629afee66b50c51ca01a4cae9cf15d53d7a1efe7eb15bb434fb1c2f4337e8b80

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ed44c5309acc4584e0ad3c2e62fff1ae_JaffaCakes118.html
Size

14KB
MD5

ed44c5309acc4584e0ad3c2e62fff1ae
SHA1

45d7b85fdb7a0b77899862ab077b2094d425b8ec
SHA256

629afee66b50c51ca01a4cae9cf15d53d7a1efe7eb15bb434fb1c2f4337e8b80
SHA512

2a69db32d5ab900e7ccab73567a8e8114964a044d4e9118bb7fea9c5b445cc2c94e629859ed6e4aa9e09be634e4e2ece0cf8dc086876edf7353c14a068b2b77a
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vPmlKt6DvE:aioWD/ZmXg8SZQGmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09aacd9ff8bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b2e6849d9e41ead666a23ba4913aa8bbe4b87dd6b9be4c0900f373f7ef39c3c7000000000e8000000002000020000000f7965a8d63a415c0cd2d27a9c76b513bb82cd0d49fd8958944c6275a512d41c1200000001225e892aa34f85466ceefe010efdfb0a93649d9cb629a1722756db80abb8dcd40000000e1234a2d7204ce6294941226b5eb090032832e93bec28e95ebee5ddfed38255bc5d0ec425e646d63be72148113a7c14a42986839ba4a9055dd600a215e690ab4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418995231"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04A9CAB1-F7F3-11EE-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000fed8301238f239d7b3d1cf3032f640a24680202b54a0585c0a2422efaf6b8dd8000000000e8000000002000020000000928d26fcfe5e037b5e45ddb40177208edb8029282bb6187d51210b701a62e19390000000d0843976175e9bc4ccaf0c9ac223e121a6751f3af168de18b7370354b7742f94f5b41385307cee9b002c0bb850c910d77f9cccea3f12db95380aa5de43e3c95e20fa83e5443ae28215aac5135f4102fc65ab74c1266897a97c25c6a1141ebdd7ec29a768d175d72613c7d0854d491c35b7ae0034cb680a5450f20e70dfd5861b580a343a7c4f7e989fe277d7aa5230ed40000000a059548f25cebf785ca0b5fb742231f877e7fa11c7caa630847196da6094d1360c042ecb891c538871e55393340add4be318493b8d5e0e750a72d8378ba5b957	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28
PID 2508 wrote to memory of 2892	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ed44c5309acc4584e0ad3c2e62fff1ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1041ebaa26b9ac8b86bbbb22665d65a7

SHA1
cd68a561a172e4f2c603706ae02f7bfbe2b96d7c

SHA256
88b15354ced3c9693c6c42eb21151a610e62bb7016b81709b6a6baeb5a42db7f

SHA512
ca72b1548adea9073edc433362a773a1b6fb8f7bdff3278785f03bbbfb91b53615d95cfdf3a26752d9969a6db1e7edac93a1945594c23cf862b33f40d15491d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2e7cf2a70529cbe4b1affce1f79a424

SHA1
81ed70f342f29a40dd153ece70b5d635630a3099

SHA256
bfbee2e40c9a7e5adc3815d772faabd552a86db78b786bceea82fa1c19221f83

SHA512
079530933b6055383b405cd32cefdc901ad060ef7d029b533348d65fdd804abae3306d01a36b4107fe3a21b0b273937e03af7cf36b9b37b5c7a08907112a9aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a5813abda2b3492a55b363c4647419

SHA1
6d45d5cb5224d893e6365f6164b6902608ba513f

SHA256
3ba71cc04ea3ee3df30a3c045f69bca6c0b1ae03321596704a3d4e54f386a4c1

SHA512
63070947313edf8d3885b2cfdcf62223649cd9bd7c9f696d67000e4f75f62f61da9d50fa4777cca777430892725711918db40f650c0d2034a91b62522af1bd40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eda0a0af27d0447d089b8b57f4242c0a

SHA1
9fe5c8221a5904ac1a5da6dc72f61a2a34a7ee2d

SHA256
9eaebd02c426b590156a8a96b245371b44b49487cea8038a0968ba0a57d80ed7

SHA512
64624e7d2416c1a3276d997b81b6c8a4103a0c69842a5a8f46c4b58be7213713b3868be05043edad5e180663c193058302092bbbad2239d804dfdcc5ef3ed5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90197a368226d9fb6dca6dee6a72c9a5

SHA1
fa381c52c08b2fe903c70c851b488009a6c4edc5

SHA256
7bfe056b41dd7dc468d76e47d3d7cefd92154561d3f9fc4e91eaf7f0634424a8

SHA512
2688fae37c831cfded4d55313b0a38fd7bb9a5d5a6abbab8c5b629f9f9dea566acdb067a7b7a6fd6a8946163e12038520141c3caf60f8fac377f7816ac0eaad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c341739e59661d8bda7256a2b9aa2ecc

SHA1
d20ebc64b1ec99dbcfdf47fb451c9851f0dede4e

SHA256
c79d050251c702d3d37bc808660c0884cfc64990ba689a7cf9b521749f8647b1

SHA512
b31e6e11f2a420e1c988820cf605c398399d7d88f422891ad62feb6cf410e38efeefc10a4147aef075f6a0802bb774e0c18351768870307a811b5ae29b37baf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8819e80a5055a02910eb32964b6d0ab7

SHA1
8c5052473ed3e463a748f2746d20ebfb1ea1567a

SHA256
a0536cbf3fa939dc394e9915154bb52d9c65eb8f2396227cc8473b1590995d09

SHA512
4d1e56666fa53e8bb71a0894b2b7228d9706aa290cddc63d05954e19d513fc05ed877a24c798d877ff427a4fbca989822867a19752400a232ada9047c9875c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c61f33553bd18ccfc322d081b1b68f29

SHA1
2d1936cd727f7e89d1831fe8a32f7d1abe1c54e0

SHA256
2063d57810315e895ec9210a69dc4e74163cbbf922578073cb665cd3b4e5a272

SHA512
9a2b067974c5efc571b8d33fbf9f6dba2e0bb06cf4fb9298f589ec9c592858470fb0b9f7d1cf058538b41ccf29f3094b98602175610ffa0673d6687cdc194cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ade4137761b1854e34a4b38b724c854

SHA1
d32af39a34132f238031837e39c42a2ffabae6b7

SHA256
d4e6dcaa038ba3f27f467ad9b62b10fe4031ee37314b440b61510f734c4b8e4e

SHA512
befc4f7f1ab8ffd87b426d4af6ab6bed6d0f2e534ca8abedeeb0a60e7b5d5b6c33d06ca68ea4fcbc980c92a4695b756f411aaadc1bf877af528999ca1acee588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f0e1f4ca3fc133fb284bc53015b6a41

SHA1
ebc565c69e806dec2afe6c295d669888e1b7cfd1

SHA256
2b069c7355b90202ad2fb899f7296863ce5ce0f1e6345cf0f91ebdf6cb7864e8

SHA512
c4f357e36a3fcab512de4c6b187dfec239fe49ba70f343c0cabec0574f2d5630f053b05be8b70bde9507da2fc38baa0889ef04951f5d22957d65b100236e061f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42361135fba43aee3ebd674ccfc2cf65

SHA1
ea982ef42ea48c1ec19d865ab8f2588da7af63ce

SHA256
a489434e8d71c400f9d2c79548e284d6c05ef93cb4d0b52727d069e67eb335c3

SHA512
077d3a9fcb6e7fd44c5e792260f5042386f74a59f8434e6bb0148a961449f2b7839f065c27650f2f23a833a83a156fe50ef927844a8ed55dd928b4bae14ae733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b76cfc813aaf33baac10c6e14dd2907

SHA1
905d67a4baa76d35a7c4734abd28e405a0c8ad64

SHA256
ed8e72fb48b4ab3e7684c8f7d287346ed6fae50455fa169be5ac0f48ade4f4fa

SHA512
28a5d1fab413b606db186518f43f62037cfc49334a4ed29b830c5b64b3a348581da8f681af148af2a7b6369e2fbeb2c5949936205e090ca921d3fb35b6d71343

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACA7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE24.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit