4f640eb8c7bba46a908c1fceb6774e66571806aaea6af6d2970edbd6402081ce

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ad3ffa6ff7c8007c5004cb97bb5ce1b_JaffaCakes118.html
Size

61KB
MD5

7ad3ffa6ff7c8007c5004cb97bb5ce1b
SHA1

3c098d97b60d367a137ecf8a49015b4b4ad41850
SHA256

4f640eb8c7bba46a908c1fceb6774e66571806aaea6af6d2970edbd6402081ce
SHA512

7affb655b461aa826acc6ecff2c826c7d4718fa92e7a5edd6855dab929721143c9505b8e5b211705ede0f3ba20a53ac08fc09e7ddd03b896fa56ae44df0c6914
SSDEEP

768:q0G0VVIFlQqI155DVwaLV4dmXdQTHjq5ezy/piddBlLa97CGMJy4Dh9ZMVRIk:q0G0wPgDVwoQTHjqAy/pi64Dh9ZO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{102131A1-1C7C-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006a0b3575e528004ca83534fa395b5a34e03b0f49775b5e3b133ff79b5faa86a2000000000e80000000020000200000002c7b0f80b3a59e767117218656f2417e8c34a6a2edf0558498c5ebb1746b8658200000007ea129667fee5530bb5b840ac0de7c91b70c2ee739b89203191e0c6b87147c6b40000000c0c3109dbc605ad9d226daaaed2eb66b36f7d2189adde6cbcb319fbb0d87c8b2be315d1013bd96e1fb5035d4eeaf616fed6d452b04f44c28a558aa918d9d3a25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d7ade488b0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000061a5a8e975d65623fb66c9cb34102ebec086ee325639c5336195026b8026073e000000000e80000000020000200000000a4ef0d389c3ac495a4d6c6a1f455699f1de77b5de66e315254319a858bfb4549000000040075dc5ba644b794e92f8c2fa31a18d4430508445663187593cf6419131ed7be1c6a884c5304cbc6cb71bb0768841f91784964d74bb07c0b70fef8a8f2e793b1665af467c56bc2b6e9ff248f52d8380f8f153c10b24d455ee04dd181adfa453c55e0a260f72dff4839a22bf81aeeb5e7785f209340f4a414b86e81155272932ae69ceec1c38f95fb3f7e6207e4fb73440000000a4d344f48f452bef08b6f09d3a6483b80b1b9d6caefa085595ced7f9142f234e165258a06046c4e69e2a3b0b4ad2d76575b00dc3e8060671063d2da174de0e8d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423012332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2064	2980	iexplore.exe	28
PID 2980 wrote to memory of 2064	2980	iexplore.exe	28
PID 2980 wrote to memory of 2064	2980	iexplore.exe	28
PID 2980 wrote to memory of 2064	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ad3ffa6ff7c8007c5004cb97bb5ce1b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f16eae7d40cbeb1e630eae34507d90

SHA1
fba8437336ecdb4c4502422231862cb956925a9a

SHA256
286697fc8c40d160e06fcb8d443866cd863ffe06114c7e5425bc1bdfa02eca08

SHA512
c7a3e443eeb9bae8e15c9b2136de387147f7b37992f8aeaf2d79077c8b6f67c36177dadd5f5e9fd29a137c3596b250878f3c54f170120ff0fd579c1d156a37da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d654a22bf619d33cde8b44b4b903c0b0

SHA1
5cacb3470fbe8b28296529101538049e82308084

SHA256
58d9046bcc66179793eb5e4516e37062eb2a26fde587a107500b34361eaaeeaa

SHA512
a24d9e4d563c1efdb312b9069a8821eb48dbc4bd657ef76ec10e3479e78f46f03aa9a4ff0210bedd226d4fb7b0ebaa251e432e878acd2f2bc9ecabab6495086f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4eeedae84360d4f715cdce06c0a28f0

SHA1
4d97c5c6ba159ce6bfb6c9f89e003c94d52581c1

SHA256
c51ff43e34098f5bae061e130aa2faa52b597455df18726cb67e9b95ff1aff55

SHA512
479c883d627e9e8d850f149b163ba952f64bb3843572976c19c4619c2cd85cc6016e75622074cb26bd7e85e2fc4b3a997da3faa2cb497b9760274320b9ec3387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8518376aa8f11c22f432e6deded1e110

SHA1
96aac5e68ac13c5b2541918e1cd8792a32751ff2

SHA256
bcd3f9a190f630a3dda253e630cc8fb8bd228cae5119645dbbc67abaadbef7b0

SHA512
4efc4ae82e7620b87317c264dcf2b0c6c1412012f10d3d21c7671990ed44fea9726cb719ff27f2cb3d76a3a91316b7291b033495929f542907147058a7a7fa33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
559a2788cc30c4af6916f3b23e00222d

SHA1
a4c707eeda46b3f897bac57d555699f3aad73f9b

SHA256
ccf36a35cab6447f357b9b30b215af988d363c9fefcb3be58a51d720645fa959

SHA512
ff64efbcbf0c8b25d497a5fe83a720a00dffe21048cfc6663c8f68b474d48147bf8c9744fb2f7b3073bb85b9c4abc6364ca68c6d935135e894206154efc9189a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
994edd64bd121fd96170f646936c0579

SHA1
5ed9548998de5c00ef582caea63edeab3d3e5ae1

SHA256
ee69ba7416ac95cf256a4a3687db48f61fa5c86e47d015780f40bf3146d14bf9

SHA512
b7538b1f67e641120e0ee8893ffecf29d76fb17c595755f97fcbd78c78068ae1288ef3b78ddc858160140d968a70e48524e7374f84a77e9d498a1712c3dc601f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0540859e921a475d15a0dca2f84bb312

SHA1
436a516f176da68e5163a51ae0b807b2e24eaa4a

SHA256
10218cb0aa7a48241cfffe6a7f00da1e83593c34ecdb09e869b33fa3c44c068a

SHA512
ac506986ce151676b666774833c19d1e87552d2b27e79ea887937cbcbb1e48273a87f127bfc16211117e99199e6265f210773bddaa5a510dfa6eb6948ff36c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aad388e46ca994ab7a52325f06f643f

SHA1
3fe22f6cc802dc3af9c52753c32e799e3a540057

SHA256
7f7917ea7ecd2ce9275aaf75eb01a1f9920d33f8aaf27f13d5b8f574728be398

SHA512
0d15a47086c4655c5db05c522d1297fddf438584ebf1b6af4a485df09ac190e46067a5a82e83986a3e14e82a7611a116e3240e8fe77998f82b5c29951dc95aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27d4d36297ddb45ceb45ab5ff8649fa8

SHA1
99052ec04ac42ed6f40b0c84230d684ed44a515f

SHA256
252701daec431c2d27533c177bcbbdb9fba64127e00eaec2e0ee4dddf9159c77

SHA512
b6159c49eaaf101f72d4c659dddd80a077181851c2f3b0550b404e024243ee05167da1eee0cb85eb3c2be912539c1ff53e1b2eafbbe3b9f1f7ad233a8adf1057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f70a8d12a2283a91dac1058de259cde

SHA1
b30be65a2f3f39d1c2db6a0d1e4eb2072a074955

SHA256
a7c0e768f8d1e45d5240bf48a7aa57f83bc644a6eb86de4770de475f39c36d0c

SHA512
f70bb1a38a24292966af0d4e5bcaff9361ec917781309390e966ca478c9ee0ed25d13eed3decb100df95fb988c547a2a9e8628dcd3283dd5b70ddbda5f22b218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
667e1c43b94d2895e061e748713eeadc

SHA1
e1ed277eba2f1fc0d674afa7ffa83677d3f521ec

SHA256
61b29f4d7b419f605ca382bf675ac330dccf75c2b6dd4e284fb82caffbbd238f

SHA512
2a478dcf2c241002071ec10754052247da95fc57ed390b816b4465dcaf07d7f9973575268132238ad8d464e0c1572957f6d913c72452e725c27404f49b55374a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8612de23a8be06c8dba0d9b5097cb7e7

SHA1
78c44f7a2c2d313d613bb47627b03b0db59565fd

SHA256
94986e3fbc080670154e878cf76b683ac1e9623ffca51f4479d2ac1c97239484

SHA512
ea8c5f9d2c6b4d012932e72a2b8cecdb3abd53bd2cba8d419854c51093691e20196a353c603175fb5d9c093314a96ec246c3709850390d092df5d239a952326c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29301c01a16ed2fcaf51fe6eba60764c

SHA1
ad4c3c575f444c1a7fbf9193f725d138ca4a7215

SHA256
c8c8fce25616a6aa75649d8fdf247cc53b68591b26904545aafe00e2b370beef

SHA512
c5480a5e0fd02ea061619025268d9dc9853985653ddd671111873f6bfb068d7d1b44299aeb2b145bb4ad7f4c8f234176490ee12ed2095dc9454a74de9c7c4766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
515573a376f97973a7bfb71777f24ea0

SHA1
1aa1bd975c05142133ea464d1b631b3c1a203514

SHA256
e623c508f1cfbddb6d77c3dd7b101beda56a8b232f7d0cea2285211355408220

SHA512
3fc6a9db0e924d7fe2327c0d6dc47ebb7fd6e33bdd8dbbf071ffe80cba22defd98a4b4027a83b2c91dc0c39658616f84009cbc2c9e85b00ae08a93b740718b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38FE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar394F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit