16fcd1169a3fd97e026fbf766cd1403ad5cdf39bc4bd42f6a43e93f92adb414e

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39862ae2da5efe43b2121abc9f726e80_JaffaCakes118.html
Size

10KB
MD5

39862ae2da5efe43b2121abc9f726e80
SHA1

6f1f5080c2343bad900d84e41c20761a13a21c7e
SHA256

16fcd1169a3fd97e026fbf766cd1403ad5cdf39bc4bd42f6a43e93f92adb414e
SHA512

9698962a3058e556b470916a5453a09c4b4f136def352d38719c1583a9a4582684175dc128350fdea570d00f3d56c6d252e52d241199b344697ba48ea89a3164
SSDEEP

192:cpbiZ/5dJicfZ5G/x8oIkqbqrWCLC7J8YoQ7JgbhV+Bg:KbmpB5G/RIkqbqKCLC98Yj7JgVVEg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FCB6551-3F92-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426870262"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404b51569fd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000021fde126883eaeffa43f2963ab456b7817749ddffa0ac3d17b83f8cc4f91fa99000000000e8000000002000020000000cda5a30f83573b0d56231dd7710dc20c10548e781f63d2d0b4bd5d8dc7de3c3d2000000078046270feb2511850b305d6fd29c023f9ccd1882604009565ae9662b33331bf400000007139e1e2e3102bf46aeb1fba1f98b64dc77523f89c09632de7b668ef55b5b6675ee8948ed1374b73a1ae15e56fb2239acf3ed62ded3c06fb9a38d44eea90c17e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000096e375e721d287139ecd2f4ca6e461ea396ad7234e0fa44fda0ad56466eee17000000000e800000000200002000000043e330bb076ffcb11328065304c40d79b7bf47803f3d2f0f01b7e0f6ff4767b390000000acc5fde0692c1626091c0a56b8bd774325707a925de9e63b985c1b6e21122c777642ae9d5047b3720bc5ce3cd331fd02b0b184f7e7b8e857a492948d8081a77dc441c2693ce7f8dc2f03c54dbf866bc4c7df323a816ee897b31e5097c839aac3e82fe96f47246b30c10acafdff3fba4cf6c5701c7f66dc4060cf6f6b15c522500e27481bb3a83d2b9e2f0987b595b44440000000516597ecd4eb3dcb94b820b1b324fa2dafeb42fc4b7b5c5a6bcf0976298e1df512df13b699d2f38c944632b48310a39b258efe78fe08817e7fc5847ef71922bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2748	2344	iexplore.exe	30
PID 2344 wrote to memory of 2748	2344	iexplore.exe	30
PID 2344 wrote to memory of 2748	2344	iexplore.exe	30
PID 2344 wrote to memory of 2748	2344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39862ae2da5efe43b2121abc9f726e80_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140d5ab4f1221b40ac9531b9baec89b6

SHA1
dcf10378bbf6b307f90c62f6b3cfa9f844ab9e39

SHA256
4590e8e088840a7cf50f24cceaa614af758cbe5e2ca644351bbb5dd477351321

SHA512
c2ac787413ad30bab1124cebcc38a66dbe1ecc43d11a5cbeca3255075938ac8d104de5b4e2e569a631b9edae94ab3272caf40c307f82be7c0c0d1506d42d5874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99ba8fd71907741b54770a768f37a437

SHA1
3e7280a959a8dd7f5c584458f7ae32a7286b2ff0

SHA256
baa56820bde5940fef8dc4ff66133e01751d6a7e9357e3d29fd41469ba401675

SHA512
df57b9c82a1cb369a2929fe7516202956edf684f978378b49472626a383ea439e985f26a0beabb3fd8b09078cdc705d0dc4260c4560659bd11fea2acc610e81a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0590840197dbfe45d015bb0b415157e0

SHA1
c51423e174991ffba19c546a5e8864d7dad09102

SHA256
8461d355ffc7de2f4bb0aebda7597a724c66a17ba747ea850b90057402f5e676

SHA512
d99ab56969c030adc63f5f97d030779e229af40cc682bc1dbaf97cf489002a824105339a9306c3f3777438c50b0190758980e0f02ac5d2dd89ac64668e5ec1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
602e152963c86e5c201d79d4edc5da08

SHA1
fbd617e74afa7a59025f50297c81d542cecbce33

SHA256
c1aebe7c858a2991e690038169253c5c880bbba6b7abe46340be2b04f86c023f

SHA512
f89ee789680f2fd324d7077dd63cb026c35958ccd0f4104c7e9dd45fe8ddd40e22b97ae4ee2c33c793f204d1879a766238c00d8feb6864693757c97a1942b15e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
104c7b44b1585cd880a57c274eb47135

SHA1
8a199d13e65f887edf858ab7f40a1193ef4a9bbe

SHA256
50b3812b029b9c176dce0ea99577feb53c9e209925be8252899168aadd43fd3c

SHA512
e3209068f30b39e5be241b9258245174d796a6382eb32d04620a295e1ef634784a01b16e17ab897659b5ab14574a9820ce6d7992bc803272c709a4913f901892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be8b298e4c623098832098524e024862

SHA1
98c9a9f9c0ffee9f7d9bf104f0e53336747314e4

SHA256
fdaadb976fe39da6ae18e8eb9e4e31490e7309cadf83eca818198843c5bf89e2

SHA512
01663c4ea8a093c96a818cd24e9adde9ebc5bef7a8aa5dd7287b2e0a6573dadc5ef9372bae7a46b4b08ae15fb5d201efc8d29cb119402c52d5741a994d0ccfc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fdbc19ea841e96a2c248474912f4cb9

SHA1
2237490dfcad57b04e13595a152fdb59e8c24abe

SHA256
8c3c29cee08b2126e9260fa1654d1b0dd3404af0baaa30b1b23813d6789fbdfe

SHA512
14e419a94f616b86664cb581e043d832f5d150a07f843e2390584408d6318cf42d388f3fa7121ad69a91cf6bc3bac312b2b70cbded23b69cc50b33cd413a2252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1963c65f94da03d2890a53c857c38474

SHA1
d290862a48ae1035f5a6284e3898a7bd4baeee41

SHA256
192f25aa71fa7e5311124022d409521d996f3ef27c4c7c7d72a9b674df9987b2

SHA512
13046250802c0444c0b17cf1adccd9c70e5ed97886d89d072cffe862c616b8158e116b60f9839ca564ced2a34f671764e49d9c8dd9821ed4c5df63e25516d09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae05b5cfbaacc4433ce684ea08012786

SHA1
d9cb9af57410fb17ff34ef8d9220728a362830e4

SHA256
1f3a1e28f7956264c3e66835729a0233b24b2c5cc5912363e5cd780a612da731

SHA512
4bd35911dc4756cf8e36b9a392638636acd40196493e8399dd3c6f2fb8b786141983a2c8cbe6e9860deadd86ada04497de2b73ba75d7e257a1623bbd86ee908c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fcd8cc45a2b6ce2d3e6be5410b594a6

SHA1
ceac16a9040134025ed861aeebe5ddc3adfa61f6

SHA256
92f11c3b0e74a27cbfd44d6d5f263cf52d3e4303736aea8b28324077e58efbca

SHA512
cce42549636d5a63fe69d42d237771955bbec553cc8ef9d7a2da24ea89f0adf4bcce4af53e3584eb1815bb527bea5cdecefb5ad1166bc34c85803137d8689184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ec764177945b68106fd718ad2e0d8d

SHA1
45d4a3924b0423aa0ed63bb8a0c11b9ce771b709

SHA256
43cfc63fa4c6b58bfed6f24e155248a57190bf293e648b3203aef38c6bafce7c

SHA512
b21cb812aa5b9993eaad9882e4e8572e4482cc59f4f50781e60d9420942858536363998226e20e813f9698f419c8e23c5df1183e7551b203d2bf5ab2a8510828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c78c1688b9fbb65174d0e6ce0e04527

SHA1
3eaff0a0c5003691325079b1799088cef4904329

SHA256
ba29bd373fb1103a57fdeaca839ffd9b23d0b046917c35764755d6310c541245

SHA512
d2d8440fe334b77b33c8a831d9ea90757c7168f66f6e0a76b92688f89476ceb7c17178218ccbf629b120ec97d1828283b0d30b23ab509f91e64bf5f7a2a7dd9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA650.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6EF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit