ad5cb939b97ce3bb25f8650daecc40d99d90c9ea83d63214e6a116576c672198

Analysis

max time kernel
136s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3627218f6e7122823e890f37045fc5b2_JaffaCakes118.html
Size

138KB
MD5

3627218f6e7122823e890f37045fc5b2
SHA1

25395e02de8f752222091c28416c37c7d0e6e199
SHA256

ad5cb939b97ce3bb25f8650daecc40d99d90c9ea83d63214e6a116576c672198
SHA512

c8d07b73f65b9eeb1b53a02c453dc0d65293b1a9336066d232baba84833e180426b486bfdc34382dba2e8d30055c1681b504aeb5516f94309559a3d2e5429c12
SSDEEP

3072:SdQnCmOXx7dyfkMY+BES09JXAnyrZalI+YQ:SdgCrx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421617260"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7029cbfbd8a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8623A41-0FCB-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000006f961c46fa7da9c2f58f4e457bad33d4b45e2020cf5af7dc586b20129ccfa68000000000e80000000020000200000004b9049326b1e2cc2364794f3a83df15e9285010f54dc74660729b554a9b55d7720000000766f545a9ecd062262b82fb2ab295d12f08c412a88c3ef78a54d368144339aa840000000177831957f93753a923630386959420fdf9b95b9d5bb6ef123eada6aac5f70861ec73c5a2c0daf9622f26ea154e10e2991c84ea54441e14cd57e5fec8f9fc586	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007c7fc42caebb0b286a7a41e24d1c0cc0845db2b2a59549a1844f0575991ce1ef000000000e80000000020000200000005126753382722aa2f19b0538d2a19062baa90b663cc8f07ad68a3a0d738c3786900000004fa21c7f09b16bb9652c507ecd3c2cdb48120c5ed4e082316baee7b4911c7769669f083f6d3d8f33921d70eb075e749781741a84e22ea4815d44f3df96d3f80b872bf8b8b1228c452917fe04fe6978e1df7468e4f113a64a21da81cffc34f45a6d5592741f2225e22077659730d6f07389dbf3b80d6f72e5efa9294424c4bac54040c5d15737b4fd1da3a710090c399d40000000b63b67e694e8c159ca8d9b611b74bb5d361a225d66e6b94222e34fffdf38d1551433190788777fc963822fa6e1bf2fc3c47fd5e5be9fed759aed72b20853e565	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1856	iexplore.exe
1856	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2556	1856	iexplore.exe	28
PID 1856 wrote to memory of 2556	1856	iexplore.exe	28
PID 1856 wrote to memory of 2556	1856	iexplore.exe	28
PID 1856 wrote to memory of 2556	1856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3627218f6e7122823e890f37045fc5b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da944f10b089b219939c1b12f93c66d5

SHA1
43130c5116b3f80d98e5b9f7b63a429b2cc0bd8f

SHA256
ac1486cca4d79a6b9bdd269541d87ea2dcae79fbb242701b85a3c9f2478d6f88

SHA512
e0459975f0704209deb93c80c495d497dd228ab7958d07e9b296cdbd29099f288efe175381fcf016b7cfc3c1bb3a41e62d82846fc65c59341244382f46f721d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7174cf59d1267b4841262a73b67cef08

SHA1
48f267934b8ea662f92f071ec1afccff07d1b16b

SHA256
364347659a229c3028feaffe3db9271582d65d73a8a88c4f6e505c2c026ac673

SHA512
728f3c74126bc3d71b589644a648fda1adb4db61b8eceb1bfb24d5ad78a9f883a212fad2b9fcbef304a6de2c0b7d020b201c048f36c5b7f0e2ceb3e4594b4b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
011cea9663460acf50da4015d1f05252

SHA1
02c360125e562a1745751ae0b174f10b1fd31b6a

SHA256
82b46e493f8ef1995642fb6a54fad6b57cd9f41109ed067f61bb0f58e4468d5e

SHA512
29884916a3f7ecf91ca3a0ab88f1723813171aaaa7d767dd3d770caa1c0c7dad6b72665a0c7cb3232107e99067b16db5e1e4c6e76c0d9a77f7c20289e5ba5f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cec82d561acc1b00db26bcf8d552ad1c

SHA1
735e806a165e549b0ef97f140303a516f043a025

SHA256
4342a921acd79e13f239e21bc8a9fa2d3851865b721058519022242a2bdad1e0

SHA512
82f34f502bafefed0a385880b44472edb1017aa4d6abe82e1ca2f1717d8e907b34ccea3e3567ec908a5df03da7e22150d66a49c7c2611d6dd15431ee02a5dc75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2431d6faa73c3aebc44ee49a47df5e

SHA1
7d481a4dfde60bbf2faa705cbf83b2580e7ab505

SHA256
cb94c92ca75f742a78f440402cc6eac815af85da4a205213d66fc34acede5019

SHA512
feedc8542597ad1b892e100f86cb83a2f8241cd3eb476424b1cf78c7dfab2ae48549cf51537bfe81a65e77ed8b30351beb18d8672452b4fed3760faecd667df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f549875f4e5e3f01b8badd2ae9bb970c

SHA1
51f6b00cc09129044d2addfa11e262d8a6d81ccc

SHA256
f076ae1c758f4e3799f594767aa91b5a49a3109f2df225ed7e393bd0ac6b1597

SHA512
101718cd8e3a8bf520f28a94c8e26e171691cd4d97258a4133c508607fda56515af1e4b84e1150c8f6ac8cd36a351bcc228d85620aa68930ea92c7bc79a422ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
508a74c5d14376bade52d5b51048a220

SHA1
1d33743ba1fad589fa250043504abb5f43d15d35

SHA256
dabb8227d2eed0800938308d5f7b563635e15c89b798c0110ba00892d39b8111

SHA512
18485507b97e7d7be40fc77a59745636079ccb5fa11fc17032be08fe2bb8ea7a7bcdf8682be609462b01763cd120e6cc72c10592e64b9fed0eba43a14b0a75f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65544bf1591e2b508d090b7c6322a37

SHA1
74b3dd875cf02a43cbda0f9a2c1716997ae44e99

SHA256
20dfb15b1fe0a3dedfd5ee476b4009c191f889c7d79426141e653b839597b273

SHA512
7bf0121015e5f6763f9187c99982926883bff758ca54b6d4eb24dbfabfe735120dffecc9433ac124a58de10f1f3462661bde5164dc0cd2187174610c87eaa8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f24c0d7986dba5c4127ca8d1315153

SHA1
7a615cd9780259a1889c7cfd38c0bcb494bbcf8b

SHA256
a2898910a266f19b5c357d9d43bc3b576b1e538cad5795d51b928df04666dcb3

SHA512
059b533e18ee213a9274a2c2bc77e3a007740b75ab7032e9d8a0bf797138ec9e5db62e5b186de186d1b02594570a9e79f288e2940fb05f5b3fe9849974c752d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66dd7109eb6d80ba4019dc2645488ede

SHA1
1e249a04423f37d8ce53c90957ae48668ae505d0

SHA256
14da9843d15466d82249af4489a6d2e7fc615e2d40d9ea6773f5b72c0636313c

SHA512
3da1828d6303cd14d8dbd17da63f01e719fd6ed45b173dfa01f7f1a1d7058757319001d8856ab25d1d4fbd92d5a527c68b338ae065e092824c264905fde06552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f574c7a786971a919c075f72b704dbff

SHA1
9afa9fcd160bee2293b1966ac520350a95876848

SHA256
596a7bd67264939d553f8a58f48cab005daae21cd985276e6ec4cb30701b2ff9

SHA512
2c4b65f5952b648822cf450e0ea2c46f443c96d649498adc6cabf25082b5f3f11419b741df036edb1f048c2bce286899c9eb0dbbed758b8c575c2b57efc5774d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6566877522bf48946cec283d8215fd60

SHA1
f7f39210954794dd2a51f741a2b2031a01d17f6a

SHA256
22c09416951a471a16db59bc0029de7cf5d245c52d8f031eb6c473e4b1860250

SHA512
286526289b815997e42a394f201bc3db9a8d8bf751cdcc588bcaf93124b82426e3d361a46af4b38f7408af78ae49bd0c750d99071df2822b025499a87fdbf119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d89cc0b821c6c30541078db2e400e4b7

SHA1
6c4829511d3e518f474fd7b5cb01b4103729c6b8

SHA256
e358a00151ff12c8b2c9060270a451c158eef2bba25c7c77d039cb985785790e

SHA512
beeaa0cb72eb7eb0a070345617768acece1c8c543c700ad75c23d3dbded99070082a1e0771db745947e7ace1d4bf1da50ed445d59028eb8acca5c6b90a722cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DEC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E5F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit