40630164781651a956d47d47b650d52bc9830d7349f0cf9e387d7ac5220a9f4a

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bfb1a5dcb5a689d071f8c02898d3788_JaffaCakes118.html
Size

10KB
MD5

3bfb1a5dcb5a689d071f8c02898d3788
SHA1

ca65def37fe0e0e68d75084709b11c73b7aa40ea
SHA256

40630164781651a956d47d47b650d52bc9830d7349f0cf9e387d7ac5220a9f4a
SHA512

208ba2a8a7160d11cd5da1fc2376cb9f7c53b2fd8a3ca4124259094ab8b0fa79ba36995f691590538b87e89bd4ad490763f62af881f4e3c926211ff0dcae04e1
SSDEEP

96:uzVs+ux7ALLLY1k9o84d12ef7CSTUzzfAIl+aG+bzbKOZlCc6ueFV86ChbBh/Ia7:csz7ALAYS/G+7+X0zPcnQb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08efcdb13d4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426920305"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05790261-4007-11EF-B0F5-6E739D7B0BBB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000020bf96fc99085248916a89fc67e10c31f65b634ddff0c9c827dfd3ad42a3e0ad000000000e8000000002000020000000a072807003c0b9745d565308a31b5369605c0bb2f5ad03bb7bd0466f8ee3ec1e900000008be9d47f04bfdf256998181a21d065db693ca0db7f850acdbd0d280b66a042cc6ba09cc6f9029c09ee6f133d8c6d14c470dd56a8f791b839e5135a67b63a8504e0bc974e7877cd1b73508615a6777849504fc42ea56ff1a29ffe6c5f8ed828502609e33d117799de093807652043423bbd537f1d735eab83af6136677af455f86696efe067101e9e096d0b9f54480472400000007c699d67557ec01f432400c73955476875792de8899bd88009ea9fe392dabc3687f59dcf6539bf7c69b01c0c7f259082d2c2ab5c6b804eb14f091b143ddb9c41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000bc76b79efc707263eab325c96cc3eb0ba7fa007eb0ae60ece360b2a97f58ab51000000000e8000000002000020000000e58921c34e8edb6c1b8e32fcca071d557166bd1230571b9ac5b54dca9ed9d90a20000000194660b887faa0c2fa05a1ccf3e613dd82071e44f10ce9d5e6f21722ec2972f04000000087d51fe4f6d933ccb18c664d9e59dbc1885417cc0a6c49b97096e9ce092916d2b47d18ef406c8dcdf17f2d2646439da6791514fd79a851d7dc4ce106a61a6d06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1600	2460	iexplore.exe	31
PID 2460 wrote to memory of 1600	2460	iexplore.exe	31
PID 2460 wrote to memory of 1600	2460	iexplore.exe	31
PID 2460 wrote to memory of 1600	2460	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bfb1a5dcb5a689d071f8c02898d3788_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
26ae7227ecb6369cc4fb9e02b540d25f

SHA1
669eee29b9530dd72d3233e7258df4e02fd481b5

SHA256
49a97271fb7e3e159bcfafe54e61d6311722f897b0623b91922f67dc1bcbc984

SHA512
1689aadbecc75ce9d064eff8b5083ddf63aab055dc81f5445e64811d5075a47b4e5bee0a9b615b9a5fbdba2b94977568fb9ad78ca5d2d2149cb1e5868dab1d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
004b32e8981542492bfe74e38acb997e

SHA1
c8793cd725d5b8c1aae5941d19a420e15d8eba8f

SHA256
5bb4ede61d74ef2e169e43d68e63c94ddb76b1818625c72db177570375558d01

SHA512
54931c0f6956b06da51f4588c5105d00ef93a1db1823c234f4a18a42fdb015d99ebf2b79d0e51eb3ca9381f3704b7d5afe07a156cec92dbef64c6dce98343a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
86ae5a42468eff50bf0cc57215070cf2

SHA1
991480f7cbb9cbaa0194ab480ef9a8864d1a75d5

SHA256
79e8f6c03d73e47bf47f63a4d0f26bbd09e23512e36e7b978146a9484222c415

SHA512
e9e8d12a905e1803ed44b0232ce901c97d0ded8584ade2caefa238c161ebb67efbcd892371ca29ac1c9ad605358839bf1a84a35f8d2fb8f397db1321d5ab4882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
738d7a1242098388ff2281e0529320c1

SHA1
0f500b752ab7b262c612de037e7dce77bf0484f1

SHA256
865caf205eb740c4db9428170df5bb7aa537b4cc9c4b331c61caf3e179aef1b9

SHA512
b4724314319b615c01c58f4bac83191a3e63fc917e03453d288695b9b646fce0d18066da11fc65b1347029698d7fc5f442e80d97003562586299cde6a3faaf72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dad4f5fb65ede6a829b0cdc0eb7f489f

SHA1
6b0017ed899a532a7613aca02cd570e16e865a14

SHA256
cb11ad5221ddeb712f4fc3d4a6e332e9715c002df22b390b271edf2e4278bd3a

SHA512
e921d9fab4eba27c445bd23d47430e2bd6b7b83177db637c10fc9e25fb2e304814e0c1f61460d3e332622b87ba63dd2fcef3b90d148472754196970ca5bbbeaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
24a345492f2583b824bdd9a4a66a38eb

SHA1
65d9b16d774396aa7e3d86d3c9fdf6f5afe188be

SHA256
8deb5c458d89ef81b6c3ffa8426dc1c89012d47977b1e23c6f471c55db4dcd31

SHA512
f7f19c8bbb3d9b38e925af735087fe2a013026e513f1264f1999fbc9109df32090bea18a238f76631a9b6eef2154577eaad09377d3284b8c4b7465f908ed5e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
76f5b661c1b421512f8befa1e0fba87a

SHA1
0d28cad0b707a31f688142131d3b668d2382a581

SHA256
7683e28bb9fa207e081ddc2b88ce484aef4cbe71f50bd1393acaef96932df940

SHA512
be4d2882e5f0749960236481c8bfe70368c7f34e66e0e9a8569c92ea78aea89e9c013f53068c5384e04df00837bdea7337697e14446686d28ccf9452e278a108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bda76d8da4a2a0a85d5e7ddd248a5528

SHA1
b8cfb69154058c370a7b8cffdd8ef88471b74a3d

SHA256
f35459f29d54139613a313ab4c27c94be75f2e532b238ad55193a38155620137

SHA512
bceed661c13bcdfc58f1b15be6ebd8767597cd9843eac3b48f13fa3be8ff65c3738e3b7ffaf3c7fa49d20b447a9df0c6bd8632041a607a3368feea6434125689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0da5f3a3b39e445e85bd48a6771ecbef

SHA1
0a11106b160301abbe164f384dfdd58742db98dc

SHA256
f8219c3e5c6a71af7d00059c09643574d7c25db73e981f6b07297b1edca4a59f

SHA512
59d5760d1080daaedf622b8bd4f27e605148b9a57f2f0443db2f5033204db64df37e3725eb5454ad45e91984b34a4b79bc761587449b69b77a09a818952e64c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c83f8654eb4e45cb4c5c1a8cb2819a85

SHA1
353d6d5400860358e864e4970197af5e42d49180

SHA256
785fe30fac64de149fe5c5362676e7ff20c8a038a9acafa672cf8c84cf521978

SHA512
793ada023b21def6bd441197ac90b57ad63ddf1267a6e241aff3303ae4198ae773d58cba47927b68ff37f4f3305ba666579e4b5332690766d35decfc9b0e0946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9cb697d29905248287f1c01c660c41f2

SHA1
acf4e406f7d6cedaad4639796037d7f2f0363611

SHA256
412b8982c78ba5ecf80d792cdae36a1f5b286801a37f040c9bba971727d66f55

SHA512
b4c1afb93af53b29481892ac1a8248e37b07b527ac12e8f1ec6a5585129eb7259f5df64a60d79dfa4d6996e70ea61ea5eaf2058b56cdbe75ee06eda5d7651d67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bcf5870b6ae389b3b326345c778696c0

SHA1
322c2aa4edf25de0e738698523ecccd6f67fa8d9

SHA256
c25df26efc550271540f30e1b37ceddaa3bdaa3a4fa67d431514414fdf171160

SHA512
d99bfd0a38ace41488d0b5119f020ac7805cea5b4f7391ab9f57bd9e279ba1d2f55cb1d2dc4b5aca79310f49e97ce200fdf31b219ffc12bd38f86d5c1a9cbe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0bcb3e789836b2c6c522d66b0d140fd8

SHA1
4ad968c0299973f4d614504c509d85b9f4cfafeb

SHA256
4971d03570c2c36999b3bc970213707c6e103a0f600ff9e505538cb1b0da03a9

SHA512
b77546a341aa1d140e1f888914fee95f62f1040e538891d2adc75e5159f21c6ab506de4c8c8d1893e3e0f37ecde58a3fe4ad1ed004ca665da347bf7285d2dbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cc4c0259a20f793389c680b6cd96ad80

SHA1
70651cd66ea196431847ce4dc72ae4327bae4125

SHA256
5dd96641f8e4c0d1c4bdcdd3d4ad46861e134e1c11bd7eb895a80dc797ee7d20

SHA512
975dbbeeeabeb9ed084659672c421fa7cecfadf8455ef99091bf4536d5db004bc39e57f76b4eb1168629a43f961bf8e9338936909c7c9100ee0be0389742c2b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
db7f2aabe955d174340a2bae59398639

SHA1
51d8d1bdaf8b2340617b9e45077c6489ed7246a9

SHA256
6c24b0ccbce5457f370b3e87ce617a38314e8940ad4ecd4eab62d70958d5e0ee

SHA512
9978d9f2a4cedc4a093746b815a8ff10b7fb3427d961656320ef9f480651a9177d11fe72f4b6468a440db0fcd15b51d792e79153ce02dfeb26731b12f63e735b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
095ced47c03e35d40bd5c8dae4f7805a

SHA1
0cb92467d908a6d7436f9de0a953c2fc72f74f2f

SHA256
83656db789e80f3a6c039a55a7632bac62c7317f6f2873153536292c5220f790

SHA512
2bfc2f64c06689f18011ce74be06c139c710d6397d11a767acb528cb0c4eacd6fe36861156038926599440ebac973aabc732a063e49f13ccd156d8f4f11a6935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e2c5c0353835af447d70a9753e6d3ba

SHA1
95c7ca5da3acdce0430a3dee9cc0f344a320d161

SHA256
6b1eb0b9afed98d01cb279c615c72aa64a121894100e1a6e2d96ba37dff28e7f

SHA512
16d5dbcd681686e3cd93a30c5b2bf18f37ddbe325681c2630b320f4ee73385a0f50980dc675244428fae1b4d88141ab3c3cbe2041a31a68e5fa2da4a3e83431c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit