a10c9c838ef17afb5c44a475f95cfec76b3e61d330246dd2bec8661f9eba1fe8

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613b059caeb0999fa9c3cf1ca0d3c44d_JaffaCakes118.html
Size

17KB
MD5

613b059caeb0999fa9c3cf1ca0d3c44d
SHA1

de9038edf271ae86102bf4c89ad59f19b2c97a37
SHA256

a10c9c838ef17afb5c44a475f95cfec76b3e61d330246dd2bec8661f9eba1fe8
SHA512

39d99a01bc26b7f1cfa7074453a5b8d80a098357aa8b47891284507af34a9aa6a4dce9e4405c6d38bf37eafc75ad9de73f4fe0996bc12e6d362049c8736e224f
SSDEEP

384:hvVUcdb70/e2D5Gz+zzYzzOzznzzpzz8zzkzzqzzozzxrZF/eUiSOrYM2mvvTxKz:ht/022FGz+zzYzzOzznzzpzz8zzkzzqk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004c6740fa6ee17319982b88e333a33c70a1811894f59db61d1a22b067848f7784000000000e80000000020000200000003772ca792a75282eb4a172bfd41e463b37709594728b736b9011c11978177290900000002e41cb32b85ea323e7ba8590f206d0dfab19ccd6a9e31b453c225a84b95ac5b5c923fa7b4d0c34fbf88cec5f10a3554e2ab46f95effb46d2ac0c44c6d6731a9b4d92850b53e5f080c2db81f9a83e6f5ac5fb1ea5db904280ebe1430fed019407d77977569f85bd209e1793790ebec879d9de36c5d297a08d76b530f235c5030a03915109467387340a8bc31e5132903440000000d464365af78b32b50cca3332e2a461d4e6d9cc5a24656141a0cda833416d8ccbfe0781d355c81fe89b1f9cf8b91c229219e4c47aa8befbac684a8095b39b7a51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bbde6c0aabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000078bd5fb2cd8f74a63dee33e396d23715f45da8c8de4d5eed657c4cc4da3e27eb000000000e8000000002000020000000f726ba44a108af0f923955b2058a35c95a6e846c8f0da0719b4fe9c47984bd88200000007c9348f049816d50b7989cf184269f9c2a527d5fc8752b6dcc10a60f0dfdd514400000009bd4d48e2af88406f71043f5730f0236e10c41378683f76e6268cee7971ee60f065293a9b6e90c044d02d7e066f5bc42b50b915232a9e9f06619e525cd2ab0e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9583D2A1-16FD-11EF-BE4D-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422408253"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2788	2108	iexplore.exe	28
PID 2108 wrote to memory of 2788	2108	iexplore.exe	28
PID 2108 wrote to memory of 2788	2108	iexplore.exe	28
PID 2108 wrote to memory of 2788	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\613b059caeb0999fa9c3cf1ca0d3c44d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2625942013107522100cc2d8dc987728

SHA1
98779961252b71b7a99c89a5d87393c86b868f77

SHA256
3f4a840f26a55c394613ff179568b88bc372c9512067e1266be7b077ac629cb8

SHA512
22d638dfbc2157038c533e3a0204ce6b37390a5dd332eea3531ff2c31bc7ed5efe0c746b64fb22cf6c3b35c8b21ea3cfff734069fbce49e4464e0adfcc560c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30fdf076950511ca51d1dc2a2f0f0729

SHA1
0be75eef51d1ea63858cbcbd435e7ba8c4c89e03

SHA256
d631d639e3b72b5f05751d3fe9626357b2cad5efce8b79adafa994f99e438e15

SHA512
0382567fa6b2395a07d0c201553064d4f5d9c0b91c66e8da59890491db9e5c8670001b2bb95a933dd0eb4137e774ff077e3032cdb1a7c9ec9a7d9b2c0f907be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68c61cfabb662b55bcb50cb1302c95d8

SHA1
9930b60ae07a3e8b691627a1fc3bf0d7b7e8b3ea

SHA256
4e39a078bee421065258b78b089cd434410a2be078460ec2e8f40d9c6967c1f8

SHA512
528e5f24d7a59662b7a2a98cb4477d900d86aea87ef3a3617a94155c2adcecfdab5270277dca396928ecc06ea6c0d0f9d615d3cee12739b59b7e40f3bdcbaaa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b813b1ddc6609f72aeabb7bb42c326

SHA1
113b16c0f1e6c16346486b6fd1a78554d6c66f96

SHA256
4436aadaac527f0d5a0028bdd23a18449a65db77e12ec1419b270dec42cc0456

SHA512
6a173ab6506eeef80a8e8f8b9b2ffcf5e72296f8ead031bb593a5662fc2a1a308814538f1b1861d2f50ba8e9bb655c6dd10c93494c4faba134afab37e00de5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4268df54c3de42dc99f41a7867582442

SHA1
4cd8dce4e51e886f7e9d489bf7a21ec9bb510632

SHA256
a1c5d7b81eb9ced7298e94d611f78df6f92d96f7db7faf16e0049f6e8fbf0464

SHA512
5b4271e741070370ea79f0a1cfdbbf6f063c8c37eaa82d0e2e53816a083e15a485e14aedbcf37354ed980fc057921243c15624f181ec3530133a0a2d6035300f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
150ef89b0fa4ad8655fc305f4fb4ff6d

SHA1
f6e83801727164cf3853ead8e3cedbb7480f1f14

SHA256
3567f79a13fbf7bc38f85f0113cbe4416fee03f185a23bdc121e1eb273e8c2bf

SHA512
492c612f1c368925aaabe0560f92ad214a63da70f072aa1c41526f5c86da35514f8bd50a980bdb9172d04bdf58fe910c13386bba5f0aa387ef9cdb1780077930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c26677da9d6f34b791954436ba6d92b

SHA1
89c6cca3f394def3990d315293ec2a639427659c

SHA256
fcd9a88a010025c936cd0adbe3268075579e81208bc2821948fe4bd42ee48bb3

SHA512
f5cc8b0aacace1b62009621ba2c28f4b99b48410746c09cd644707c1cf9f0a43ab6928a5e4dca9fcce97cf3c8a53f31de9dc3adeb1f335d713fbf186684f0346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369e6dad121318d5158df5cf173d79c5

SHA1
df8389344ccc4c1049503abb27ec66a75eddd2f6

SHA256
b68fdfc917722bc3d52da9b55bea1078665ba909b6810dee89fc7eb819d69a04

SHA512
783e4e776074f16f73314a4fc8ef21c76252bc1f09b80cd3059db1c5213b39bc3f2b5ca7e4614b1e3b62bc98736f6ae178b76ad1894c9975589a06e69bdf8439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c82f64e6f22fd8f50b1590a0d9b761d

SHA1
37245a2bca1d7e62b57e1fc4e034221f2064e0b7

SHA256
74b709483b648987f031517df049e08b772e38ea91a56ca101c4561ae27efc10

SHA512
d0a8dfef667606b574ce0a2aa998429019b6cf1168df86d0209377dfc361a97ff6bca7e6a5df9158213dd29dee266fe57f4eac8089650f20bee6cd9d91b333bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab783081e095b7b8eea71cc650b1399

SHA1
91c0fc70c53bee160bd164b1a939c7d082415804

SHA256
cb8ee6358078655fe60cb55571f3daf255192d7e0ce12fef1d0308d38b8f96a4

SHA512
8b3240b95fd0600aa11de11be73be0baf8f6b496dab756f9fec15e3af5118a9104f445425db18d589121856c977a857e1520120e123bdcfe40c7e800c0605cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1175e0f3e640e9d9a43212e0bb6af29

SHA1
bc482b9a2012a104ad89f126180bb6f00de8bdce

SHA256
fec3a686dfe2dabd0805eba385f6e512023fb2cfc6edec690396b202c4c50e09

SHA512
60ee963831ec6fba0a483e571b5d4a95b7d48830ab5fe251c88121d3bcee70d8ec2cb9fa83226ce968802f5f088eed7b0eab7354938eb78ae5686888d35ce1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b518624914e041192068423c893d3b8d

SHA1
a7059f7b6b5bb0b995854f677b8506edd1546c1f

SHA256
a1ee0ea715aed601b5aa3a9b0ceb3791a257453f65ad433c4c650724cff091eb

SHA512
fe9b0bf097c24d76b34abb03030c2dd04dd591761707fc21125d6410c6caf2e5be3ae26ed64cabab3b2ac5d470887a815029115eb2987ef6a9cb30c9e91e531e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46687241b47063f985c4c321518de48d

SHA1
faa8d35ac78e6334e0fc2b8582924eeab36e9144

SHA256
7771566a79ab13e67c1ea09754d69defe5561bf7bf0e49a3c647e45ffe6c45bc

SHA512
a73473ca7417508806c745837991da2f49bc4e8bf51b59f8cf52399c1952507286690d1559ce790093554ebf59029ce17ae1437a2a59d0d8d86905c47c5ec496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46A4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit