dc8477bd53a1f8455a2b43f221bce5c5fbf94789e5aaf7f48e1e8fd54bd248a5

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38bd44aab9d2ce7a624f4582d96adba7_JaffaCakes118.html
Size

23KB
MD5

38bd44aab9d2ce7a624f4582d96adba7
SHA1

ab2cd8deb81ccdd8139dc4f95b6244eb11d6f28a
SHA256

dc8477bd53a1f8455a2b43f221bce5c5fbf94789e5aaf7f48e1e8fd54bd248a5
SHA512

9f5723791d5aa63a28b5d1156ee96c4f5e587d84425db9b983dfccb623a8b18d78808ecf2aafbac91d2f55afa7f648c689b896874e2d37db421f4699e608826b
SSDEEP

384:3dPf8XkbqBoNqZUEZsnrgKQW1NqW1TZJ37cx7ceFF0/fkTOr+n19qH/D:3djskgKQW1MW18SYOr+3qH/D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B975BB1-3F70-11EF-AD9E-EE33E2B06AA8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005847e37cd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e45d1627eafa1abffbcbc941b4c83850fdcd4fa91e7ceb5d8620fe3bb35c4e8d000000000e80000000020000200000002cf1992c1a38ecee80a725546960eeb01b7c7a49e8bce77870e3f2c0c032c99f200000001b82776a725b169c1408fe6ba08e4b787541a5ae6c69ebc21dc40f6320ea1da04000000062345fd8167dc12a83ecf86e2c24604e535819f978cf9508db23d4be4ef6226d193b9b4234cbbb598d195d89d1b7a5f4a5f3e424d7ba53ec365b18577bf62b40	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008d651c084c02b3fd8b11c0d007979dbce7f4434b4cb39086da032a97d01b06a5000000000e8000000002000020000000e4830f35ef907c300caaca896f9cdd797ffe9156cf2bb125ce8c1b3c46aaead0900000000f32acb7910890e6098a2dd55b25663d6e645ea17c3da2af45e202b8c47d9c869b7f24506332af1d83c92b8e5ad9a34666eb6e0d1da11a096c29cafc0011f9a879dbb8f7e449c7ef85d3338577f6b2b214cded27369c1b82d39506073e6e0f451ac39b98e753880f6dd0e84b40b87dd8d297beede70393309b9f0f5dfe2fe4d1c016df4f4a2f02afe4a17786b911a80a400000007953b65681d706f728a70024c7c67264276af80c2dcc9ab76d65311de9f74a159edd244f80f57235f6ee223d117902f06a0e5c04b0c8d0fd4762ec942c1dec2c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426855488"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2800	1544	iexplore.exe	30
PID 1544 wrote to memory of 2800	1544	iexplore.exe	30
PID 1544 wrote to memory of 2800	1544	iexplore.exe	30
PID 1544 wrote to memory of 2800	1544	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38bd44aab9d2ce7a624f4582d96adba7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d56a41c79970f6863e0f09d4dd7f8e7b

SHA1
4401bc3f75ac6bdcc9208620daf60c6828eb25bd

SHA256
f4cb691579f0738ebd51523faafc6c30eae5e7245d5af03d4d64fb9bb01b3b5d

SHA512
16ace41681c63a0fb0f208d82fbbb73f99ae977209d6adc92aa462b339c69ac27f3a9a4bdc90b0109ae74d97e69e4dc61bab9d03eeca46627d1c7b356146c7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a44d5604d9f527bdc46e47ac8059648c

SHA1
53ab618024b2518eb8cfdc9aea054a794f4f087f

SHA256
7ca66c41e08cf674da49ac3017251bf7337e628238b6ca8d6ab4eb33313fe062

SHA512
834b20f19dd8f367c54242fefe1f396a8cfeab94e3f3a355e93a5caa662e1a6a7dcac9ed91b1efded89c2a4067bbd15942110dadc3746c7f6e33e5c0cc96484a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
340717515a0ce6124c034b64bc030f04

SHA1
6a549d20a10044bc326c1bd9eab3989fcd8c3c57

SHA256
76ea6f5f683a37267b65f13c602af5afee2bf4e14b5eba757f587080dac94682

SHA512
a98370fd3b22250f4eae8af993e08d303cbc1ff2a932ba08cdde1e5e7f982b62df5f79a840e6f779c9271ff6ef5aba2af4e42d050eb7442e1bdcce49e13df646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a47c7b5708e7fc292e6a51f2b12ea1c4

SHA1
384cd3a2f14707000bb7d8316583b9bfb6f794f8

SHA256
73207e4192f01076a8a7e445d93ba64d3480f68647f5dde7be9d4da3c5d48f53

SHA512
13478c97cee120a585d71d1a2272cc66e1c1c78f3525f33f5f58aeae20b17e5a8ba9c4678672843a393a97658d10c4a4b7b15b05618af120594ffd8404ce1062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddcc1a6539e9b59df49bcd1f3021e6c8

SHA1
31150ace3c381518c064962102159579cf3fb8be

SHA256
802153ca48b7d78483073a5f06853b950cedb254306879e9d044036925cbcd3f

SHA512
dfdcf144d5948fc1b352f4a53a121af40bc3ea58201b1a1fbffbf688ba04d3766e70fffeddfc267c654a058d7da1939a396989d2203f0434d22bb67f06e143a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234865845d2996981a316dfa075192b6

SHA1
0f85efba89f0b55df07c6045979fc90ccd47e1bf

SHA256
eab7d323893901734a267b97c22606735293523e8458ccf1ba9b3d4a9aca77cd

SHA512
6d95385963723240dba9213e033f8dd08074951822911a74417afe65542861dc37b90c33f348a7e8cb4bdee7b79acab21f457d9c1c8f9571f962a7137e5a6faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ca6ff7d6c0c138553df23d997e9c85a

SHA1
246cb7737f5d10c6125ef3a283096dffc83dd9ae

SHA256
72ed48b501e906ce06456dfe14658a13f74665119a406e92e8d19e6d1de670a4

SHA512
0340b5b79c7f11a9d6bb2196473f6e3ef30b43b36494beb64a7748a0543de490b874009e48061f6b765f44c37a2787a2a2a9e48586d45f836387125fbb355757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff4140cca44fffc3c47f77a47323db0

SHA1
5df8740627be114ab573385c397a08c8fa5c8e16

SHA256
9b6785ae37026e039dfd08e82e688d9732a05097165d3dffbdcc870c2c738da7

SHA512
c88e4f417e8e75da3145e2499986584f3b9f2f8207744091cee7c2177415f10d2f077eb42a480b73472344a2d8a2a6d9a05ef76184170b770dfa4e97553d9f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a99bfe4fedc604c2c397efbda5310afd

SHA1
7fe88b73d4502d969138a818551a2aa5957e49a3

SHA256
715424430cef095c02fbf8073c01b56495ef08558ca50b330d6d4b5365f222db

SHA512
04a6d1756416c1375ce200f54825e262bc4b870f7e81a915ca5de370474ad732bc77c3f8d07f4ec9f799ab12980a6d92ede04a9f58d966e6f9fe143989a8370d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71b096ea94a8404b6a4252a4a61fd155

SHA1
68151de98c5b34dc49f6804ab9024d2b3448544c

SHA256
320a508f9716320d1321daa84f8f3ac0cdabb1f077b6ba42eee0faedcb7b06b7

SHA512
ca4ead82017fb55749d82c80f802c1231dd9bbd2ce3fa9ebc540dceddb9c2bee940f3abf4f0194416a116f2216ed81081b6d750fcb806077e6a9f49e652e257e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566bae6c6c4cba06cfaa96ebad14624a

SHA1
bd997f8fcffafdce29ed59e8c3c907515e680439

SHA256
146de8fe8b3b0c68e4931fad589bd10dc5c305185b93d673f1360459f3ffd7f4

SHA512
eb1d11c57bcbe673433e7fdc116c3bdcb67eca99e1bd20a3c90118a3415d50e675e980169362592d4bfcbe9aa47ef082d0e42aa9b65d071eed5e5f0fadee81ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a642e0a5abe8c7d103931abcd11e7232

SHA1
e02fd2a3abc483f3ba1a5bea6b3a886c60ed100a

SHA256
3896affb802b839d5149fb135f928efc287e72b13a46191323fd1db9a47e559b

SHA512
905b298e5b1b389b8b5650f3c6d3482d5049fcfa582181df01c3d3190a0a670172671ea64def88037424d442437f45a6b4d80b277b6281901af5cbe99c833505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9371f69d3842bb7eac69492f67d0b43

SHA1
5fe1c5905a313204a6990ff2a8ac0d94643e3147

SHA256
79c10861944c83ca05301d944c1ed9f01d5cc11694068b15ac8a8f07774dda6e

SHA512
63a3d578dbc6f3aacfb763b6360069c77eb7d07c4bcbcaa56ba78753e9a77bc9f9bcef3edd4767e1568610800d890924503d08b1a7c7b54ee9ff6202e3a82651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb6922b9e71749c35acef22439731cb

SHA1
b7e0a07cdbdd9278d749f1bab521a078bb40aa1a

SHA256
511f5767ae83450fa72195125f5832e7839aba5a78000f9b72319cc4494a90e1

SHA512
1f19cba232f5a7bc2ce2774b8924bbb15a8cad849cfd532b6a863a603f402ec39b8d9f05a80859e00225c38a3ddb42a15597e02fde6b042afd25f685f4b12dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be31f8d0bbaaf16a496d2e38f93aeb72

SHA1
153015bdeffbb37759fa9b5b0a697c1247ab22a5

SHA256
50673bb4f136fd6679a6653174224547eaf729b2c90d782d127309cb9e74c4ac

SHA512
9ba8de40898410155f1476c8c1b0b3bddc857d63ba52b4d54c37d684b43aebb7c61efd1f8c547ca387b5636f2cce76b439855261bedce725e1bed80be7f90174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebbd19eb6fd0d7ea31cf3c51be9aa3d5

SHA1
1384ee3763008452191e5b8567e065ea9cb21277

SHA256
8c58c3ed58a8c0d38a8e7455b252336c86bf9031594d7edf9cecb24c432313d4

SHA512
98e48d09f16262d6cca40356bbf80bdd5771c251738b63723c9cd3942ad514b9b37d7850b8e31c5b9327c2edcd856930347b791c7717a0e0b091541141c8b495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff9e28da66b46cc3b97c88d6b5fa74d

SHA1
a8d1439f2bfe9a1dc810943919822aa1635709c5

SHA256
1f25285f21be56039150cde8ccddf217269fe71dfc76f493758595cab069c116

SHA512
41134f4b4a9ebc75531c97c0a128ba87e1a7bc72127828612be2024d8bf22062e3231898f448da891dfc6f80d8cb2b70d7401b8440e8ae3a77a8a05c2731f9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab283C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar289C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit