57957ff4897981c116176d0ed4ae66a6dc4a320884a72d2a34d8c5538e0cae18

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42914f338461d22650ddb670f057887b_JaffaCakes118.html
Size

10KB
MD5

42914f338461d22650ddb670f057887b
SHA1

af382b4d1e86f642c4e305d2390ecfbf59450131
SHA256

57957ff4897981c116176d0ed4ae66a6dc4a320884a72d2a34d8c5538e0cae18
SHA512

f5ff4845985b462d446db83f4e05597cbc09558b92d0579c33dc6e9d18447599bd9dfa59ef524ed00b0ccf22cdee736f2c23952a2b3ae68c2ed8e1f5b1018a3a
SSDEEP

96:uzVs+ux7RvLLY1k9o84d12ef7CSTUiGT/kzUp889+ssZMKuKHlVHcEZ7ru7f:csz7RvAYS/jW8VZMNOPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427051902"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005ecb7ff2072374cef3c85011912f6b927d9363d903433a8dc7928c8c543f9394000000000e8000000002000020000000969aa5a688c3d23f544cfa0ccb6b98e308b3f8680f155aa5822a630dd6931ae020000000072f5524d7f6b15f179ba0bf0204567b9728666d1820941bcc8d6a476b0bc1294000000094a422b285e0344e3761eefe607f0395b86d469428a28aea15632f8ee4e3eabb79f8eadae31063a41a1cd5e91a10363383afe5c17e656ae3e7985861ae90edb9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a0e36209df32d205a9ac2fa5fffc7103b7afba7525c5a27180fa6f42b269963a000000000e80000000020000200000007e171874080b178e7216736bb4b75590c3e3db10ce9c5ffa6e43c3f89678b5ee900000009a2f4b59bdc4f3c796ebc745fc90fdbec4a76996810961854c917dcb9d53a96534532a0f783e433b698525d4458609005cc3e5fd2a367c31ca28ca52e36a62ff615018d4d391bdf1f6b35e1d4365516f38425c559e86e0ccf132b7968b8401e07d756dd69c22543547e855efb54e074b617fc58309644cb6ace66f393307cdfeb2629f3fbbe2cceca7ddb5b502ea206b4000000040241e8ac330a3845d2b31de9e3dfeacda09a2527a2ba04bd60809fd858a0f7dbc46d1873ca43217a38b6838876429378c9d988b8a6326b3f172eec86bd7900d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A4206A1-4139-11EF-AC6D-CE9644F3BBBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fbcf4046d5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42914f338461d22650ddb670f057887b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640b6c0120fc35f5fcf0e6f636a5edf0

SHA1
6264b53998e72bd8a50f2a22c6430d5067cf332b

SHA256
f438abbe413e225598eb47b0bf461c5971d2ff829b6d93011b1d234d79fb0b47

SHA512
5bf2fbc85c3b5cd08de9a83c262f9f485cd70e49b9d2cf9439398dd7de1862935f061cd98451968c128ec468d2278099fea2adb191fe4f70c93b2c144e2fb441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dc6f44a1b3fa59a038e8511656183cb

SHA1
5a71405904a1edc56034cfbc07a45826736be824

SHA256
9f35933c27b0f0b95242e726451dea6164086e700a04427bddba2950dce79fb5

SHA512
1e860457a3dd59a2b18ef21b2e0da4987166b5f764efe61a4e559ff09b62ca07404f9f8eec331e6404eb25d051f7c8508e0cb225edd19d0f711ac27c10682fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4655a281f05b5dda3122110c7ca5fc1e

SHA1
99e2cf1081987b3a8e7ef6db9498d493f1dac179

SHA256
d463c2a4e2eeeb5834bc46b17b843a195a5ab14519fbcf35f1620695ae2a678b

SHA512
40805b3f7b89e37d01d81dccc965deead971436c003877e2246d663de9aa1f3cfc81909831d591b376572e7248909ef905b0bea8ed14800eb591ddff040c3018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61ff6bef014093f975a7e468f3f9a6d0

SHA1
c1b760f768392dd120ce17ccc65297f44953487e

SHA256
1044e8d9056be14d15b540f5ed0fc29ddfe0ca8bd04d90242c7ec36cc5dc3c6e

SHA512
b0b705fe270aca63c6bef9299762cadd29293c95680b5c12f1d50302fa508480d0bc25b5d7d9982701d4b6f50f5dca85b4efab94a4c83fa0131c18f6d1519705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
896d9eb65313bc93950759db52bad52d

SHA1
80482a795cad640b5ce46a13a61ab695b3bd10c8

SHA256
dd01ea9d1148f6ecbdc3de1d770c4bd3fb7e2bb521a225ec0885d5945a9816dc

SHA512
35f061931a1e129556b44d9e3f0894511dcc1e1af35acacd8f3523cef9b50084533c2e731fd3d810adaf422997c4af21104fc03885a3f3478fe2375835f9e4c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d923edc55345015dc3379151229c339

SHA1
f2ca63f6e118e5d21b558450356522a4eacfcf9c

SHA256
9bc72ca78eae1623fb2ff84eb3efbea6b4ef224a1d573c3563038101398fa961

SHA512
b132f2e21d98bb969c0c633f1fc15fbe965a15a753b18825f9dae23ae113bd7580bf8af4e7f3cfd22c850bf4671c697b54c50ec2ca43420d3583d7391296c909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0a07fcf43ce355b08f6b42fcfe6b8c

SHA1
9005e1ea3c1831fdca987a8288509a86330a27b3

SHA256
288487c71a5e0d1b3e7c8be6f60c7514a7cbcdd21afe57f0cd7455abe6d806be

SHA512
500e6cc002ef5bd4fe2eff51f1454bb174ed2fc5425a654844a86db31a7f33ceb136cf1c199e2360ae537a0881f20c241f71d2cc92b60e66f9c24528cfa89f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9733ad9679d7a1d4b9d05c64b4c323f7

SHA1
a84f1327eaccfa5064d57e9b43a81204ff958353

SHA256
8e4494696c6c5de48bbafecd934252946aec168220cdfbca3e183f96bd246733

SHA512
6921fde3e6cfae275a3338b01b14ff28d16d766442858b950d86a4239b6c3779eeefaf69968eaf9ee9aa61a7a8347b5189a5ec76039b180f6312c60b024339b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ffe8c373a410f77bb9684c7778700f

SHA1
5302ebc0a2e8a105d3fc8625f89ecb1954ede150

SHA256
7509b3e069bc66a364986d811315221a4dbb8bda8f89afda764baa8b36b69d59

SHA512
ab343dd93796dce166e7fb9af6991c7e53c5a94f6461e5c7242fce458efd154a21ac596d8e1a8848c0b8d21cd0121fa95b859be56e8f9c90b4bad2b9098a2944

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFBF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF01F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit