1a6ef34ee2824733380781f0be1440002ba7aa1697891fcd959359efbcbb384c

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60d46dec778b1eeb698d1eba0ff130e3_JaffaCakes118.html
Size

16KB
MD5

60d46dec778b1eeb698d1eba0ff130e3
SHA1

f0e6088290326d1ff5daeb26d60a2f34017bb9da
SHA256

1a6ef34ee2824733380781f0be1440002ba7aa1697891fcd959359efbcbb384c
SHA512

ee182d36171043cac14f51d404e6c886b0397107416f2e233e98eda394a34ab3b0dc049099d46662f13317ba1d56fcfb7c8d27bafd6478e6c5690bbd98935674
SSDEEP

384:Sf5Kni5THuf2uf4V4TlmDCRnm+DmdpvJWI:Sf5KnitHuum4almDR+SRWI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{763B09C1-16E1-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c29a4ceeaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005d8e0acb11ef55e519ba2f98e204eaf92c1b36bf98ae93054ca2644e503206c8000000000e8000000002000020000000ded088697edaca7f27ea4440170ba516ef4775c283ab10ce1a904c7c934dd98d2000000060f1d70613804f1af555795f53146979a72e2fcd8c89717588a6ef87ed2faa714000000075f221e489e23e1230fe989e7895183edc936f4bec5878eb5f3148f634dfa21f87a2ff2f8bcf41d15676bb7edd07e7e139c6505c4873e8e327ed28d12e393630	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003fb2149b2bf6e807ed306ffb23ac7cf9e35771c21fe6515254f9f63c09c9f32f000000000e8000000002000020000000f3fb91a2ef3d9aa144ae3f75efcfd479e5bfcd9b304a4506ba616b8ef6a23f66900000000348b2e38e1972149889597f30fdd0802e17daf4783cd12c330e26a9743965695a9c751bd28e44e41f9039dd342cf6dc7cadbeb5467e794ea78cfbb70ac7395e715b9a52c4a20d0e0d400e86a951cbe6856eb3df1975d4de27683bc6de766df9c01c7b1217fe409901449e72d5a0493aa869a678997117015e6c7a1553e704c97f499c9bb7dbbcdb3820c77874724c4a400000005cba0ceec510fb9090c79dbf9f3b180b7cfd03ca1ac48a7ceac504893d85a860b854a39ebac61f06e6fc5797644fd9c54c65c3096b3393368d22f375c92b1dae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422396177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2108	2004	iexplore.exe	28
PID 2004 wrote to memory of 2108	2004	iexplore.exe	28
PID 2004 wrote to memory of 2108	2004	iexplore.exe	28
PID 2004 wrote to memory of 2108	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d46dec778b1eeb698d1eba0ff130e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2723f4fd80b4db5b5373a3c4a627aa3c

SHA1
829229404e38e41716da9146503e1222a8cec626

SHA256
e3ee4dfc73c3ad15ca141cc53d666ff703410ba6a4825fdcb36ab8f01f5d56fe

SHA512
4483562f9d6514667159933313fe41c27816e4984824a22d95f5e44affa99e70a09c3bf14e847707281d3f347b7941f1730f7309f209fe6c8112acf30876f5fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b6f4e03db09501b461a23cbfa9517c

SHA1
640e1c49f2cbb9627b28877726ea1be80b5c8ee4

SHA256
2396b02e448a94bbd68330154c924bc9924d1d8e841750bd3ef213ab5672a61f

SHA512
544fd146d474d8093f5db57d7dcc352a994bae4e92ecee39ac24febffe5a77e999b66b53c585529fcfd5ba833d46ede3ee2d0b4e15706f376603d9da07e8d848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a2fbbb1935a40f700ec058152afa07

SHA1
32287fcaff9c8aebb93fa4eb9c01c52a524d0df1

SHA256
5d55e98c0c1761cd665bab2a40eaa7f50917b20d9bbe880931c49c284c5383e3

SHA512
d14fb6a8a4cfaa9a8f62b8f38b86dd6ff32866c1f73c28b0ed8e1880a91f13a0c625648847734b532f3985cec933842aea8305c4aa0f75c3284a839906a4f33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd93629c9922948c34f8dae8b4f7b5b2

SHA1
d6be3625549bcf40b475a52b8d4101025c79048d

SHA256
09591b7b27d0089d93182b922f5fd126feaa892a3d1f117b7b0a3b00b14626a1

SHA512
d0d3212f44bbc305d6a37cfd5d21700941801f26fe3cfa1a2f41f3a6e0c516e756443cf2ca8ffcbd08958fbbcd5acbd453a22994b3d08f6fb3288d0c0cb4560d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd9b8b3d3d295a2a34403c714320b4b

SHA1
cc424780dd382559697b439923f26b881a92f027

SHA256
cb873b153cbf6ee9c61ab577c3f525370cb7b6f3c86b25c6167e32603f0bad2b

SHA512
9e4d6a9b688cb0f30b62afcc1140be4541598ccf84a23014c823c8c9bf93c3f529784942c712afff4042b2509c088766d492fb27575eab1aeb632d1c310fe6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53eab9651fb6542f7f7e3b60ec0f8c7

SHA1
3b41d72f14dd5d569b544e655719a8e3bf505c09

SHA256
aa3632578ba3212e50f311b7582db0afee2ea38b5f7a2b7e1586045d0bc29fcd

SHA512
8e887cd19018ac69044fbcaaa1a4d88d2aadf844432bfdc9d2fe83a12a379a73d7054adcb56e6db9ea15fa04917fa9d79231fbd386766c7904b79155378a5dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7035b096ea557c1ddc8444390d22d9c5

SHA1
cdcf6d46b569d9c4f97b489fc7df09f3e6a41260

SHA256
93da80a761da6449f83644cbe82e5e40c8ac0609c48934598fc663092d56fb20

SHA512
14dfc3b95bb462d0db3a5f80ab31cb045f4dbeee1f74107fde3b5c0ab2176ea4a249ccd6023a3ddb3e9083813454ef58cf69065a750ddea043fb95bb91f4bad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0fd16e80dd8f45ce5d4af41fc0d4ab1

SHA1
b2f24f49a4ecfe6307f41c3eb3e290b8be261c75

SHA256
791eca817b3a1f181b367ca39ee307ca3c7aafff0f1218df1354c7c123223995

SHA512
76234c3e57f508efbfe78973e305dbcecc4e6e23c6de65e80a7de621fa64e30987e257d1435da2f605fb0f8d2af0ce6a70347d8266b60b73d8ab1074793d9b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
202a3f0742ea9ab92b7b6d72c67c0000

SHA1
d2c177c9ddc9e8b44310b5f61e8fc0dc4b0604f0

SHA256
00dcaaa04b50e92a5d4708dad4e7fe7070df88f7620387ab4755c4f2188484fa

SHA512
a0775996e2ea34f5e00c29ebfb2abbe477c53fabc11a3b32757cdf2565c9cb4f07ead5441d2fe14e951f1c4fad6154ec031199e2566de89fb6f1f54f842cad3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39772519245aef2a186aaa96cd2e6122

SHA1
7a3765aae26007392ff1859ec7053d3d7c94178f

SHA256
b7a76954e2dd1370d405e6b902789859ba2cc3df2ce5432145a381523a58d049

SHA512
79f5e510ab9d1ed8d5236cec5694dbbb950a9845c20d74c0cce11807004dab756f1e01817189e02020ef19e75d38a3c210a3f57627788a2445152f1017cd5159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf2cf0aff952e75c49c113f3b9e1da4f

SHA1
37d66361a8a03d7c79a684f177b8cf94aae67b09

SHA256
2857ab4a46b53f21cd09df7bf7754cd4819f7537bd4a09d602371505b550986a

SHA512
1dea2b8bb87b43db5f79ce46617a8d736ac54b157f7114826c7bb683b1914ffaf12b13d08626c73352b4f14cb556efb5f2a4d9235156630d09eff3e97b6fee0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
741883b7dd3facf96123d26a9a53bebd

SHA1
d49312fd9cc4f8ecd2b6b762a8e8a610de158d4d

SHA256
38b400e7fa33f9a142a7d2b3cfac509c06d4bd4827f8200d3f6ae87772c2adbe

SHA512
1b8a1acd96ab4da005b9ed45453b16785208836d650424b0310f63b88428c8411215724f9606701154fd25dbd58cae7ae611f26557eb8228c15e040e021fe2a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab403E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar403D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit