3228c11ebe59f7edbb6a65487df35ad8881863e4f8fae1fd4ac63322b2ed8295

Analysis

max time kernel
142s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c03733ecf9d85e0df2db6cca0a249a8_JaffaCakes118.html
Size

37KB
MD5

5c03733ecf9d85e0df2db6cca0a249a8
SHA1

3b259039f8c56f4d8beb7681ed5dc7e369691d87
SHA256

3228c11ebe59f7edbb6a65487df35ad8881863e4f8fae1fd4ac63322b2ed8295
SHA512

1e212b2a504f93784445d4f5969cd860f922fdecf1c884a8fa8f406911ef6c7645f3b822f248e64e1552a219396c596e098994417fd72e69b5f5f354f0db8316
SSDEEP

768:2rDvSmw8gH8azZzrkETWUTOKW2BctrTq28d4ZR/1KYETXZn2wq12kDok7t59TdvC:CvbwdzZzrkETWUTOKW2Wq2M4ZR/1iXxL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002b4fc8bf909b0dcd03c56f86710deaa9e8b83c5f84b7fd38c436e7e3353638b1000000000e8000000002000020000000e7483830c4217b1c420c4f4e5da0fd93c9a44a9365327e68de4461ed8b5718bd200000002e41a41db1915ace2e7e386e31c8e089f409be22af3d1201d11987961f4d672040000000b2bd8908fa611514a77aab99d453ca68dfcf850ac4772ab16674303f27f2521be57f8a7486db9fa5bcb8650ba7ab28b8a2a4b7769a1e5094660c19d058f8438e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c7565cdad9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DCD6E11-45CD-11EF-8A22-66D8C57E4E43} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000001316179070628f0c7c5ea0277307a1f5af030547f8b0371466cef1eed864289a000000000e80000000020000200000008bfc3b5911e0b9e705a4e07e8be0f182049c47f5395c6f3e72b85dc4c86ef6489000000099b31b4d06a7764d24fade3144cf0620465dc7f63010fee3db65cd1da112cf4fe85facccd0e8e4bd27c79091497e42e3ece806dfe74fa32a43656937c3edcc18f737cfc687a1e1e05103515769bb53f0ead0a5205cb5ffa4edd33cbd88032ed6775fecb9398cb0eeedc9e0e751e6b3a953dda3adf56d78e3c37a3a47409458ab40034d7c72d20667c5e9c543d801f2b940000000a91cc9105e9272c37a36e47be749f63729ba53a7703fe008e99cb3dfbfb8ac1f6fb29517bb6d2e730443e6f7f5404995d2afa94f0533951f6f8d7af27e852efe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427555311"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1252	1984	iexplore.exe	30
PID 1984 wrote to memory of 1252	1984	iexplore.exe	30
PID 1984 wrote to memory of 1252	1984	iexplore.exe	30
PID 1984 wrote to memory of 1252	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c03733ecf9d85e0df2db6cca0a249a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c319715290be23a85bb021bf0abf8b

SHA1
a384529bd42f1859fd158357e6ffb765a560d5a2

SHA256
a74d8753166b81ce156b9b28df930c71fc9202c787c584c165d9d19ddfa1321b

SHA512
f448bb72bbdde40791f0467b951088d7c850722c8193b8c25b72c4bbde1617a4077559c8bf9a6db0c026185e4226d84b4a6e4ed3795f76106d9df93ca02a6897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf73a0242f44947f0d9dd5f4cacb26cc

SHA1
16f6213d975edf91f8c913ab892dd69a3b0273ef

SHA256
d43d3d8333aadf494b3bb0557e5f2fd321b1175c5efcc13711d361f3f2b29121

SHA512
e700709d373451f971199fefd5ab08a4a2c17bea05cfa401321bc2a00912b3454590735d2464e57bb585107e8bf9c0390e075142d6dab7950ef562012c94e60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf056c37130489e1db7a5f339015fc1e

SHA1
8ffa7606fba3a7e06fd69c7fc728b371e792c302

SHA256
154d7cf14070e28667b05246ad6c465a3529db1f0952a5308ed40a4c00e8bd56

SHA512
83283c4f9ba822b96bcdce6a5d6469c06b933c51218eb015cc3b47e9851ee351fb249c8254d2e4d9e2b4907efbc013a4cab12d978ba61c904843359a8441414e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f73704064c97d40934a893982dfeb525

SHA1
ccfa53b4e242cb2c4131131eb05017321bd7388b

SHA256
e7080bf4922448ee36b55353b8777bdfaddc7fbd49319a36e48abd46e6b552ed

SHA512
cd07b51a84aaaa78d59f82b9a823613b609a54dbc896d930aee18a727af3d5a02873df1950e2fe7d2c996f207d838a6aff61ab429b22a7a3df4f20a63e1f594c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0006e1aa2cdef8a318fbc5669be1ae1

SHA1
56005bbb65639d65894bf9dea2d2bb3b1a4d1d4b

SHA256
d74e603403783e3d396433b39ab39c76ffec2e457fa9ff3eadb852413f853349

SHA512
f8811c2a49514b5160b2779aff1372f8b4bfa65a3da7f997df0ff81df9376917e2ea872febf25634145502252b71fb28257f16fa7d06a8cd78915d46e2f265a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b917cbe410fd11a83c189bd938da7b28

SHA1
ec8666687067f4685b84897a8e6543d7792e0f25

SHA256
f6d1473f32eb236b6dd76c9da5937909f6d57d6b960fdeff7358bdba7b6759a3

SHA512
9877fa51505966d8f3267a08e7ae110c8e64a6f58841ee885a4deaa8c779b6bbbe0ab89c4fef2b864d43d60835849f491c4254401e78a5c4a41980b200d41ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf998420d98d431e230c677f8e0dd50

SHA1
128e3cdd445a411d29749de7a6ccc1d04ef3b5cc

SHA256
f2dff6d2aee5ca5eb6f3572d14333b0a56647b5c4b546a65809b10151576fcb9

SHA512
ed3f4ea1c2a28cd583621f61ea620c3d018e92c65e1f5a6859fe7a73e6c7ad5045d8d0c6d13ca84e15546f8331cd10c59148d3740847d14324d375db11f4afd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1290587c3155bcb205a42189b634d5c3

SHA1
055fc397f0db0c110cb6f6b26774583162e3cd62

SHA256
34547978b4293091b8cdbe9b15634ad1858fc58d4f52ca08f37c229cce6b71e9

SHA512
d8b059d34818659fa62bb10a39563a5eb99f09082ef4584317ab21c0962de48e303051f3ce6def98d3d76c8ee729d9e1292127f924fcec2ae180002a2a0817a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fca6efae4eb0af56e734572ae6e4ebf4

SHA1
e87871cfcb26ff07e16af89608eaa745cd97b40d

SHA256
e78ba1d170a281a961e3a42ec3a37f4258dee743c9ba133a006432411c6d65c1

SHA512
f2a16811796b000629fae0fd2299a4bfd305d33f8f87f2ceadd210970f00ed46825196a8e49d4dbc2da36e023596f62b6f43c224503b05960ac049cecc4adff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd47b7bc0f412df6df7f071ad5d12909

SHA1
51e5a566e7e4360393156838438e23f31fe6fc27

SHA256
d4c9fa6a4867e12d146fe931799c224cb5c9a908e5b01ee2109c8c6375b1e785

SHA512
945c20fe732fe700a159322e9c1b5cfff681bb5b6b67870de87da4a27fa78809418bd7419db06c71e1a5774bbe43479c9b40fd46c358bc4c1520978be57eeab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddf239ba452422bdbfd3d9a6eb4d6e18

SHA1
be71d0795f5c884b3cb753f49d5f011b8eee1348

SHA256
19cecd935afb3750f2d9599deed4dd5905eb175183f45900205b8bed62cda48f

SHA512
4e069f2edf7f2e796d14c89ee74aa32073b914db2da96b7c0a372dd9780bb9b9398c6e5a483fdc1774055826c34a7e69a153ef3a1e4ace05d0659e1468de0561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb0aaec46784e6763b3965d8d1daad3

SHA1
d8e1855f3ecfddc9439e2495dfc0ad3b79b98cc8

SHA256
3d0b413154bf91b73d2ea73faa153225c2ef01777ce8addc0989aadae089bcd1

SHA512
6e21db62524695a0bc6692a777d7555cc0e97884cab2b42f0c26fae5214004bbbd658a04184f00d864b78fc02bf6caa3039bea05b1d6423a2f2eab72b20ec3a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf0b45deb477aa6d330f18d4eb36f4d7

SHA1
25105c0016f0b488a0289045a6c1ee7e2fecc749

SHA256
dbd257e01f3474ea0d4188a73d1d28e42f12daab8ac76f134608f91bbe1ad523

SHA512
8ff4d53088512e52b41162e0d8ce3121b5560921066bbcbedb8301d687d8aaa047926b987823e6e3e1d6ee1586cc824764b5022af210c3c4ba9bef84c1c3e31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA5A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit