af4306c25fe59ee617cf51f4f43dca7667dbb406f40f12b3c

SHA512
538e8d86571fe49437549c2e6843e45d221a3a2435b81bd10aafde5c1a942ede4a509c97ab5f51898ccbd6c70a4379a9952ecf5db667dffdffc7a33aa4513219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb867237218c4a96d6c05a54989c87f

SHA1
897e56ca35d3d456230e1b74b835094ea805281f

SHA256
b426d50f68ff79188e3a0b87d914c291d0fd628f65f158be35480a7f898e97dc

SHA512
2e3a9fc5a97eaedce4a5a8148947191aed70d3dc7983841aa4552a665431548c88d433401d4950441c96b43a5a1b59b6c166c67aebc5b179831c46359dc855e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC568.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit