09fc3446d723400f1740063931e85fc5280aca5cba3ed7e640469095931823eb

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e640099557af72e0b532a5de1e02e68_JaffaCakes118.html
Size

135KB
MD5

7e640099557af72e0b532a5de1e02e68
SHA1

298b863886bccf9903708f99097fd389f8afe334
SHA256

09fc3446d723400f1740063931e85fc5280aca5cba3ed7e640469095931823eb
SHA512

cb4148c47d6f4be9e5a6cdba3c13b2efedb0ac24fa46ede8ebfac7d1004fd6d37e1cea188fedb8a4b2c195b54e3bcec527de8572c5c6558bd858bd52a78a061d
SSDEEP

1536:H6696i41EyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTO7:ByfkMY+BES09JXAnyrZalI+YW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423091991"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eb29518c2e7374396cb7238ea5abe0141aab68581e71d430c02f2dc093a76ab1000000000e80000000020000200000002eedb682dec4acb1e2e032f9bb67f609d5665acf14f58d4aa0a2abf6f5427311900000003819f0fc47097d7f899416d11ef4efe2f9b4ba7387572fdf05a3bc18fcb76db64d8e8d14d08309080a0d1e7442c26c8e772ed479be935c24a7fedba54cc7480df6c6e6fe2b0c25a6632e022428662f3f6de36394d41297b5715cad38573c830f1949ed01fdfa80701e59d9fc96fbb1b39336f73c51d871e02cf274376ae0bd1ab5b94f900abcb332b6b7fa2389b05aad4000000027497bad2ec89d635eda6ba41ddda7a4d73f217152bc1e2524e70a6db452e81dfae9eba1c1dee517d59a2f8b44e9004fde5b11fa1d06089a929ccefe79341fa9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0aa5f7642b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d62d09c42befbf6df8544223a71400ddec5584ca140078e6a9296debe41d639f000000000e80000000020000200000006182e7a5bf3a1c579fc41dded247466a0e2b8c910e999192d05feca750ca173e20000000afa301b2b9f25961b2aca717ae7933a6a094984c13d32aeffbc5302bd9767c61400000008e232382860e3c2b335aafc27bd0a9e66ba2dee3497d9d96045dc774d74c97c76c898ad6bb8eeb9e3e112c201bfef9dc32f078cd72578cb83a6b93752246a5a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88971E61-1D35-11EF-AE65-4658C477BD5D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
616	iexplore.exe
616	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28
PID 616 wrote to memory of 2216	616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e640099557af72e0b532a5de1e02e68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c167728276d96785b10e1c2849dcc739

SHA1
41b904c28cfa815424105f879e0b5e3cef0c5787

SHA256
610a4f513214b223fc95f01cc0cf52a3517e8bb36ce944792702b022067e7c22

SHA512
e0f44a37f485845481b941d2457af2de1490dd8fc57fdd2239c8474925d5c354e019e30418e04687df1180cb62f6b8f5fa5b45cc607c7a26ec38b1341650e860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32b02e9f6f4dc507ea6cb3db0f5ea777

SHA1
64b0f6bd742475ff49f3c27fb0a24bb525203a10

SHA256
1b8af3c455e931fddc398b1c1172c84af91ee63742c697e420500483f462faf1

SHA512
c4de8d92259eed18a33bce471cddb6a2430c19a4471e3fc419daaf7d07d9c712fee9cc59bce25c0a7c1fcd08af7c93030d2706183a43ea6c3e1599cb91325fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
967015fb27e714ef13b07c7f01882e4f

SHA1
d5d28b6aff76af63e2f25948b57d84ba01761fd1

SHA256
3bcbda8ab3960055de85f2af9c88db72fb656c637e99d96892627cf48d992a21

SHA512
22bbf026fed1e3fb98a3ecf41d56e9c44b2dbfe3290c3a5ff3c4056095c0147f89e5af8c8f2a23187a6c82cdcb5973ef14575509a417564a27e386912509259a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e8b822b2115001500fe160cce9b1743

SHA1
8e6d47029fc69b5f69280c11ca27beef873dc1ed

SHA256
50503b24af0b5facffce39c02025c5f5717140cb6afbf3a6212daa1797f35d87

SHA512
c27f555bbc5f5ee5ff6a1a9245d86592503a5df371f6ec79823c8e53210cd9c2d11f3673186dbcf2277b8829c837ef8fbcfcbe008d8f33785605054c1944abd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee60d5e1387afeec31acdd22a2448162

SHA1
7127112a3b5422a11807a2626fd0da7e3cf8cd18

SHA256
d980470e9bfc3dfcb7ce8fb62d37b6cfd99703783d47c6847e54218cf9059036

SHA512
9d902c4358b451841ee94352ba0f219b46f406c28a9e7275072b881671ddb18891ac83b3527853f3e2de654391b264b6b04c0e0d6fb470160baf4a3afc595c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f19d6e46458bb3189372a92cc4783f54

SHA1
027c931b64f44e05e6dea5842054cb453d839eb6

SHA256
19de34a54be589bf193e111a3c7f0881fb3a9e122fc2f7ff97ed1b7b2c818e8d

SHA512
bec5153aab90dcdaa734061693a75270d6642713fe7fcbd4c58d148920014cd2cf631e8f493fc34c298f4ad4afffa441ae0c444feef8a0dd9f79fd507b452a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
200f8b9fb5a338bafb39680553254cb2

SHA1
11f91108ec4666a86e41d14facf45d79479df7b7

SHA256
3133ab594bfcac9c1700c8d9c764a46b8adfe9498957107f8c28260d455b3806

SHA512
f75ad826662e5b9b56625cb72422e55643ebfe560d1a5a96275b83e40efdba5c5010a76ad1bbbb178494a8fc184634569dd814b0d943cb5656d26e8b00c85e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffdc08429325de61d4924bbcba9e8915

SHA1
3e65d436646ff8d6824911ed6cc9c6f9a45884e8

SHA256
486500eba1cb8deb7470394ad68512272b0f239cb4bee0ace1bc87d3b7a228c1

SHA512
88af2b03e4d72ea7729bb6f6ce2581e5734b956ff01ac03ef0c96ec9c4c7c36b8b03b4e1022b9184c63dae931cfd1dba145321c500701f261721aa592553cdd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4497ccbbc7ea61d37f7d14cdbeae8d1

SHA1
ffca861f57839bd3d67411256939d175df7c4b40

SHA256
14bba8af6bb974110200309a4f2a5ae329c79490dcd86e6f184559b66f1ac41a

SHA512
938f0fae58a67a1fc0d6f830fc9e61a17ab74ddfb05a0c96538deb7c99f15331d3f1c13881ad51d50b4e037e71fdee3a0f1bdd83bbf14a1f241d97d582bea358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
819cb03df3930f46a15b01433cff7e3a

SHA1
003b0fdca49b680ce6d9c47017d24e79434e8d0a

SHA256
f05c57bcfa613a235b99bac918185174dad01cea9761ae5676d8256d9bd3442a

SHA512
86bfba3ce16b2d22de2166b5bd92e77d44a986a519252849ae69670b5e0f26f7c0ec02f8445f6cac3c37d236e07ade5f1e0f165b5804ba0429d316f5e0645e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5053b0fb37a002a4fe7fbe2e4b5eb5

SHA1
c18d7002b7cf27834b66fdcc32198697440a5a0e

SHA256
64b2f43c827b11acbe77fd228b233abb79e9a4e853b5309ac0bfafac7c8e51ca

SHA512
10ad24f486e67cf74427ce56b33e12e4d197d0eca3d49c293e007ead960da68bb1901696534ec5319f4091c947f82e2031245a4c6018563c68a2dd5309ef1699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f904e5962b1b4f690566173e95f9e6

SHA1
23e06afcfa286f8d1e22d9f89b572a3015387de3

SHA256
3c91f9ebd18f6387b4f511f7d3468dcb0e87fcbd54b5367c62a81b42b14c6a01

SHA512
44f26071c650e9beffce2613252a677587dd98489ef0e5b593588e264e8f23c3b060588b7e6316940d956cd465a2a055be590f916e67ae786bb625ca8c8dbd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54baefe1c4268d06ba928449f9fa039e

SHA1
1110f4c13d6b007a1b3df440a3fd96b7cac20125

SHA256
6bef9eff056d5661be1eeb2f61a86945493dde534e818e395954a202ad7eaf9f

SHA512
9b39c1193964a5bd74c64c9a32908958fdfaa3a49d35c4cdfdf2909b02e488467caf908bf9b93d55bcf9dcb94fff6632555fe05582030525c9ef98944677bf1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7D9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF83A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit