b0dd3f5a105f149153c92bda4de259d01320ced44d0ad5b53607a15767aa02ad

Analysis

max time kernel
68s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

384cb40cc360c44860affc07b8adb69e_JaffaCakes118.html
Size

4KB
MD5

384cb40cc360c44860affc07b8adb69e
SHA1

346d674650b4ad00379d4c29bcdac585951e96b1
SHA256

b0dd3f5a105f149153c92bda4de259d01320ced44d0ad5b53607a15767aa02ad
SHA512

190d2ffa3a64ec51eb052068f30b34544cfa611d930d85adabd996c40a3d86cffa468b2d06c0b39305d38e84143a2198302ebbc107508e194a6473e26029cb0d
SSDEEP

48:lmINXEpx9P3yMv5tbiQZVK+iEKvxfKv/RIWKMQ2VSXOhzWwE4kXrp+I1B:108C5QQZIBMv0MMdlB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a033232368d3da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426846551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000eebecdea80b7619de2b04c87fdb675576396573ed62aeae7e910e84449879a0e000000000e8000000002000020000000200290dc3e8a7af6f24b0918d9188fd437906a26f2fe7f9a0d002ae1a5819376200000006ff02be1a3f926dcf6f8cff1b70536de219c822fa3a1a4fe9417d759c55cc132400000007f77c3d49487fe9af85a46a9c615b2babd86301c1b4252711ef57f641579246dac363023680c78a6840602704ef842f98c83b7ab13962ef1755237a123e21614	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008ba86d253602fdc2a6e1a808ba88ce4ddc5159b7e1b2e0798bc4e96bdc8888cd000000000e80000000020000200000001909f0a585d2d3a4179745f5b83ffce5c787e8b9aa051acf06c397546ea140b390000000967d58a0818407fbe66bbf0fe91a69a3368ced203e3b0397266f32f0028a5b489b3683f01b209e9f5379d95028d69341245cdd93eebff2707e7bd864717f000436a7286ad323d06499a5956538921e736623cca8f8100b2760d51752cb57400480f8a3f97551d2e80e3b3a3f9565059aa194bd27ed29100aeaf8c041059208d66855db8451b273e856d559e71502ae5440000000c1bad500ff6094dd4d6e8b3082cd399a4a573d7cddaf414dd6af28918d31ae11941c97fbbe06b4aedf26bb69329682e75918aa540443a8da2d7519af77223220	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BE5B5B1-3F5B-11EF-BEE2-725FF0DF1EEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2948	1972	iexplore.exe	29
PID 1972 wrote to memory of 2948	1972	iexplore.exe	29
PID 1972 wrote to memory of 2948	1972	iexplore.exe	29
PID 1972 wrote to memory of 2948	1972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\384cb40cc360c44860affc07b8adb69e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f453b1a30a1d1e7fec4c11c5c5d15cd

SHA1
d36817e1f30e0dd6d51b87ce79a54478bbf6dc23

SHA256
595acd39d0c78f251dfbfcb4dcf3b7c17d0480c6a63e6444c10ad16d5305bf12

SHA512
8dd754240d290b79f54c3203ebe993f66269789b11c218ad5f6396c598f8f7211b9592e5b930e45fefbaa84d2f761958921658762d834c46042374136bc987e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d610749d128c9f0bfee0ccb7867e6df

SHA1
4d45d621369758287fbfd2380f35ef750506e3b3

SHA256
a5be27961d1a5787e5edfbac903293a6ec0d81657dce95ae858840c01f2aba2c

SHA512
f7c8ea3b29dd22859aa6662b70c8b347cee70ee761bdb2ab4c44f8880bfeb65f4618fec14892004ef4fa9ec86e5b99f781ba1ea949fbcccb8b08107df543d1e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da6075e641e7488809a4ee180beb9775

SHA1
29586e1d0316eccfa6e6495efe5888138ce902d9

SHA256
20913273e9a1db5903ba1a408d6c25f66938b9ba8ed6ddc83ce8c6055e94f1b6

SHA512
b333d95007fe5ab29391a92cae079cdbb3a3347dece4511a5a7ce54bb5c0dd539a4e38bdfec36f230a50142df2fda09b038251572d559a2bda7bea29612d4f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fe113fa691adf3fbac353e268aa770e

SHA1
542e5d6d96e33c7919f57e7c38d1c7d51cb12f21

SHA256
1878737ca19f472ae4d41cee81d707fe5255443d066604553a6a095f6c200b57

SHA512
e5eec1e560e1aefa74814714c203173041d6d59144e58995ed94bf02ee925db44b8d88d1e0817411feba0c7d22b07caff1a8ae83e79406ba79b5e4598548c357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eed079fdaeddfa99ecdcfeb6b73c59d

SHA1
5f5c8a6aa580c8f515457459846d32281cb32332

SHA256
22a6b4d249a33bc6fb8eec9ed58c86d270a513ff211c85e58f1a3be9d8b26052

SHA512
eba868bb9721c112362ff963fd78cd08dd4205333e3e1f59ff984a7d8f371a0f69be73feee2f4d692f30062ad17979ef7f9de2f99aedade27daca631e006dc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
981a979ffc43ecc9ba1cdbe997e21f1e

SHA1
245bb5a3c62a493cb9254425f4c6d4128cc819f0

SHA256
9ee03eee43d4cd7599787cfbdcc7079ff109526fe22a58d331d2821b682481a5

SHA512
3ed396a315efcdb4464e76d07d573df136651801ee5acef7e78f1469bf616f3fafdf2b4b94d1731a04eb8e00c0bd262060307adc19ca96be8c3b671a2dd8c319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475620e4395e8db1f99771d1bcd30df8

SHA1
d3c731dc83ce2d76a2282408f818f4a6534e4fd6

SHA256
416cf914e6324d654222bef558e6d5a38bb0759435b16e89cd1fb29fe0365617

SHA512
ffd9dcac3932d0377083c67ff9d0064d0c93b49fe28d300eb6deee6a08f34e43335f26b67e9d35113933a7b565f2ec034db45d9ecfc90192e47ca623e8997298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5753bcece22dcd9073a86f5cc0edf8

SHA1
efffab9879a508cc6b63851f2482af70b3978055

SHA256
19f34f2ce4456cb7bb58e72d1424dbd61db1e8f94df3025a8f894bb0ab268aef

SHA512
0ee750cca406dbc6949947f641e704e0c40070e0975ec6786331ab0ca401a417dd9ce33c6dca2a6b5877f922088f168e1a036f332e3d8f6dc0ceb2db05f91535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a820f62a4d39f9f3aa0655a665c50d86

SHA1
83a4806e215318262f37c1f807eae76870efc8e5

SHA256
a62bdd3947c0a49ebea873221a20c2fbd189fdaabb877664566ed8451edfa422

SHA512
11b57e042739ccca85c8ab8a2f519d25b2418661da7af019802165df73f067c39c33e716cf2dc5a4cacea841b0e85f65601f4d9a038e4c65268e626e9704632e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b5c6435c24cc1eafbbffe15ef1f3258

SHA1
388f94e44f45087e6c6ff59d1d1062e2a1b538a7

SHA256
9d37787f5f8e4c8bfca0c0abe706197ad6a4210b7f3b8a7492068cbec37ec6ba

SHA512
238e1a7ecc2052e0b040604898182a70e118a22b0269239d1b8052901dfc41c7eab27c5a5b557eeff9d0d9bf3a13350f2ff18eba714e5406745510840eb634a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17c53cf22eeb4b887a1c6faf44ec2807

SHA1
86afd22c6ed9a13486cc6a7ffec6ffa302f1e8c0

SHA256
7301013afda4823022a5ed0779eb5abf2524c0156f80aff74e27fffcef05587a

SHA512
32d868b205bd1c5a0b7a4d9629bc1e9540cf3f0fd06647d4580e714d2dfa95db46bc314e0a1df0983647e596b8ef3206a642c6aca620332f4d08c26b1d8cfa8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39f9222dd1b71bda30a219b1a9d6abf1

SHA1
c5924d6f1b3c697279e9139522fc58f88e249318

SHA256
d82da76b0ea2809053c29dd877098ab7154a2aad88cdfd233bbb402e191b3f7a

SHA512
73b99b9c5e6aad4b0ef310adef1786bbd9e512b402d459351f56787beeaa3965b88092aaf07d55d63264b166a79f88ac2df75d80863c4164bba926a5c30299e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6babf2de9c87378a5e371b9ba9b5b5a3

SHA1
f69054bac7645d5ae34d3fba401efc30fafd5acb

SHA256
00e7cee20a67596a4d80f471a93a30b78a9345e72354a5678b55eff56cb76d6d

SHA512
dce0e698ac97bc78ad958bd9ed87a1eae688250151a933bde0cb3e6cb55d6f9a06eeac711dc79465c278628674d8633ed3964a7f5ce64c8e52be53999c7cbf02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
223f4ed0a509904291049bc9d5103e88

SHA1
7e3e02a604421485166dea742c49ee69a692414a

SHA256
dc70c89facada64b5ba7327e42b99a9aa6d0903ac0789ac48550ccf9c9309d69

SHA512
aa965d7aad957e637a61b39c41a04e6be3d209fa1a4e42a34d2e518deed8da1689f25b47b880ec0a7186244e6c39a62b6856cd48a37dd0ad4179e1aa113d6f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717608d6a4aa962da678845799aaf893

SHA1
c2b56470b1e989429e3ad0d6778fea845f98220b

SHA256
a593fd51ec8c6221ec734599d63cf7355314475d5a86f9f459fed245acb36e34

SHA512
ba2bc2295381a99a62189592b45f2e60fe1aed0d0bca37fe49505b1e11dfbdf7e35308685bfe7899629c938945e2b3fc7a32a5d15ef3273d39fda99c7a8001f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a18765933543c1a6ed116c979db79b6e

SHA1
d4100fc7860d9af90a3d7212a17bfa587d69f0db

SHA256
5102fea3df1d60072a7574667da3ae90447bdd4f31d46b2d9ea323148e3d95b7

SHA512
9ab4961373635a103fd4d47e611f7ab307a9fd3b3453d011da05c43e3ed38a5690ba9df51f9e9105f27bc0a43a47f78f43287b68bfa8f7a2f231e839cb450467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FE2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit