59030ceae7a11c5abf762747bf62110b58ea6d655034ded47003f6d9fa4a41f1

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41c1c1ebe64a8d8132cee0b4ab63bf22_JaffaCakes118.html
Size

66KB
MD5

41c1c1ebe64a8d8132cee0b4ab63bf22
SHA1

638145f228b8feb459754bfab1337dd9ea9c62c1
SHA256

59030ceae7a11c5abf762747bf62110b58ea6d655034ded47003f6d9fa4a41f1
SHA512

ee4c9822eec256ce8f3ddb4c8ea1453bfe238f5e28c780499c23d8a80948ee600f682ba69ab97282471d9682beb9aba30d972979adf9a7b6a4a780442f0a89cc
SSDEEP

1536:1ebEyUq+C+TfbyJhbe1gBuoQl2n0zPlhQZ:Dq+CcfKbe1gBC2n0zPlWZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48D19A21-4117-11EF-BDF4-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e03b9223f15c49cae698e21df1e0ddd85fa1c5656d00e339c214c69c49e3d67e000000000e80000000020000200000003e1f7c9e5b5ab266fac8cc34e14d1e85dfeb87d2db98a571638555bbefa6712220000000bbcd745e1ec148ed0cd35432294394bc6fc168842951258e0e46a44ca0a12a9f400000007d1ea869d65081a4f63badb080f34452954dcf8706eadafd4beaea83c6d149f9748145d6b65276b2e1cdc1b4567cb36f274996b6d2dd189ed6347b07df9adeac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b3541d24d5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d107c77b02bde43ded4ba52d1154f645236689f74f733c18eea606a229a2149e000000000e8000000002000020000000c6e55b1c206938170c45e2337895803aa31b161f71b3716a5fa04f3d15c8e9bb900000002cacc5c1e0a48c3c9c85f23261a83f961d5d20846d4733f63fa659dfb2e459a5a9095c4f90af490642dd7d40f1f178a4740e1d2fbf7a3a40884693e4dc909657712fe02574ec4e0aff7a0fdb77d9069e357c4a34271144de99d42cd150786dec1c28a562ede77cabf50cbccc481bb9e30e28a606625f5af4f84ffacb5954accc1e0a1e5752cdbfbf7f6da0cad34a4c4d4000000090d8b6d3743672aa014c5f65c1c96e3523da7853a3b1dcafccd009afa784c385f38df4d9df5e8d218cb3c9b436cf82939041d6e9252cfaaebbd5a955d1f83684	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427037241"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2904	3032	iexplore.exe	30
PID 3032 wrote to memory of 2904	3032	iexplore.exe	30
PID 3032 wrote to memory of 2904	3032	iexplore.exe	30
PID 3032 wrote to memory of 2904	3032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41c1c1ebe64a8d8132cee0b4ab63bf22_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e01001fdfbe947696968c27f736dce5

SHA1
a99c66bec94aa847082f3c129fad4d20bedc55da

SHA256
59adcb6b02438d9e8006c5750f9293f54f95c9d24cf94acbf960e1d80d64ed24

SHA512
01e5095ea12be9a5269af9ad53c69b2bc37b4794729d9d1eafae28e082d2e8f71918b7ec2e8a174284f6cb412c701945ab8a0ec9558dcadde0dfdfbd6dea7491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df8a45b147fd546484c9330304b1c436

SHA1
e95c5f4936c387dabed6456f716d550de3e85598

SHA256
f870d4e0318159c37f8f1be385cd36d1a50a2db6d1a49be6e1cf9e24f7ce6ded

SHA512
a9e7793bc2f43cc83aa53326bb0094cf391f503244bc109ccf68cf17b876f9ab92b522fc6c124b57d214711e2ebfeac1bc93336eac8cc8c2457eb57566a2b80c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df5cc4dd3592ec3ad4a658ee7c7d5072

SHA1
4aaad106c208bd514d0512a1877844d9dd25b767

SHA256
509589a16613f59b38dc721780c4af1ee4b04a0c21969cf84fd1e2c02d12aaf6

SHA512
501a8b52a361f0d4dc825c5a9e1f6cebbad7bfbfe9f0a17a3b30212cb62d12ff12a223957b8bf57da20442980c22dfdc359c9172d752714b4401bbbcb81710d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa70d5ce6bd691b9e6d2ef782b00ab89

SHA1
568002e9d6aaa2bbca3a91b902ffa1ab47a7c18b

SHA256
65c8a4a17dc4a01c0d734f6ad344c77c4abba0fa7b01c3acd77984626c9ca610

SHA512
e4221206bc13b6d9d1d8f43f7c13d8f2700bea2fcc21954bb1df9d7e12976b59e49b77adc5f48a492e39c2ac4dde5195c6976dd7d1c8018a2c49b63cbeae8eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5e4d9b6b23434be9621daaa13574a33

SHA1
0bd9efc84009eaa443e277742048401e9857ce9b

SHA256
e98ba85f5577b4593eadcf2d4af4b17556c610a51c80b4823facb4e9590d613f

SHA512
bffd8e0f56267b7fd2e56977cce91eabb8c6713fe98e182d5bcbd17891dfaaa6e46ac7671f5ff7a65ff6579101fdf953100e6cd0f119e25dabf407ed092d2bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6141fcccf437f5315f7e20a8929454da

SHA1
f0e0f3d02221397625216c78fc1e25c416747217

SHA256
3fbe9f05d7917bacc1d10dcf1abffcfe3bb6652c397ff72989d37bd6b43e9647

SHA512
1b53c8e11e3854f5e9037e232df7251ddac59df0f710a238f270f882fc353ab8221e605f80632734f0186fdb89fc2f195e5331d36acc9bba503d9f9c756eeb62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
494ad3357ab9a32000b45c42d23cddb3

SHA1
1768e76408e46af8f2dee38b1b1d2fa55fe2bffb

SHA256
ccd29355276a54c8af832a60a0c535f31ce4264953d3bc60b1f0e32f55f9a054

SHA512
e12f401081e5382a79d2e72914f441b1eee15a961c3941d7864cf99e6c74e05c0a20093d681777f47d4411958a14b123f2a4c858273aea73f5dc94b70dbc2e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f4ca4a5bb0c2011be5a3de02b834f47

SHA1
c45974e82efefd77c9a446181271512b53b2699d

SHA256
a0381d669bc44f0ed171932aafd29fa040e0c9a63656dce01542cee2a4bd0b67

SHA512
c39e18f3e3bec2ee0105ff5b350b3a82d0e7a175e0c4a6abf43fac58e50c32a942a0edb0365df36bbb063c48d4c383f2cdcd7569fc935d1de334cc40b2193e87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e8eab8fbde549ba2fb097e63cbcddad

SHA1
74e07299e36148d42629161c06012bf750b0a5e8

SHA256
0ca28a4764ae1bf9ed2db3b2daab74776117c0000bf001366e8606ef775df7fb

SHA512
151760456b0ce5fc843b426c1a3b1287439a37f9a2bbb2aeed679c1f1ec0929ed9c103800b551bc5ac364c9f2e533c1dacb1de50d309446b0cf56300c7aca51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2d770355ff5c4172af3a01ce7fbb427

SHA1
8e301d9eb9283c2fb1e3396f8f1eab22b2747f2b

SHA256
d6585c5a9c13ec1fd8911bc7ff7c2aadd7d5de09e4c058086be5b0bfcc3041ec

SHA512
7423710452b9aba8993cb1b0194eda0d970dc29117a34d29788e70e60d4e7c64c5193fcbbad2e29d334287689350b29dfc2cba8a49304d0faabb115f098d1ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de21485658db9d825095492658e677de

SHA1
42118e250243ce29626ad607a9691a9889e9f0c0

SHA256
7549bb2b0d84fce749f3ba00a5d1576f5ca3a1af317f05fbd8834c5ffcbe0b2d

SHA512
8ef2ff5e0b134f9e3a48940d5c14806c3eec099b12ec7871caa4e714d886200c760bca1d85f68436ee43acf5ef3e0f649353fb97e2b2f7386e4887b36f57039c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c7fbe08dd2512e65d1829020a0833f5

SHA1
3b3e829ac55624d33532fdba70015f4d48793138

SHA256
bf1e83b458871decb86cd877c231630e77735ba5f785930a7d5a8d399406ce3c

SHA512
dbaa38fd9e78cf8ef72d1f23aa2095edcab0e94747b7c0cc15966e9b4a404e2cc8e0a335bd29fefc68f3aaef8e28a1e22a533860eb8f5cfb7e23a99dafbcc3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d468fe2e1005e4af853ae804eada887

SHA1
b243c37a459f436ae8bd05f4f9553cb1daed9618

SHA256
8d895fb190ccdb9c447267ab5cd5ce4c3f07bd67ab0f18cffc90e3849447452c

SHA512
1018169120aef2ed9ffb07b5bd0b8051665b8ee0e2952f2d458f98e3dd085f2e3500c9b3633f3a1887e68ff2a73c573f1ff5546bb35bd7b65187b105219e71bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CC1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D60.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit