662af82dcead084742f04b0ef107608ed755fa0ae88aa5c7a9be908c478fa609

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html
Size

234KB
MD5

7a5ddca6fc2a10894b77d6c7954659b1
SHA1

be0f45ded5458432a661a335da6443880ed6c164
SHA256

662af82dcead084742f04b0ef107608ed755fa0ae88aa5c7a9be908c478fa609
SHA512

9a0e2396a48a8267d737568458751ae2b18abc3e26da3d5a3c91d8654c688497467306729a3067fd1e3d6113c6811230a5dabfc62a5d690fc762e99cdd4876c1
SSDEEP

3072:SLVyfkMY+BES09JXAnyrZalI+YgxIM6jiBnes3kqee66jp:SUsMYod+X3oI+YgxvBnT3kqee1p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE82C101-1C64-11EF-99EB-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000aaaa070dee71276b975c9444c29b006f5fe66a229842e2e79d987a182f869050000000000e80000000020000200000004013b2adea0dd9efcc97469ed7a0125f7173a030e36169ed5075204532c45aba90000000287b06118bb66aa38efaeb8852810977447f46cf61db0222e52a1f39efe07a8eeb1510e44817941ccda35732c30d4f497c1714f257a2dffc5e8136203c1de983cf62d326c88bc5d43702ceaf49af704eccd6d289719231a96529757112565dbff3485805a42ea90c5b58d2397b7dc4f5fb52c8a9419b7a8e9c5d0f6c191c516a86f45be078e6a3fc7edeead16204be924000000034ed9eee64bb47fbf712bb13df79e333fad008668c293822364164f799f78839a97a2cd53213e7d3ea503aba439feaaac6fb42fa5189d3d9764393c52b3bcb35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90de2e1372b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423002441"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d3b9868e98bc7757037b9471f7963c7c6e087d87678ec27e04ab97cfa0d7287e000000000e8000000002000020000000e4acd2e0005dc3946a065229001e196027faa56f845e5b532839c354ceee17e920000000d3037175a6b034f9247a64257590890d7589e1c1794cf64528b11f20c9c01209400000008c04ff5bc9f3adcf20d4cd2d25bdf4a769986e388aadbc9ee9b40d2629019d828a91da24cd60825307b60aa0c73cf86afddc844504ce4a67bce3c8bd4a6e3c22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28
PID 3056 wrote to memory of 2168	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a5ddca6fc2a10894b77d6c7954659b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99f694e55c52a58155c0ab4e258c0caf

SHA1
b046180c51c128fa1240c93171d15c99e3769edb

SHA256
9a16c34acab36a1ad001b47275e082e79ef9c8515afa9f4888aaf81c2cccc71b

SHA512
499a9c37985cad7cbd6bde3feaaedb9ae5d0ef9e4a67bbec550dc9acca8c5712dfd5bdf703b19b53ff9bbe43e0afa53fb662217cd255076e39baea91dad79f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706a2d3023e5260a0a24b1165f1baae6

SHA1
cd90f9b32175d5c066764b6d4ee75232ac3e674c

SHA256
8b817d4e5ec33b43365feaddcf48beebfe6276dcee840879867739507afd70a5

SHA512
12cd3f1d741f9b33a84ab10cdae010ebbd0fb8ac9121ce79d366b11719732afb589067c6309087413bbefa36e6804ebd880d2110135654fbd9d0d41d2eee4d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2db7ae3b7b47611fed56a922ad38bd0f

SHA1
6d25aa3212e8332035f60887e2aecd099e66f2d5

SHA256
aa2323c65f117b5986b11709f2a829b0b979a4c87aff942e4c09a4b6e38fce31

SHA512
a858bacb0b94e83f4e8b22d1d18c0ec20d57bb15c911663babee03b91ed8e7aa2507092929725935b2eb8aea7b49564b0fa3e793dd52861bc4e4e2ed875fc45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129b47626cc1d6a89b649bb342806158

SHA1
8d32b08500576e9375d3ab67d2f682fc33699052

SHA256
e650e5cb58a39d47eba421947d9d09ad6ae1b66866c6d1335d7d738fe028aa57

SHA512
c9926150ea23682626b793d1974bbe5f920fdf160937ba1967745dd68989dabf91f2def7ed83a6415747f75a9245322337011205be88b8719a299afeb09853d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef80286ba5c9114bf6b7f9c12f401ad9

SHA1
5f4b9aefa75671c9b1cbca17590bede9fb305d2e

SHA256
65a91fc3f701d0b04c39a3d5e987fc29fb03da0659a9302ad6c44a33c2d02ea5

SHA512
7de8c456f0268481cbd36f357712923d7948a2699eb0cc9eb8364f5be32c61778901a495e56714f0ad2f5499cb7ca20d8cc197158129f39d3d65d2adf22d4102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee3c66b1f54e8b4a5e26898d984164df

SHA1
5b815c5d7c8e2e2fc0f89c22126c80b3fe12947e

SHA256
1c621b92713c6cff60f18be8dce6c69702ae87e1f986c8661eb67d0aa6021866

SHA512
5045a1e195ca440d5740534f4f1e6d3cfd27f5076b05bf184373d05e7b12c610f7e8449117efb3bf913787ac4c2438cfd2d7fa29cfb3c214bd79da455e85b276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a89d6d9d3ddeb88f81fb565e4a5bc570

SHA1
adaff9b9d9b9c3f997074762778ce406bcf8831b

SHA256
0166333890dcd62ed26faf89327b411df799db78b755c8ac796b7c9476bea902

SHA512
6910b65b4951966eb9dd714d0e8bc96cb3e039290c3166c68feca070546e72965c7f386a5ce30b379b6948dabc397ffe91aed5bb8d76b0da83cf89452c9973db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef604212225b83514184382e719141f9

SHA1
f0388af80179838730f8e9ff9697e694acfa00dd

SHA256
22d6c98b68f23201ba3461707998012438c523df1533b86db342ddecbefaf392

SHA512
5063c1f5685838c4bb40c6f86b78d41aa21930a38e04b3f2c6b56706150b0b43baf3b17231f18a3ae2e12f584ea8272b56035a2d2f41f3d4bee072e4044e3998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e58b229ac53dcc43227fd39825075202

SHA1
bed25ab68afd28ba740a67e33bf80aa0e463c7de

SHA256
a051728ad94f6c78ab49365d4fa37c96dd9b7cd76f4bf648b67dcc1371834b15

SHA512
35dae4fbbf982614215147661a0b98937a20eaa1a5285d4e32145070f4fc39b7b0aca756e822b923f8e2f73dc6ce9550e842ff1dfadf98b080affa3de47fc2eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaba1a7f048aa7adcb64e68938f10412

SHA1
d73475bd3bb4b9c61438764e7d80e1abf60fdebe

SHA256
54f1b8be690bed695f3c8c1615839e483d4257848db171ab894178fa24cadc28

SHA512
fc2e4ca2e2b3044face65e542e528c3c5a8526532bf744a071270b02cf9ef179a6c1f73255b7c3d1ae54da9a47ead24893130206df20570ca14a54663887a6dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e726b4a6715d0e79fd6157ea747c00e

SHA1
de3a90ab794546fe1a0546de8c78ded1a5ae07c0

SHA256
4daa70127917cb619112b36f8351fa64ef21e4bc1624ea42a9ad66ba351338e3

SHA512
60191b14b5cda35f9be83ffb90e53bf1f9354185e0bcbf94c7f34fc48668a58a80bdc08cd5b6f6d3fbb046dffe97d075c20649449d5ad69e1f69036df5c6cd0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b8a88701065cbc0d339fd6d57e834d

SHA1
7edf021074ed1eb592261801e2be9270d336205b

SHA256
12af318d8f5070e294641dedcda9baf1c53b5cbbf75df1bd84123a7d4bf1b2f0

SHA512
466db75b3abdcb284f29e120948a027ce9a77b2e2aa3504e48d1f9af8205737acc9bb20255481d08a5564ffbc24d9ea7f5f80ba2b3a7f8cdf69a010dd3d9984f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b494f088efd1d043becf5125322a00

SHA1
a4871cfcdfaf70c3b6eddc85d7a3ce15e96c5a66

SHA256
4d56f71f02445841a447a942c0285d6edf8f63679187cfb7a6b6b3e4824d9291

SHA512
fbc5d59cfdce0a0cd890748f13a20e47f41537308bfdf6fc110472e83cd3eb58761f9c9646f8aba4fb96ff2e319f456bcdd6f46843883d90487debec66599d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1219a4e3e615b86008e44cf163d3078

SHA1
bf6631ac06f013ebb0667c4ddef429c95b9e4311

SHA256
65e95d0404cd52d862d23fe191662697aaf692397b2af47d731957d23127db04

SHA512
186b97817789e5dd50c67b42e91ce7106df5a626c86925042703429265385b5446b94011a0c3e779e6b1518faed36d70ca1d496630509867cc92b1cc68c9b5eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0cbfdb4dfa64643060acdefea01e28e

SHA1
8e2169cc111ac1a41d8835030b8b0378fa293158

SHA256
c9a53ccd774debe9daab3ea4b49443be3d20ca3c5b5527e8390636a2b19e5ba6

SHA512
3f1c23d981f590a0f24b3a36aa25dc02fe45b9b9211a91b09827080f7716fc0bc360a6c8b4d466876745ea6dc17cc87cc7df32eb852ec9f8e1fecda94423acb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29B1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29C4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit