63b1aa0bce5154904cbce32f756c1f12d739da11e0ef33819b19178445595013

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a37ed7d298c20217842a67d8e9f62ec8_JaffaCakes118.html
Size

41KB
MD5

a37ed7d298c20217842a67d8e9f62ec8
SHA1

8ecc317d35807c6feceb549536787399ea982235
SHA256

63b1aa0bce5154904cbce32f756c1f12d739da11e0ef33819b19178445595013
SHA512

f55069718a2e210c7f7ed7c0cea9bb2815f8ee9bd1c8d012a15af56e342cd91ebaea0074dd4d2bab102342a70be67ae598edaf9fe92cd0323abf771e6c9d27df
SSDEEP

768:SQ+3aton3juzx4/wMhHGbL+w0NtQvHQJxsLI:SQ+3aton3juzx4/IbLL0N95

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ef138c9cbdb573784ff7db9b4f3a9649c19765be2c1d86367333888bdd493844000000000e800000000200002000000098274a0e50e7028c2a4d1d9abdb16e7248283c57874a6d5de40ccf239022ffb320000000ad14e83d7df0031a87fc09927b68af7484d06ff6b61687276f6c666f6f56b05840000000863ca7e788eb4d57940e5cd5d6cd6b2855e6c89a47ef8af6c0b18c4baa26f63d18a1beb266957e5cf9c102c12538501a429531366d4bfbf2288f5dddf42f4761	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02b81b036bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424406386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8695391-2929-11EF-BD87-DEB4B2C1951C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a8cd1b30d1b4ee2b6c1e4329e78c0cfac6782e3370c480108e472bf586277c52000000000e800000000200002000000091b73a5687390e1367944cd46660b2d79d9a70a9a6e821a72c3fe37333dcc47b9000000086cda2e3d7548022de0b29d1a813728802b2f135e33377fd29fabd07c334f71df27afd58c8ef9564b8ba52566c7a25c1268492b3c11f2b9e846b0bbe120aa83b4a94c8fcdffa5b307ef61a93ac38ba3e02d6279ed8048db462ca4d6926c5faf4d9f68c6461f84eaeb5995ada15f2ff1a7f25de16c5dcd4c5e310f120c7959ae38d4f53165a0e88dc24a38e640d48fa914000000083dfc7645cd03197294289c11daedd2d7604574b8f9e61b46f0e6606579ca7b6ab1a62c1f9c7f7e05c25fb8de9e289efc6f343c1fcb66bd2111c22503f8e96b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2676	2232	iexplore.exe	28
PID 2232 wrote to memory of 2676	2232	iexplore.exe	28
PID 2232 wrote to memory of 2676	2232	iexplore.exe	28
PID 2232 wrote to memory of 2676	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a37ed7d298c20217842a67d8e9f62ec8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
903cc95906bf4e3d463c834e0a27faf7

SHA1
04acaba7b53ae881d056f3006133d4ab7f86dd51

SHA256
c6a2b063eb2599c36c911d5176c674961f155f3be36ce353e7d1756c72ff3fc9

SHA512
362f709fdc3269dedcb3b8bc0d656b0cd6b82797e6d587540d7c8b5a2b5758f1f14b67ed10325f786d1c2b24c58b1328b58b57475ae6930a4b381c678662ab7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eb992f3d0c0e6717f8f199ce35b3cb2

SHA1
9616f40836906d389f8aefe6f62f5b8364e59eba

SHA256
c7880fdf4893ba2dee98b7fe3d665d2a9fc0326090da3a35034809d79488aafd

SHA512
681a65454d34fca7c14538730561eaae0e0498e5f5c52cbd21d71c8cfdcd5f5cfe199fa5ca51252630892e9a8e1ddad4eba5b87259e2bfab8ebb3518b471b1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247540d6193fb89191d886f0d764d4b6

SHA1
9aa258bb80ab070f3263bb4e0c6d53db8bf4f953

SHA256
82798c76b9e0a14e1ad64904535e06d55961519b0a416c966df7e5b198baf2aa

SHA512
ee6ef2f2f0f03ad4c8b8daddffe016b6d785bebda2cc2f62dc992734c3a8a5c950054404361d6b7e00aa61e6698feabec9f64650d1ccf8879b055d0ef10edf8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304a1d49629438716f66a342a5f740e0

SHA1
8080c7048aaa8eeea0ad9b3387b5c1c3bace77c0

SHA256
2fcff8bc21545c34a39a5eab623a64cf8b71951cf3f5548ad148475555e3ff85

SHA512
8e9b5f472aee09e41318535230dc076678f06458d426fb74776bec07ade2e101aca44ef582cfcd337c0757d3e533354be8ea501df633b45ad92b300973baa7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b17c7f14fd444286dca484ab9c59af8

SHA1
928f035d15a3b10415ae1f1024d7384939ac2513

SHA256
605fbb815a974ba28c7f170c1ed1edefc5e3f2d01e96baaa190205b6f6193e1a

SHA512
313e77d4481a6649178e8b7e0a20f22706c7b7c9812c2a22526e252ebd9c3ae38e16f30c09c3d81d8968f30b51eb6e0c55bfb5661ab344e2bb6c60e553385072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49e39ec071f2a515367188a78ea7aff0

SHA1
eb18020ff3af108acd758189376417f1b0c966a6

SHA256
239f26f53080281adf123217a85b7a33442590a3af1981eacc438e3d13d5abdc

SHA512
9c6b19c018c6cf8c4c0dad4b6a35df6f763b8e3b03690fe0e46f562a0d71aee9179459248e406889aacfe80b8d65482e5bf57e158a85b6dc2a8752e08600b912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37d9969610fba05d61a793659d8d75a2

SHA1
27eeb2c99a6b82630310f4cd2dfbbf5588f4ec13

SHA256
3e8010b2691d123cb6de3d44c56ec4bbc3b839b2c605b3476d7f832f485a9a04

SHA512
79a8176cbf7acc7c20c023fbed0aa1fcbd43c12ee6acc5cfd29e0a6113bfa058b32283a2f2dad3931fbd8c2fa4e160a2bed2b25d857aaa0131224229b79c9378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106c989dbe9e7d48c398f9b04de7980d

SHA1
7dea8a75015afd389ed68f0f1f0c1fa6f6d8da13

SHA256
cbfc516864bd6a062c8fc58cff4448183e5f948eaf999c18c94c2fb43fee3a2b

SHA512
4838083990ef687eb5760a207ddb9d50fe9f1b4f32de4b061fc7a7a03e7705f63d3499181622972906dae29996abe3e2f06618c08970b4d4261e4fdf501b8fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e5b64fc3dfa8925c108b91af3712e14

SHA1
4be8c8446ac43f2156e7163ea65c934afc42c8db

SHA256
1f15e8712c22b62b7916d6f0da56e374f8a33c8fc82adfd31b086716c35048ae

SHA512
3f4116dc45853b88818f35b3ba906e31cd8e7be4a548e65d4cad5233240cee8bf8c4bce512f86bbcfa2bef3963bb5ea56fb2bb8fda5faed8ec3c1dd4d83afeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76fa706b3b81cb20a185867f7b8835d9

SHA1
8798bbc7c1dad6741248c45b159fb5575e9a687f

SHA256
0fab436389f0cfb0e9982c800ace7428917374ee12048ecf819b236de68fcbbb

SHA512
58dcc5f198fab97bb9e473a3ef0ad479df37d64d7d194ebc1f48befe4997d737e6fbcb032da36edea8a024ecdd524eb109940b47d528d7ed4f3e861318f176e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e01fbf84adeadae9133c7ed6db45d722

SHA1
7ebfe0994e17a69c5b3e531604026bb1d1216e50

SHA256
e71c2676ee5ed64edce1b66a0782cc7d99edc2712a5b9322b20817c0e18e74b3

SHA512
8f398792d289df130c3831fd685a74d11fb38f104822bd236203599e699c73d8351aae72b0e73211799154d7011789a0709fb6fde133042968089938ceef444a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8B1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA97.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit