30f612d7ed558a892a2a84bf332363f01b5dae34b7e3ef96df3447fb6ca031ef

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86638b399a36f0ec87f69426f4215d17_JaffaCakes118.html
Size

33KB
MD5

86638b399a36f0ec87f69426f4215d17
SHA1

0fb832ab58f8aab2753ae7b052ce976940b50d0a
SHA256

30f612d7ed558a892a2a84bf332363f01b5dae34b7e3ef96df3447fb6ca031ef
SHA512

b361587a8ee473d9608360eb4d272f5229423c941b47d76184c4599ee7335935c0fb0e733097f2d1b938c635a451b7e3671e01d90e0956d982d4c324fb7de30e
SSDEEP

192:SH5+PSNlg6g7mXdvCrwTOCgviwjmpRp7Ouo8nPLjqIfUahZ+zIUyXZq+VY64d0XP:SH5l19NqrSOP8/qIcE+zIhZlVYPd0X/3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0272e4d35b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac12beff06c9e64285c37292eb6ee35700000000020000000000106600000001000020000000a8bba903f4e84ad4dd5967291a3195a08846e47fee174e0b369b5193d30d5dd2000000000e800000000200002000000068551953e49fb13cfac2f5e199d05cea698e922fe86db760394bb022c320d03c200000005edb5867af4d3cff13ce8ca551094e835fd6472c611d294ffdcfa0c7d96e3de040000000e51282f56e834541de98725e742541abc208fe8273eb2552c563591672006201cb5b9055ca54da39ba11c30e86dc2310a5d5e5522421f10618aae020ff194c0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3781F781-1F28-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423306175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac12beff06c9e64285c37292eb6ee357000000000200000000001066000000010000200000002afbb5fda7e182c6cd9c9df00a4d2b2fd44bc706ec01457c511135a9f954dd08000000000e8000000002000020000000b9193b6228193cd5e0efb51568408472e95965aaa111bd61aba7e7fa5f0f61d9900000008603a28e8642ea71102984a52965bd49b431fa2991c354d68d5c3494ee96139bb19b12c374c81ed3926f5eadcac17715f7f020a9801533a1672e82eae3e3775e9a6a1143f8ba4f490a0124ddd2222cea95770b2e50c35dde0b6c190c7d86ab5b26a4497374140c53dbf693c5d04ccc93cce6496b284163df9423dc8bbfee72b90a1dbb5111d8242ec919fe85627edb964000000094596d3b41a6f477444d2105bba629e795cc47f9715c131e7a2965b011c23a263f2b7a238300439dc2ca8efe441ec3bbb991e9dce5b47aa0cf6642429527d464	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2192	2320	iexplore.exe	28
PID 2320 wrote to memory of 2192	2320	iexplore.exe	28
PID 2320 wrote to memory of 2192	2320	iexplore.exe	28
PID 2320 wrote to memory of 2192	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86638b399a36f0ec87f69426f4215d17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b9ad837a295997d8a42ed70fc3dcdf

SHA1
48692678f28f391d4736603c7616ae59883b1922

SHA256
59b913d72d700b96bff7e1081bafe0e3b486fc99dcb44fbf6389697cfadd901f

SHA512
b51cf044f10a092efa482757268cfc299a83ed8449b2a5618d6e04afb4ad408883167ae446446cd035d65b0966f79b178bae44ba45dc4b6433271570c05fae7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c415495e85f0adc0ea876471bb4581b9

SHA1
7af30a9640952fddc2e59dd194239e0da2f1bc3c

SHA256
3f3109e8ea0e00ccfc6b05c3dd4d0a1fafd63b5f8e426696e2b591d407180747

SHA512
463d152e748eab5efd6829415a5f3518036adf6e09f0fedc708681f4f480530c4a6a2e2f9aa4bb878762899e6ce7ba2d4de03a91c4398c0b45785e11bf544cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e25f8a65327f4d363887f2d1f5bdf9c

SHA1
5c06d97ac4a7e9f53448169f16fe249030ae0f11

SHA256
9e866d3f465f65fecce51759643159dbf9941ad9ea575857d8561f5cacfd8f2f

SHA512
cdbff9d97c36756023cbebd71e12c9aa2023f876986120dd95111023159805b04a7448c537a17ac4b0e661c81440f11608d53a610f8ac37f565c058162bed625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3e062a150b6c7db061d98c6e19c887c

SHA1
cd3e1f6d1477b132305bc7a89901084868058a9c

SHA256
157117bead22dfd2ef81492f99faecd19682ec457bdee2e245035fed3602fe40

SHA512
74e7e5f82511ff6c212ab33f8c93c8188ee6a86c8a93613c37bb49a6cf55d505df30ba9f332ef47bfe5e06d5bf46a9dc0d0e44c4583d46a71dfff02292ea4916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c400b68d21bfd87302af7f3819f17f73

SHA1
58870f1c245d13f4dfcd8ae712ca3393c09e9c4c

SHA256
5e7923be92d1dac5549b847001940d5329a22fbc60a9238d859634c1c888839e

SHA512
3aa825996f35566621c0986f122999a32d6ae478a17fea168ca302599b63c2e40a5dfadc41a974da6c09f3719f7fe416a1284845f6f0d6e52e336fdac6c5801c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6de760493d3478aa4153035402da8081

SHA1
9e342bb529f010c3e22ba1f8eb69ff81cceaeb46

SHA256
e1de99c63b9acef3d8b37325b572b37926c5df2bb02b7c6d8a6d9e88cb302be5

SHA512
0621741fc87c336849f29a196f8ba1896ae8fdb80f7e79a741c3b389abaa7d7ca8c0375d3b06cb2482304ecf8cd12d872c1bb2d5358c540e99370fa8b420cc0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ba890b2686fc8245782c4d7fcb1696

SHA1
053b395cae6cd4042e080e6ea7c3f9263ea6cca2

SHA256
fe601db79da603425cf0f16a9066f2cdf240f67f84b39470d5a9990bf2f396c5

SHA512
447ee30e755323b2ce192ff09e960308a688b924822a47d6b40b0df7eb9952b0cb3fb512927f0e1f8962c19ec672635022d2e853d3018a423126165d02687a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c82f32e8798513b392d4a77e2a6d313e

SHA1
2e3f938ff123ddde329be399ee9c87764c896541

SHA256
48315267a44ae9cc254bd2dfa581672a38871da44d9137ddcea4f2d32e9e3ae5

SHA512
b45905116b9cc3f5a0fddb9b9af2e8d1a6e0cdb44e4f1aaa78b6fcfc800d47f43d2601ba6a26dfdda6e831cd2a8b6ed3a650ae6747d4ada78adc878ea4f2c951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfec8ae93046f3c4b37a365b4176f8a7

SHA1
d578ee7e15ec8ef38645c585842fdc6bab7cf9d7

SHA256
75c045e0c93ff42f562eb42d12d060910d4c3652870ef399a59a0e15ebd5a819

SHA512
867591995b0921ba2286e6a6316f439774b4fded7909578633842d2da703ff0521eab5db6e04b58a16a0647e806e1001c38f2401fd610aaf0f64acff7237135c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c80da9e97747dea433ab5d930a479057

SHA1
66cd89a80ba983cb8c6e40c15ca0f3b61b0ad02c

SHA256
170daa8d2dfaa838641dcea294a7d27944e8d3a2e5e8388f52bedd72a6f8dcab

SHA512
7181ff01fcf903be4cae13ae13c54cc078a7efd1f7152619d7b83d231b36cd9be2daef3efccd1aabc4ff68c2f5e3724112e79599b8d1669229a63b58bbc7abbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA848.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit