27aae40a142f01abe290dc2d729331255cf06924427a617eff5df003e7b3b2dd

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24fb7c18c02861f97c2f4d640846fb6b_JaffaCakes118.html
Size

39KB
MD5

24fb7c18c02861f97c2f4d640846fb6b
SHA1

043d661a4fecf0bdd1b9496016f93f19614b3e4c
SHA256

27aae40a142f01abe290dc2d729331255cf06924427a617eff5df003e7b3b2dd
SHA512

64ff27162544e097b9a268027bd3733b94d9a45e86939e9e3678ad50bb42b78e665f25d49c5229e32fc75b881ad1f164298ab1dcb11416db3b863fe30c883945
SSDEEP

768:agl2KLF0ujrNwygRRSgNiUkrCKCKCKCKCKCqCKCUPCGC6Cl+R8tWUmEFynzLWcA6:a+tbrNwygRRSYiUu33333tlXVtQ+6tn4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000525132e6b6dd1aabbefaee209437f847e3d988c192b4bc7fb35e825cf54a9903000000000e80000000020000200000004377df2c2e6b2ed0d572f164d6f5676fa35fb9df4d1a6bb3fc81b6e85e49ae7d900000002d47a9b4cb6200ba5f80d6e2b41f43c10f16c7b047f78b821dfd67286bb4d7d8742956ecf7f56e3c76d081da1e71ab766ad4a95c499e862653470dfd14fca53a356ac5d2671e3e328e7fca6aa8a392ca59d5a8606f6a054a7081efb072940eb76e201229a1ca5aa4c4179375056ecf9b5a13e0358fac1f54796deea70e60fc07b9cfc985956456be514597a71cccab0e40000000c611e3b2485fd11028a257474e0b7c64330a3773ccec75ddf327257528e98e51afe22548c2ea438b6f9fadbca96780594bde523ab3a85dbea9b595d27be5fb1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421335659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000069ccfc68d88fdcb542b9386d2312c0fb1c6efb01c6c4cb624b76695e3bed0b30000000000e800000000200002000000088cb6b9e5b535ddca08265b4f80f5ddb8d82e365f9591a3c809d36c3358a0b0620000000ce58c03618b0803276be8421609577511946c55b46c45039a04abbc1f5cf26da400000007f531947574b2be0ce4cf9080caa889ab5db4fff9463bd2f17289f1d305d96fd65dfd09f2717745c3cc3da5c8c58083ccc8d0a6b071906a0a6e53fa9ab7d68da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{408CB9D1-0D3C-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5016d63849a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2556	2256	iexplore.exe	28
PID 2256 wrote to memory of 2556	2256	iexplore.exe	28
PID 2256 wrote to memory of 2556	2256	iexplore.exe	28
PID 2256 wrote to memory of 2556	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24fb7c18c02861f97c2f4d640846fb6b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ab340ca14263f147f505000f119016

SHA1
dfa1d3d1924abcb083ba90b69338247e3daeeb01

SHA256
8e196db425243dec2c8884fbe14f9ab982dc2ab51e9144ca00c62e1f9268dac5

SHA512
46716b56835f897e82864b66d6bf128c33c518f07c92e476448265ed290e2b3533f6dc29b2eb843f33fffbe1fabb8a5355225572ebfe3bc48359783a2cac6421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f0c5331bf0bdc1d75df5732bbf981bf

SHA1
08f118ddebaae2ae8cd999e0042c4457d5150ee6

SHA256
c764c9f37a64c8b236bd686b5df535584433493b1ea18398d5c0bbe7f5d3be9b

SHA512
dc4949dfd2cc7ad1b1ec06e7c7e80b991510f73242c9505fd5b76d27434e236aebc27f26abf001e24cdcf29d82f13d668aca03f2d143424c7058387b2b638352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d830190852a72f567c9158fe5a179e19

SHA1
73a986b3877b04c51df502bf9bd14678308d2d0a

SHA256
6dbb26888e56724c0cd0656e4d7c8ec9491d614789f29ac854dc058b19974a46

SHA512
b262fc7571566021b043f3250c370f159ae9000488c1508e472613f135314a38c042a6c708b462a0899097895444cc6aa97456c54904c21192251a62c1ee8a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75e6558f6bef6edde1094c3abe3936e8

SHA1
46c4c94a33ac950c98930ac3fc591c4a2b0b6389

SHA256
b7691549ab307bedfa9deb2c462dadb954cdb852c97aaef64137e695dfc0a405

SHA512
dc2fa91c96fb1311ca964fc1e70fb32c702919f61e8db9b1db9062f10c4d9a595e96c5fda5974e8a5b0c5cb63615825752c4148311e2d5ee64bcdbf81395d076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964055cfc2bb3200c78f4e57b792e343

SHA1
2c252448b7ac9a50ca4cabf6cb5963af961f26b5

SHA256
6cd0be5aa76255ad7768d5c6f585e645058926cf2b032381363c2b6448363b41

SHA512
169c27be430863ac403221b2c5e23a3d85fafdee9ee20735f97c2c15c127cd254a86b910b29b42099102b9352e921244c53c6a54ded8eaa1c2ac650696ad4de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a131f333b1dbc0f190d44fd8ddf5543

SHA1
20e87d11226bfdedbfccdc9afe11e3e92cafb047

SHA256
d00082f5646fa7c3a0adec8a195971f252db2780631a643184799e26fca69437

SHA512
f34440ca955a81d26abb73a479d80ff0bfa15a33b4b3db85ba2734e80fa2e71058c5fe12feb92ca43037c87f62eb1c0065f77690b4a523c7d87a9b3195d1c95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22037f98d6096d7b722e671d2225928c

SHA1
2f34f565e444e79b8764c90b89e9872c519f1a2b

SHA256
7b9c242d0b7445dc03d175697992c6f0ff658e4458184fd1961d90272677e9c6

SHA512
1aed2aba4f8a9039806c9439ad020f364cc3370d7d4d8fd2a4eaf072381cb210c65512c5b435ad68fc3226bc6b20e050ef5bb25f14592582eb0cf4f75d619d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353acaf8090eae557516340de517d6fe

SHA1
9cae1b6ca4e9bcf7f75614f5158748eca2e5d6e1

SHA256
095c157d8ad8bee76ae3fc775d47b02a384ae637b11e517b3a15a39b9e6898a9

SHA512
323c85687b7355171c95132e6d0e2737bad348440b8da86ab5933d6f267c3a68e1ad84814dc205495673c22769457127681472d5d441c0b5f5949325fcbaa844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b44d14877c32bec48b259fd62f6a4a8

SHA1
768615cd8c1146556c67b6450b50f8414541c5f8

SHA256
7384f018545b126da52e566599e7630c7f7fac5181221497a8465960fbce6514

SHA512
f11438c179d460109e715c6b4d041446eba8f68035e17495859cfdfc4b20c631a1fd0c6366f45ea9eb40f2cccea1a4632ddc51b213075f8f05cd410aeaa3ebdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7bdda956a61a47014fe2a0d8adf751f

SHA1
01a92f992c88a705b7efaf8f66f270d187c6bdd0

SHA256
fecf4027ab4daf1ff0fcdc789755ac74807ef4fa33e12c53de7133594bee0b7a

SHA512
686914e073b0e29a25d75a491b67b7ed302ce8d013f4a246860fa116692c466275879623fa8013000df627f3b468b19d1789829a80b6bcf1dc2b774c83dd8259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1be44aecbe3aac58637f4eebf4a18ab6

SHA1
2d7db63939bb389289170130cfe5e233ca0937b9

SHA256
9fe473d13a238e7f6867f08d368091eedc811252b42821271ef00b95758d6ff9

SHA512
0c78fb5edf86b90b24a1914770af2091c6d809ece2d9b471d7cdfc0987d7794d9dcbb07c9173c6cca8f6bd449cb6f6532dcce310c51f1338d11737198308c406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27bedf65ef9268b8b055908a373b07c

SHA1
3c8130ff008afaaebdfdd580280812ea6bd4d54a

SHA256
4848fee56ee15bbbdbe09951984d2c0cb5975ba665533de0ea5eb04687654fc3

SHA512
7422f5a145bc8ea38ce6f6212cfceccd104f8c746cf44724713cbcd08dc9c49b0b0c6204bfa9b07b734f3b45892c9a1a3f7008ac4bb7b200cf291df5af3e52bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b115b926d615011536ad35d968547ff

SHA1
4f995377516de5e56323e1f830147b12e74f2e09

SHA256
b18b7840f1ea8e7b0ccbfe8fc2db3e02c3b86d7b6d6f77b09e338626c71a2bee

SHA512
2bff2b79879d51805043fff0596a754079f8df8cc0eba5a70d8c51b06bac46c4fdaca00e473b64687fe5e0624c4d224732af905b819fa26ed2fcac34b811b2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit