2ca80230e5cdfffac49f4c2db9ec7f62987ec066adb302ddb5df45e9046eec69

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c99aa1f3b4c42a9b5bf6236b635bd3f_JaffaCakes118.html
Size

155KB
MD5

4c99aa1f3b4c42a9b5bf6236b635bd3f
SHA1

4db843351cb9602ffcb4c89dd2c68777bd7172e9
SHA256

2ca80230e5cdfffac49f4c2db9ec7f62987ec066adb302ddb5df45e9046eec69
SHA512

969d356cf208be772b4157d97c82d8f16cddd307e288562ea6f8c97735d884156e9fb4aeb81f949b81bfdd27eaaac6bb173aab54e3cf07efcffad852e26005dc
SSDEEP

1536:0jQNxiG5WbI3Pfm+ijwiyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wee:0UNxHc9yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b32e6e2fd7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427261915"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65880201-4322-11EF-AC6D-CE9644F3BBBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008f65edcf1ceaf3058a0302052978823a093a749e066be1491a80f45d830150cc000000000e8000000002000020000000908732abb58f9705860ca499891973b60252c8d465312f8e52dc38257145421420000000b3dcdc0fecd3eed758a80f98a5b8c92b3dea7fcef21664a8ed2d314a7a5cf8fe4000000079c08303ddce1b427ec6f067ef025dfbbe1dc5e13d6786b82095a15cafdc72f811cb1df6ba6c8482faa00fdb1f3363f0857c6370748b3062293d163086fa1293	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000081bcc2a9acacfd25a1fda3db62f785884405a20ceb09ed73c5bab2c025c63848000000000e8000000002000020000000f1044a83aeb915ac0b500a40c520390891a1efb390841e31f47e409564fb1dd69000000097227afaa4aecfe91297a4db30210dd319b9d8ef6bc4e25bc1993d51b331420eb87ec45b285f1fa0b30b2d2c7a579665d78fa5152cbed404397790ba7cc617654fd99d8c349470db56d23cf1383ea964a0f2d985fcb77c722f39f9da61b5f3c6e90372c26d8f47c3afae6daeaecf05fd7b71db31ca3ccbd063116d706954bcb67a0210fbce5bc0d3fac540e039ace96040000000eb0dbef72b6153976b89c6b412cf2869d5c1ebc3999fae82c16199bf1422db56b986dcefa91843c7df7135b22df4fa88e5018dbb3a79f69708d7b784df043887	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c99aa1f3b4c42a9b5bf6236b635bd3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd2bb34a7b9eb37b5513156fc2aa1c4

SHA1
bd9207c43b9b77f844b9f6e0e128599c7780d026

SHA256
8d0a0c5cd42ad5e13c69c72e417f2befa1a48efb5a17bb82851c961c87d44c4a

SHA512
cd19a2bb94081fca1f79c25595d4a0910ddbefe56b9917b20be377a9b4b6000022df6efc114926e235432ac694b1d6d410a14786f14fe295fc47516142466482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27e68a2a3616c0a47fe0e4c27c9cff37

SHA1
c818823319d8de1c7dd7297eb52ed99fa4cd7781

SHA256
639dda908471371c8443744df5f871196b74216c0f919183ade4bacb5759657b

SHA512
15fa982b07d03a26713f8baeaeb5048af6defe13d9e1fbf5ef842f19ad11c6920c4253c1040e8619bd2a70ffc94f8eddd3600d03a190e566d77af4b43e044571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6112cb1241ee2a12bfceb6e6555b4a2c

SHA1
d27427a1ff30ec3b5b440a86c09185726191982b

SHA256
b35709f8db36b2b6cb2ac06a57e7146587c9abc24ca8e3b71b37c11014bfabc3

SHA512
df9e4bd273f1c0f907698470918a18ad0064cce2d01a72c68d1c77a76956a77c81a14240fff0ed598d2373694e41b7abdccf98292ff5a953b2dc3454ea997df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a48559cd6f90b9b4babecdbeb7d2c1d9

SHA1
83f0a7deb46712da8000b3bfd9649aae2eb66277

SHA256
affe4edf7b39798769e15d02dcdd959906a4da3446ace3741aea4d0346d17c55

SHA512
e9cdc688869f3860ff03a065d74ee2a3eb9fe636b2cc2356e8b90ed10e2328eb6c193d203a69922f0985c0fdb3bfaaa68e88764a2491f78b6a7db21d454b60a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d75ac29db7b3144c6e68137cfb4be3d

SHA1
694051497198f35c42ba48e95bfd5ce90b7acf96

SHA256
2bcc2519232a665f5a79ec91b070d0fa2e65370d6234f24818e8c99fa2de7613

SHA512
af64d939989014665343dc8e66abaf66d2672f9bb54a5e6d8398de1da06aabf4c674f45eb7c2c94f063f1aafdc3eda2041db40321ae1c23fa0b84fda1905f27b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a19849acdc232060fe1ee923776bdc6

SHA1
2aadb54ac9da3f38dda9ba3f530629d435932733

SHA256
5b14f7f99ec39c427bc7152e367ecb1bf954ef454c9bbd8eef8a72a2b327f952

SHA512
1848d68847bba864761b04a598620a7ed8ab8598b4f9aa8b31cfd2e9a9d3a0293872e94b47f3aa01aea1905d61f43f403cfee5fc2fee3e89ac43f9bb7b31ee8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f6bf93c252e22ee6e26d0a5f6f470f1

SHA1
71204672e400f75f69c802750173b320ec9bc6f0

SHA256
86ed276a554e984cf6fd34050078626b11900534df523a29be69901f6b05b08c

SHA512
68c07522a8c3f08f4e0b8c180b7a4f959c1545acd731a0f9a04e8071f218ae57a1b4d8da56ab2d68782902e1a40b0e43f84433e0cc25a9fa0a47147e66c43dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
714fde045e1c02ddc9768faeac4d345e

SHA1
ae6fac96bb0a493435341db6a465b4dc84955db5

SHA256
90adae4e6a35aa733cac37213cac58a54b406c422370319fbac203a82448bca0

SHA512
cb1fe1d5833cb7c743b0bc98884326a83c7e39d44f36ba37f9ba2679df80be06b1213380fc5dee602a80ceb9ee11dd2419a038a4ae826af1d45f4424e5005f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b280b855f1a2580c1f071146b38c498

SHA1
2bef06b0a25f5f729ebf55ad7f86e5786b1a5ce0

SHA256
f8c50896ef882f7acddd20e5615bd61d661af14ea9c48b70025366432fa6c3dc

SHA512
3822cf605f20c2f424b03e67c0b952a05242ff255b55b64b0ad2b06503ae042ed277da2873d775cabf91a1a0509734a436a00144bc566301b2256759d2737e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB4C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBAD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit