4e9c41d4d15ee90875024be2bd7b3227a67bf5648f9f07a49521479c2c1c9961

Analysis

max time kernel
137s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a735aab44fd2f3d1ef7679d7e67deba5_JaffaCakes118.html
Size

462KB
MD5

a735aab44fd2f3d1ef7679d7e67deba5
SHA1

388a994aafd8f8471c29e3dc9c8925d102f964e0
SHA256

4e9c41d4d15ee90875024be2bd7b3227a67bf5648f9f07a49521479c2c1c9961
SHA512

8ec95cc23ab84b582ef9be3cdbce6f4a2fa465c4248ff23615e85e07108b95e547ad3c1214bcc6f6776bd9cd32343696165f4f78080a22541ecb6defe1dae78f
SSDEEP

6144:SssMYod+X3oI+YlsMYod+X3oI+YnzsMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3H5d+X355d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000028c57a904ed20d4c845ffbaf650f29b100000000020000000000106600000001000020000000927c2a7c58fedb62bd8dabe18b8beacb043a1bf97b010459e3c8d5acfd49dc2e000000000e80000000020000200000006c2b4f6d32a9dbca63e644122a0a1c6612e60e34a18ff976628c1e24bed313142000000030a3d6665b5c6f18d54b8d827408a19c47b8857ea05fb19745e438c9f65f47b84000000081a1eb2f1363cc8259021959e7fda66103f8339fee245c7e6a5f7d9534a5c493934106881cad514c5879951d3fe588b0596d94c8dc87956edb948c0608b9099c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDC270E1-29E0-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424484968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50833fa6edbdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000028c57a904ed20d4c845ffbaf650f29b1000000000200000000001066000000010000200000000de022eafb042aa4eea5b129ee87cfe211ce8ca5681cea87e07fb7cc343d8521000000000e800000000200002000000035052de96a653e83dda013e4d82b4bec6cc2780f704c5a0b6f879dec5f72d31b900000003d2b00e2263819c72c252d13127a9a8a7c81fd8dd4deadf47ddf4131890b5fdd8dcb5a740b8be992a87ef5e9d79f37659f4e04b7f342df6ca3772e1d2f4f9805a693ab017a06008a748535d79b000e86b182ac3eead511fdf99b4fc1da0fb4846852926a9f08b4a68412c52493337fb2bd60c160550d964186b4fde8a16a1e52f6489f811d2dc19f1c1ae24ae4fdbb594000000004e005b6b7706b165aeabff076eb57bc99ec49d5166de99d1162e46003f078fb99fead1977dc2242cf990beb167bd4d80ad57a566249de807c6ca97cca4fdf75	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1856	iexplore.exe
1856	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2216	1856	iexplore.exe	28
PID 1856 wrote to memory of 2216	1856	iexplore.exe	28
PID 1856 wrote to memory of 2216	1856	iexplore.exe	28
PID 1856 wrote to memory of 2216	1856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a735aab44fd2f3d1ef7679d7e67deba5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90166ad0401a234a8c7219e5efadf4ab

SHA1
b9f80175e75140a1b5cfde7da3d2c07b8f9e7515

SHA256
78b6c3235624152ccbecbac1cf9e12036c539d208533daa792cd867a0c9c85c9

SHA512
d6972062c6cd766827f3d6ea91897bc137524324686434e170503d0e3429af2d1f9f1596e5ff5fde94abc7343c7b79cf83f1db095a40359a4628372926351539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bf4778987c55ce63c37ec7ddf61bd14

SHA1
b4b99cb6865c3087677da6ba3fcb81634d371d6b

SHA256
141076c6b92c1e63c0bb731bfad439418234669cba475754587e3736f365a00a

SHA512
65c3969e9752fa1bfe3ef1ee775beddcf38fc28d1cd9f67fb81c1ab9ba001bcf41351e04648f6cfa8aa9c29ab64098d53a091318e4cbeb9cd7840e1e0c14a0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41efb4dd373162c7091fa3aa0dfc960c

SHA1
22c1e8d2edcce26d3abbc27e6cc73d6e48b1a671

SHA256
2adfb8e95453641e48c53628f3c883f5ccfbe304f1d24580ec08c3b5e0f7325b

SHA512
3b123be46bce383a4c05561adb1d664e8055b31568813f6237cb2e0fadfaefd955fcbf7bdf1ecc087ed2137b1f2fdf974beb04980c73988d528ecade6ec8a481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a5fc3372ce47d131eddb63e8bc85487

SHA1
451ff7429e2ba254dbbab33a912a74f1004f01db

SHA256
ad649e67cc297c689642e5a8f2ac72e7f307767073f0f82a3f1fdbb79bfd7df9

SHA512
e9b4819bcbdfd1fe6f91205bf60f02d1b0cbf6a3f8d737ddcdc02b62a9553038b40ae1856632fc0a81dee201f694552d5a12ed73183885534ee266254c2ec99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
472d22df4c13e23b46639c43b9054cb4

SHA1
31788ec6beeacc0b92cb9a6c9672f4c57bba24fd

SHA256
af0d697b74aae376290a1e4811b8842a1c5e5565505d5cf81f7829f0175569b3

SHA512
13e5e2d43e3202544264714335d0c9d40ee5a726b152ec6cfab2c86c835384b01e3edb7b60104db53cb6a87a88cbdc38248e5ea3700705a348f62fc6659f0d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d680926c8699fa9afdd79e1adcf7b3c6

SHA1
22f1cc9cf60ecf4b6ada2646873b46c4667384ef

SHA256
3b2ae6bb73964e1d4d5496e6f85b2d353a3cfb830f1174b0cdc6bca2a4b2c837

SHA512
b685adcfda7139ab317fb25a3ed29bbd10b7f260cd57228836e54b1c04aaa6f49476e18da7790ca88ed57a5133b81549c88a0400047cae4200d736357cc0893a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5889c3ac004a9963a821b1c912d36dfe

SHA1
de1044c3ed41c79d58a1c9012db3e9037d444973

SHA256
27322f18243cc14b6101ec019af30e689b3b1834491bbe1c29ddc416f8024d28

SHA512
e6126149843621ce0a04152948df3b382d29d0cd70e639d729d5b408e6d536b733963ebba46eabd62c40e0e30abf7c8d5895574ab60cc91472604961871a259e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
312fe2bbf2a054bb8a2c0b7205d919ce

SHA1
91317d431a0d146960c93aea47df3be8db8519a7

SHA256
bf77035b444beb1dcdc494846dd4635185536d9cbdd9d2cce0b4c08dced4bf06

SHA512
b79556644f3424b61c2421a8fc3618cefb577ac69bc9d806295dcdc72c1a2544250b2934e45d4bd369e501a5545de78fa01a3e7effeaa209f4dc12e5e5a18012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a28179c3da6fb1a61fc995e2576aa0d4

SHA1
c10eb0322a5febbbb35b06d5712853021d2bf191

SHA256
c6a3e4584d3fdd2cdd076741c52cf0ec27c28189465706e7def0512d9ca13779

SHA512
63a32c37820560c34d6c21842d964ad90955607cf6359091946234bcc95a38b711b99a8bb0ff977e014a6796aea2d14407990faf2f2de9878cb9015f3f1a01f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d1cd5555dd15a8b764f465866eff25

SHA1
f47ead757943a1a090e663c6c4db5e2465f224ab

SHA256
a99405ad471ad5e518e22bd51c10869d14b032d40b98db20834b840ff6a64d2a

SHA512
5f5156d3d2098cdca23d87bfeb0b036eb02017a7a6bb381d60f93c5bca17206b46a535edaa7500f9e0547ac5cd727b820967133313a31462db7174223ba21aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b566e089c8884b730227089bdf0c4109

SHA1
c771356a54f52835ae26d0db8570b6f86b1b0a68

SHA256
15319e24f81c8109b1447913a047e8765724aabf8d60f6a81b449659470dd9cd

SHA512
19098f09fa984ed7fdea3441ad7d23b5dafa634e11945c410e72198f0d3896bdef8e548d540dcc82692d92a7c429274b5678e3001083fb18fb6f63b170939c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a926ecd423094d8084fe1172eacb9007

SHA1
15cac48e14a7339b18f9028d7a877af5f919455c

SHA256
e3e859f1507b3eb72acdb192268aa1850e74a8d8c85b11fe7a9e021e1205b3ff

SHA512
924d0d0dc35aaa05107124da828bc6e77b0b779015c4fc6fde5e2d008a83d42b2d029bf5489a308360f77c822860f35be545d8397593de62ef172acbce897345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44d14ca8897124c8cdc8b62f2f9bbcc0

SHA1
1f5811ef876d549e1a958285ed88cd4b62c29a72

SHA256
87fe16939d99252b321ff34461a52cd7730e7b74bec46c14bbdab1d0a444ceab

SHA512
75af04041476850db6dcd128675e378f62eab6634cecbf69edc820f424709ff522080805e2022b6c6379953a75c0716add9ca268e423419ed54f1a0e9836d01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee4f71526b90a3ee8819d60890aa5d4b

SHA1
9b40c47074d92f7e96a3bde7e8b7ee5b2627cefe

SHA256
11cc80dfaeb6ecf3e57ad8626deaa7a51ff7af55f816f216110cb47d0d554721

SHA512
c3d1afc231a07c1369583c4d759ef3d97bbf3a0802d7e7d4b87447dc15894bc7306f4bbc4be7740ff6dee53df41765256f6cfe141141282a732165fa3f361963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03cab0a374fe953dd8d02a79a83bc766

SHA1
17565b4faed402debe9df458dd229f9eedd12316

SHA256
272b8f60c640962961b572f4ccdeb1c6c5876361400a27dc639298c45f32c578

SHA512
ec8363e90099f36165243ed19f346ed6efcab084734faad428d922463759220f8a27b00e065473f8d9afac67c5b2da5551fa4206fb6bde51430b1efcb77bff3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C8B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D6F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit