aa481b4726cb1a7b903022d1d5897f396a72e85a3401aa77aa6b63141ecfabf3

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69a8d9f5d88e161b2824825dcb3c72a8_JaffaCakes118.html
Size

139KB
MD5

69a8d9f5d88e161b2824825dcb3c72a8
SHA1

1c41ea4766f76ba08481afc04dfecd8637b965c1
SHA256

aa481b4726cb1a7b903022d1d5897f396a72e85a3401aa77aa6b63141ecfabf3
SHA512

752e40f00ebf67f163e32a688763b52c3d621c5c69740bf15de067d76f3e4a50abdb3ecd6d103d71928b93f941b8302afe507996e2fc04f8dea16495f304c222
SSDEEP

1536:SMVdmI2QB8ClByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SMQQ/yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422598578"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000059abd5d6fe7aa5b5e04c7a8923eaf6b6bba4af88f689426832f46c4a36ac0f67000000000e80000000020000200000005b0d71f02f6b65a1d9f57c08a157254492a4b93a7368f4613d0fa893fd53d89690000000ed8d6f0e359abbd750064ff02600f94be13c86dc541bf15eb4b32888bb1ac475c892801c92386b7d0610f486f56fbcbee7789f391fa2237e4c7551df66e55884c9c43649ab98f242230d8597838f66de673fa43fe837d174385dfc3b966efad6b9cd079486b446886605d21bd57911418ec48fa676b69bdad72012c952ccb111616884d1a694ffdb563a71a880d313c64000000010b8497176f1b9e7e8a87e196660d79bc84d07bcb433c73ab9048a8151aef4860e4bf9d7bd25f515a6b65254102e1b6a6dc6db9f62a6d41481629e09e645f53d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7775961-18B8-11EF-A04B-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08c6ecdc5acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000404d673def6b6f7a50a51ae8a6c4bef32bcd6e5eb0312f3cf5dafc4947fb35a8000000000e8000000002000020000000b143264d41cca5e8006231b97f7a53121f1de519aa7a50b099d1b99eac24ec43200000008d2edd99ab6a8d94804eb269e0ffe5c01d9a8fdb4682c3cf95d97dd976ceadf540000000afbe6986f252ee411639cde4adfc90960715ea1b2919638d3d049ad03ac69227ece3a6f3debcb4707af141b764cd147abf75a43bbe0bdb200931186ced4ad00a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2636	1992	iexplore.exe	28
PID 1992 wrote to memory of 2636	1992	iexplore.exe	28
PID 1992 wrote to memory of 2636	1992	iexplore.exe	28
PID 1992 wrote to memory of 2636	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69a8d9f5d88e161b2824825dcb3c72a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14623e4ab407c3b4ca2df14c55faeef2

SHA1
66dbd572219b7a6ff2cdd5de2cfb7fc5f6053848

SHA256
a9a52cb76ec345eb2cf972d263bea1480c69ab9b55ad790b3641928a66b2e3ae

SHA512
0c28a7abc1329392dd71fe8ce38590395987c04e3b93cae6ff5cb23e0e8b9ffacd858979972d12db43dc8341817c6d26da5af57eee9bdda7067e882bf6b1e510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db71286cdada57d4ea4cb525e2c892da

SHA1
7d099a7fd413b9891072426001277298575a10b0

SHA256
da4d9cb36ad9deffd1da2ec4b6ed72afb376896830f1b50a2ecdc1378d2e4a9b

SHA512
fbb9c9f41d5f1162ec2321da3cba1ae160380423681a6804c0a99e56028c4fbd9503d31e6bdf6dd9e3c51319176eb6628cb0cad87c839747008023341c311e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cec5ed66b0ce9c32eae6c43560a33cd

SHA1
f2ff922ae6da7339442596d6dc503a16087f7b9f

SHA256
a99b23f532a6cd0b0ecb90e97460935e6496d23bb52e360608b6846642cb2181

SHA512
d2da50b16cfc0c89a0212fa5a438b8d7af830df4b3bc7bd760f5cb49d706279687ecb9210f917245e83a9e9335804d481ce96d2b40b84730d48b159889ac0bac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7a618a6512c48f27396ebb1b0cfd60e

SHA1
4a03a3aa7468239bf6cb6dd43354f11387ac218e

SHA256
38928c73e9ccce80feda659d35d90766cfe08a8f782c6260c26a0a907e460651

SHA512
8c2dfd799644fa0b92de19367be3b41b0236510ad8f5cddea7d6bdbadc9955bf21219d9001eedc99e21f391577be3219e883c274d91aa46d5dd5466367eca957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f853740c4ec4df3fa56795184823b4f

SHA1
d1215ad40a93bb507ac8cad1cde5c0cb65c8333f

SHA256
69a58564bac12437792495cede36d4ab3355476a1d407024536faa236bb49e53

SHA512
6c279720ec77babf775d1e5f569141c267d068e2bf0169d624323f781d2683ba873cf896d841b7562a01009b947af8efd225fd0aaa7b4d699ec3845f73d02f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077bd30547b9d79f178703b5adaaa384

SHA1
b749eab6b2534472efb49ef152c84f139354644f

SHA256
94acb3701832e078852e2fc5aced06ca73fad580731bd73a98ac7533634dac62

SHA512
5d2cccf5f8282567a868e9f697ed060bd7c05323c960f124c93fce8ff6e11d439861be735dd46193ab974c10c65231a36c9a7bb614e48775bcd98bac14831687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d550b60cd2d51b01c583df9af3cf74

SHA1
29418191db780f81a04a0cc69e5ede94ef6564ee

SHA256
c37cf16edb28e284e818fab4d2e24531f24c95f0d4ea19a62a1394c872be2df2

SHA512
408058beaeef45913ea8550a35c4c5dc5a6b76cd40afab19c86b2a554c3dae930e545737c11040a6694afa6cdccdee8b463342c6de075b7712ec1e928334b1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70ada0af561077dde3e8486c09f4f068

SHA1
84f72a6d9e1f4a16396c5733271a2f07008f5a20

SHA256
9bd07126b80171249322b14444ba40953ca93cf7078a4ff24d267d1774aca1f4

SHA512
e446e6dbcc799f1fd8ae38e1f783df85debed9993ecf580556279d3b3e42f284018e785e3d330ac0e81e718b569c4496558ae944f1115bbde23abd71344c8f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd27b2ee4b42383c85e99d0cd347d0a

SHA1
347e772e4039078ad5b579a8935299fc8bd5830a

SHA256
7ac62665de5f00e38d582c9cdbd09eb3231775d46a645fc06914957136d77de8

SHA512
258a91d9df67d6d05d7120544cd9775229bbece6f985ef4d40894b2de5e077212870927e4ca4c952ad33f45a3051f0325ac6d7658167b9d23ff950c946a57e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84dc6e7555a4e10006ac7b0802a9d731

SHA1
401a5f050f60bd312a7f76ff557403c21fa7b112

SHA256
40040c826d73492c6d59669cd7bcb19416263e3a3882e0e887a939794fc8d0ce

SHA512
fc3f5dc354246fa902140b1c3d8b090a3e01797b6c718d48a68e2595b0f93d402ed924685b20cadd83bf95cb814ecd87bd81ebb8f8a5785cf22a5a8079d9cc87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e555dba35eb52f7c41231859323e346e

SHA1
7fd134398315fa1999340dcc80a83dbf4faebf5d

SHA256
81dbf04e9e684d0459b2b9a69c83535dd6585b738157aceb5eae5b6330dddee5

SHA512
edc225316dee7ab35c493d618557a89c8626b07921915a9f44cb0290a58f7ab7b09c1620c3d549335385875b66afdaca5d575f123ee08e44b57f99000197ebd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4fddc29462fc9d0de5ae42cb744cabc

SHA1
c67c82a7ed296b0fd6a2dc4a682876205b76c418

SHA256
c34d8631e7f73511362b337ea93487be3983f7da567bf265bdc92b0fd560304e

SHA512
b41556ed0d14baa958bb1fe4705d2250e112fcf198d49bfb6677e51f12b59e58f5bdb7b123aa40963a43126ad21259745f37ca678befb933b0270990e0909bee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1170.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit