595d9a2268b6ce768ff348c7a454e7a3eddf703f4f333dac47092d7879ea1c42

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38d5928f99a1c33ae59adbd4f119663b_JaffaCakes118.html
Size

53KB
MD5

38d5928f99a1c33ae59adbd4f119663b
SHA1

e11a620abb23a3d01040a90c7dccd8ff6ddf9cbb
SHA256

595d9a2268b6ce768ff348c7a454e7a3eddf703f4f333dac47092d7879ea1c42
SHA512

592389d3344faebf7560638f0cec47dfa5009e865517b9623a0e66d013c1f37d77888068e2659ce045de0d3eeee82b1e6804ff5323dde93422953737f70521dc
SSDEEP

1536:CkgUiIakTqGivi+PyUNrunlY763Nj+q5Vy0R0w2AzTICbblok/t9M/dNwIUTDmDo:CkgUiIakTqGivi+PyUNrunlY763Nj+qh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7097944181d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005603cd6753874a5a6eb5d70490779d71051a41d249629d3a9f7beba8780a19a5000000000e80000000020000200000008175ca2aca0914a2a6e42ea36c9026ed13e80844dffd0c4974242c7e9e8049ac900000007712e6eac69c811596529af29b2e170ce8d899e4b208e509dd9aeeb370c3109646af4f0ea82810127c5de2b8b77ac7b03d7508ac898ad72272a9c4512eecfef139880b950a471915be56a9e310a5e59cbe27a560da57d1e56fcbd0bb80ae36559869a2f279d1264e0e87f0ca62f269d1fc2029d320b629056a1b2c9362bf97be5ed3a7245a09a69da69775684a6d518240000000d2277284f698e6da3895639f343f70d55974fb0db3423fb9223f002d5d55a900eaed606ce7a5149e151631ca174eb474eaddddd226f5cff59aa42e010f5f4e5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A4118B1-3F74-11EF-9452-E2BC28E7E786} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000065de6bff45cc4e9dc802a8117c9f5baf19e7c2ae7ab13006aa44c00fce149db8000000000e8000000002000020000000bcb1f3dd6f79fd7315111af82da3214d10f9fa5f10d96414acbc2d282ac269a8200000006b71c8541fd79d7bcf724a21c419ba781b31b9c949125c38b6b3da745877658f400000004fa999aec6002f82414e90d07b8aac88967035ff0954669572deead0baacdc3277a97644d18ccea090bc40e1987abc860e6d8915633176eea99002eada71e5ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426857338"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2052	2480	iexplore.exe	30
PID 2480 wrote to memory of 2052	2480	iexplore.exe	30
PID 2480 wrote to memory of 2052	2480	iexplore.exe	30
PID 2480 wrote to memory of 2052	2480	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38d5928f99a1c33ae59adbd4f119663b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec09a8738cb75659c40ad5be47a71f77

SHA1
1ac7aab1eeef764dbef79c65d9785d0c614d72eb

SHA256
b1b6fbf588e0b99462e37f20ec57d81eed740080b7e0c76814f55b22b7904364

SHA512
b09b50c59cbd66958e0c099d969856e1b7b088f885e5a3f1cf1933097d6b5d70eef0990a8ffd8593e042c3dc51fcb594ca2efffa2c16b68eed546c6363a0868f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a3c9d22a3c1965360a13d77227fa8b

SHA1
d8af5daa204674ac845ff8ecaf5a210a38a690be

SHA256
fab6831863680395fd9429af970990e1efcd8eb6ce1d0b8044c306a8a85316fc

SHA512
57410baa3cab1f782bfd55e312198b25bafe6dc20492f1c804e35e5e4d6cb7094ebdf31c47fcc9c12c32d0f1a2a91c865e43678d418d907226ad8d9408628aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d393325c7bee94ef244b9f0c43268b

SHA1
3e73b66604e6c3e6f0b50e7a68755dbb070f1b5d

SHA256
720745bf4ca5d427d7879955fd9e5b09c880190a0c0f75c28820f554befa51b0

SHA512
61bd07409202f8361fcc729f8f1ee723096be3d145e72e1c987199ab4755edc7c675bd859fdab65ad2f17e82411f4d2b9ea1e9af20d6a2431e653774f24cbc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a62f436325a36c18a65662d4c5f4f957

SHA1
4aba403a493f79d9895835a98c6da5ad8cc091de

SHA256
fea1d8cdb28d5fd6691099cf4d0c7043725de433e522ac913da6e63b33e21e45

SHA512
634c27f6dee38afcb430519e32cd4aa7c70bc4cb6589b2151d2b7b0a46739c9788d82b2cd8d2aa3cf12c68063b2f58f4caae86eba89ce5e1a1717a2ea95702d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2baebaa6dffb8d75a5349155b78f01b2

SHA1
07f13a503bbb4c74d2ba363bebf627026ba7e6fa

SHA256
452f192925436c2b229ac60eb01b441796b0bc0026434d34bd1dbb366c4bc9e2

SHA512
9980db7f4de8a2a00dc15e17394745969363d42d3ac7fcb04590b97224d5841023f4c897198a778c88e4544496d8921974b9f2bcce3e149ab9ea0361a4cdc773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
275f18a0d16e04babdbc8e8e7da02b9f

SHA1
25ba8c7532a202ee2f624eac94f87237925c5e99

SHA256
6b88c6180313651d30c8d3f78ff9536a94ea2c4e02201a55cddc0172bc176c0d

SHA512
e4e60d6622d72347ea35ee9316d1182a510c01a94a94a843ee1f609ce78f234deab56e3272ef3253bed5228860ce0a232f3dca7f4c528758f53e515df962829e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23d641741dceeb2ab3de353509edc806

SHA1
ca0b88b2a259d005958992df224069480620e474

SHA256
193a6a108b68900c76870fa97443b59ac0a63eedaae22c6fad8f930f06d0587f

SHA512
8b4c1ccae9222c73a25ec98dab6c9a946740e74319aa372fd5ce9b4aaa2b374c30a1a12a18d8ae9539cd6ac22352f3acd27a9eecb447c4f7e3b9c4b73450b19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
696a25c0f0f827dde95fd7b114d29aee

SHA1
7ae58ddeef2df0f6b732f2f185e3114b327faced

SHA256
880399e44e6178e0796fdb0ab1594b65a30142562785f4cecce14dc942406e11

SHA512
79240eacb2246d636328461a56fda8899310d01814ab769a077a6dfd83b06f63c10d7b01d250efc1a98f4ab436e16421a7c3221fe8b9779b47f29c407b744a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47875f856deec86b903cbf3fffb6abcb

SHA1
dd346e33711e04769ce609d2fc67e7644b82847b

SHA256
bec968c8e42811048d75f0cf80bee7a3b5bb9ec1173ce94ba2a5b0a66095f105

SHA512
1bfa44863a1ff59322c91f1b175217c98edf8bc0b50826e0aa5ca13c017c2d936bd7eabd9f21c837e0f271902777fda79401f756573b7c57485f70c33dfbc199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
729d07ab6c93fc6ba2f2c913cdcb9f75

SHA1
afdc3eb6c9223f48c0cfd6d5c4694cd2f9044544

SHA256
8034989f0bbbf54e56a4ccd541a21568824f552211031b3475f6d1cf28b97e7a

SHA512
85ceb0be4699a8605c30cfc5a59c6d8422a09631aae0c53bf3938c61b665bbd74cbdb436b4f64a57f0fce11bcc92910164febbde78f8171842427c9ddcee9404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b7a55195d0c1c8d827c9bea306b3c34

SHA1
ed5f1062c158a218be642bc4f2d30984b2c66642

SHA256
e42fad87c4b7cab9c79f8b9da1ab55a4feebec15c7ae6dd9f76a4355e0e49d41

SHA512
98e6b3a0d8151cc3bc053185653c6a7e1861dbb6031f402ede2cf9c71879f963eefd4393ee52a63cb944d7289a9fa00fc8256ae7884e4a635801db855744708a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2f354de7a3d570e800b4c2f32b3cbd7

SHA1
3828e5400927e6c60ebbc4091f15ebf243d4a025

SHA256
1ef6867008cd1aba4aef878bdeea64307c9f9fa44481348e445c6ea00f3b0d74

SHA512
8026d158877788903bb0b83b92da6514460a8e157883305b5cac836168835945be7f425e5ba554e76ba5696273a9f9d637b476256e12de96b7c7dae520d4acee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bbae4b33322761b16e996b4b095c0e

SHA1
90c86195d3454d0785139715a2c294f6443d2a12

SHA256
ba52bbb30b7f1075b0549be9b8e962dcb61a8b7747212a98e2314a33aae5438c

SHA512
6b2e73da145dfe869d0bf775f46335631c0b34cf802c0d191641a394b75c54dab941ce433c988d9951ed3c821cb7ed01c02170f4bbf66ad129662ec3aed40fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcc842a868e4ab68cbd803b258fd2f41

SHA1
00c7fd1bb5f072be3f73aebfa906235a2500b302

SHA256
5e0f5aab8130632437ba4ab91c51bcf4b270a3f5f83051d32abac20bafa3a0a1

SHA512
830cd2fa1aa40180a2cd3014edca78dc6664c6eb6663542f5c3991c6eb6167f422d9a575335c70683bc82350ccf8c995aa2dfbcda719945a5a600fa57353595c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ba6143d67195a11fb2fb35b7735aad

SHA1
af4313109a62c2bc373201167ec86ca94b4a48fe

SHA256
5dfef445618ae62637b6d3a61a87a83c61537d511fac7a6063f9b368baccbb48

SHA512
ca1f6fb9b295b9b0cd7438c11ccab6c16abbb00274f5ae6dd2ce1fc5d096b0f11e5f3693a522bda4cd1c74883a41c2e917351b84cbec59515fe6a4113843d175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22eb14dbfb1425243e27757d1b2cc550

SHA1
a39f82aaa2a05d3a4314786272b6ca907878eebf

SHA256
e1234670c7673742f2e9cf56b346c14174fd179cca4a13711a11b08b5f503757

SHA512
4e566b787224dff30d25cbaef494d0d288d6883773dd744adbf45abe077d064177c12a1498df7c6dcdab293ca226d3a1391bc2620cfd6c27198cb94df60bd96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\sha1[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDB5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit