08b2163fa8ac6c2577c7369e04f52685c919bd98067bc9fd8fb030de97fab2ed

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html
Size

19KB
MD5

79990ca1a6ba282e8167c6ef3e0f4769
SHA1

7f766394564000ffdef54f1935d906b8a9f28bce
SHA256

08b2163fa8ac6c2577c7369e04f52685c919bd98067bc9fd8fb030de97fab2ed
SHA512

863e023707c2bfafa3bc3d569abe97a2ee236c96cd6f28255f1f11252d2e181cd4075d9480b53bfe7c00f04952f3aad567b47fdb8e48a484dbf30b13782eb167
SSDEEP

384:zi9KhgESVVBD8c+Q3RniLRd5zemLEXucfIk9xhe3rzVc9G3F:ziOSVgcR3FWQmFOIk9e3nqG3F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b5651ffc27f1f4c84dc9be6e0d785ae9863e2a159df56877e86f146885fca25e000000000e8000000002000020000000e2d0e2b494b186c13939c69db608fc676db57ef6b3b594431d565872939107d090000000d35a967ef8b28aba05098c172c0b5b280fb07cdc539202bb03b00662940bb099c43072d687ea747bc29d87a7b5ff1265d2e27b084e0faaa0e196550372b0fab7963605c1bdf0d002de079612538691410d5b2737ccf598699fc4286f360d6d54dd091a7a89c06f30c7509e9f4cef34dbd3001cfa0c0829e000908cafa6dccd2a9752569e53086f40fc36d3eeefa20c9440000000be385141dc8e7360518f87468908a9e879fdefc2c000efb8c2d6408a39739e2b319b8ea08c57a14582ebda5570fabb314a6fb0588cc67d01598c90235b7b7cac	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422986143"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0461ced4bb0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1640C6A1-1C3F-11EF-89B4-66A5A0AB388F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000084e40ba37446b4dc771a78c416f0c823df6b00dd0d5723c34cac063fbafb9a8c000000000e8000000002000020000000c5beeea0ea268a9d37b7461558e85ccce9aaca9f7454cb36b4275f59ea2795e02000000074d20e93b0e3c55d81b0a68403509fb5fce45d9f484253f8c27accdf70842e69400000009155408027e7f20de122f2ee9e67fdef73465ca764c1ed1668efd76070bf09ceecaea1c285f11a18649fd445542667d8e13c5e6b9e38e45db3a1b6a0f1a171cc	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2184	2956	iexplore.exe	28
PID 2956 wrote to memory of 2184	2956	iexplore.exe	28
PID 2956 wrote to memory of 2184	2956	iexplore.exe	28
PID 2956 wrote to memory of 2184	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79990ca1a6ba282e8167c6ef3e0f4769_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a5a0e32be0133873b82018274da4f2b

SHA1
6f01a50e1594c47d1a981abc5bf2387eea6e6992

SHA256
ac1856dfd9150170a16a817fcc917066b93df4799f59e8b50b78af87ada39d0b

SHA512
dead047fe65d46dbbc2d4d210d77f90839416f5ec0b990a9816ba0f41909cec45fdade1789934530e1fd3651b21f19c7211c436597070ab775c7006d239ec7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b511f030838edbff2ca20f8eae8ef8

SHA1
44df8ffd1969c3edee961daf41a455b5cadaa68b

SHA256
2a00274385719c48ae91c1ccf2e5ff23afc1766d7f65dffa1449178edf013bdc

SHA512
2e1e0580ec00b25db86ab0641426c175aa9da36de6de664217b77a030fbabb345b2036dba6c407628a9f9fdd7c1f88d5510a430a04d8881a969051f0145f4c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
683ab9742382c41666738b567cd55810

SHA1
a79744cfaeeab309ff3e6bb05e430385fc2d5f26

SHA256
2a453e4bf005033e162d024d044f226baaa934de968e26929b6bc7bf7a269fa5

SHA512
8476a87f9fe1df4b53f06c6d1d4fa20fd3e26af07b912433471217c95fa8ac95a75e32919df466f87cc335feb5439ce393fe83b9cf806dcc9003e253bc7b401e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa8388c760a73c91950af7dbb0b208e

SHA1
41db18c78edf58ae12a70e8c42d30ca0c1756db2

SHA256
31dd0389e3dbb0ee5b7aeb5175f7f0d7d028c6eef2bffdc9b14463e7e47ecd4e

SHA512
b55f4d6bf985d89ca26ef0548c8a85b4772d01ee251e98d5461efd9c44d404ca9f6779650a7c5cb7e1ac39dd7069cc3cb09e94ac134750f0cd5ed4b583dba59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37817d5dcae214dfc76c5befa6885ba9

SHA1
653fb1eb9fcfd8536c12d9c3d93977e6f7213e6e

SHA256
9455de4b7ad11fb51155c094f31d32afbf175941e3b8275b8006a1bbb5815868

SHA512
f9aa3ebf9dd98c64c5c35efc508a983c76584e84dcc1049d490dace58a212a7abe9dabe6e88823d9296b384ffaf0f87e22ca3e8dd774e3eecad41a522e98cd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0dfe4588af499ae2e98b9a11c55fcdd

SHA1
2ace557000adcc44bbc2f0954fa9b1ea8488fd06

SHA256
24408f62920535000928328ac934c0399454bc081d13a6a2a330c524d30c47a2

SHA512
fb809fea98e4f5abb483325ffda5b9eeefbbfac99b5df497fcb2d38b2bb5036f6ba9075588937f26c0af89dd934c578be4bacfc005d242d26748d3f74cad3739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b74f2bedd9e900dccc92aefff17d99a5

SHA1
818d2ea2f3feaec69a74769a63a54a4927a5edc9

SHA256
3d18831407302da73ba63ed89d2900173e9575f5ebcf7b93b2011d947556c945

SHA512
58379547302887ba541c2a9694420ce9fa816dc879840e46e7acb86a4e2c99b71f41d542f0e980254686561de93d71a24604d1f20bc1ee66b92e06ddc8796ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06612b27545611a24a7042bbabf176f3

SHA1
a3a30c7bde60247162edc5caab153166b09e8632

SHA256
eca03f0aee3f18918b528fccbc235bab5e833a500f24752ff5053ff3d8769e66

SHA512
9bdde9766f4d9a26c3c5ee1ae17737888a1110bb1d4ee6b069463418f8a6318fa5e84d6fb7b58c43e3bac68277322117c48121aaac336def79fa765a199b3c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
758402f58c213be832312dbbce7d5ccd

SHA1
68613dd3f805edde5ad8f3fcd3ceb056d43cf1be

SHA256
9a6792666e187289e5cf84dc800ded4e5e513b76b31aea158efe619f156745f4

SHA512
751d8555141ce49a5c293922ce4844dad61e1454215340afb015bc3b14a7896a7495a0d511d70627026a9f6b76e867608e30701c87adbbbdbf2224fac28a1684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea800c32994057b50067b38e1060248

SHA1
9df280d13a6701fdcb4449af68a4eb3ad461c34b

SHA256
c38a558609de905bfb7622c5a9b8dd276cea8bd491226de4c36c4a9cebc1a811

SHA512
97d502a54b93ff90ad3e0013da7792db26ee17df06d2387527887e8f9c604d144621380d2260a0809dd5119f4cb471a9c30f7228a7b5beed52fd087c748eda92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b64ff8b43ef7e2a7dfc0e1081e39958

SHA1
f58725e8aaa5d3f35b64585f52a2b2f47c6413f3

SHA256
13f85fa2eebdf2ce527307f835c82c19e0df47d801caade16fd0e6760c0d3b0f

SHA512
64df1fdc7e97787dbc9bf572aaeb3cba1a2740ffb4db2c0a697b92afa7d18ccdb0ad2e56c5fc47424707e77d532e1dc7709310efd1686ecf600571e83481c8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96cb8a67caa5efea739475ee84bd03b8

SHA1
881aa5d43a2920c6dd6b17ecc91edfd78765d6c7

SHA256
b5d270543503de35fe06688e69fe6013bc53c15c5e15664cdb52ee3a201ba5d8

SHA512
a7c0d6adc6f8b69b9312833cb798395fe98a3d7ad8e0ecac69d9c1bde54b7473ab8521f39064fc0c44a934e7dd7f737b01bfabb2205345e71ff00ad01d32929a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94aef3161cac8e5ccff9c095fc59743e

SHA1
771e48ce45f443e29d2fe2acd5257ac0f9a9a23e

SHA256
911e62d664ef44c153049afe7651e9aab4f45eb4b70c741cc78bc8d649867a11

SHA512
584222957eef89f06dea50feb614063bb486c33047fae34d679840b24511ecab6b956dec1731d277a575c5e5e2accda3cba89d660dd6e54833d9ae6b433942fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4859.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar525A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit