656c71e26847b604b0a4051c7ab46d3fcda7d7707df7aa67b020666b04593dd6

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a400f9538d1ce8617022d41311f3aa57_JaffaCakes118.html
Size

17KB
MD5

a400f9538d1ce8617022d41311f3aa57
SHA1

e54e9d22b4ffcebfe9f3166de308baa4f97db0d8
SHA256

656c71e26847b604b0a4051c7ab46d3fcda7d7707df7aa67b020666b04593dd6
SHA512

cf02d51726c5616fd4202abeafe52c2985145b0d59a30e5ed92541904c7361f8fb4121912e4d88d26b91cc92884c883e3bdc0685fec8d2c4440d78da5951f523
SSDEEP

384:unwuqUEnA414ytrA414WSlCA414EFA414ivw6+YRlKMaeL+TL:unwwEnA414ytrA414WSlCA414EFA414X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EC337D1-2946-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d8041bb2bf840ce153336bfce1d22ab7bb9a56b72fa35f5263197283684111b0000000000e8000000002000020000000dc840e18937c4a27df1630d41ffac288622a2f465b129a9eed73de6907ee010b900000004b542c0932dc8a5536f9daae9a42bc76cbfe4ab066868654c2b7fa54e69a6e2c6e6ddcf627ab22417922a04b64c5e62ffc95f68ee30f32ee25072169ae92c6aef3d1b4d569ddfad842ef8bece7553a51e16c30a617832710ff91e121e39e39deb042c6903771103795d5c660a0f9191451d696fb052f1b2e4de5a884a270359546544c1f79607d187b754ab68bd46bb740000000512c298c9dc20b334293ef6177336d7fcad0e4420eaae56a09135e96c175412ed6c736b37e30aad23edfe1b696d774cf09e4ef1fec8e320f9086cf719bbee6cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424418558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d6e00453bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000cb2b0bc11e4f2bf72433f83653f87968d657d1e8df22807e4bfdbc5440488196000000000e8000000002000020000000c6c205e9d01dd094a405a940d35649564fc169846fdb8acfcd81818faf2d4ad320000000442df8f4f4383f3636477124cc683b8f2e6a191fa280b2bff773f3281caeec5e400000009b8ef98778bf5daa1663ca84bb4886c6ded0017d1aa172842a5402c3cc59421cd5e89404332f88636df1984c22655d8024a28fee68dda13ae9316fc98c4c9b09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1560	iexplore.exe
1560	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3008	1560	iexplore.exe	28
PID 1560 wrote to memory of 3008	1560	iexplore.exe	28
PID 1560 wrote to memory of 3008	1560	iexplore.exe	28
PID 1560 wrote to memory of 3008	1560	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a400f9538d1ce8617022d41311f3aa57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9fc85085bb6585f71cc5c0925207a01

SHA1
9d03ec65f299c74553c2c23ba19ea006c6c45c17

SHA256
33608b865b5969e443173f8675f6aaf313b2349c1d8dde24b2abca3deefba9d3

SHA512
2e3826aa8f56beebd05ada22356647a5d792612e594c94c66d060e8c6497edc7e356707a4bbe89bf4d1962f8cd460343e7371127e56619401ecfd2e5ba451479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c4726ddc9537e9e7c1695c3de093059

SHA1
2c4b21e8854fed36ba6669c7bf4b9f4b9babbc29

SHA256
6b1e3650aa9a34411b04bc3135666d3d316f49d3a9a5d897fb31bdf559c1a63b

SHA512
bd8a66efc4c9ce443318e36e67b17c820185ebae4c043ccf2485f9774a4739c5304509218216382f71f27dfdb6bd3da4b2f56a6b0fd8c6d90723a7a7909b13fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43df0231eae4e86c48c24f2e391139f4

SHA1
1dced02bbe75ebf0d6686fb85a136808f207f109

SHA256
7074311f323a573de0b4843e4514880bee564c6bc8f6389c0cce812937c045cc

SHA512
c677fa2eaff6d43e02eb0b00b3c1e2274759d38ccda498211d5345baaa1ae221256981981689c83747011235cfd719249319747139c5546c7149f609ce6defac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54dd7d21d33dbb5c898c1ce79d54d865

SHA1
a091d07f453f7af76cacc7ae1f985de4bec45dbe

SHA256
c51d0d55171423af62bb39c0d6b4876270f04ff3036c0747c143d7043555c5f3

SHA512
fad30976c4e5be5a0da4050b60c69f27c2d7905a60698032ef1deda3aa03016b50ebc68dd23c25afcf1c4d62b1fa838c2e3a7b693d2ad569b9fbd3803f5e25c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc961634e2830e258387eab3c98aea37

SHA1
62ec7776035a230ca855f3ec05b6a16a6646a670

SHA256
09f4d2460122fca55b0a6d7ff4d83096f6d0a8db07fcbd36b7a03193c4f1b05f

SHA512
93d7e9f9e26cd1e34fc05ae81f6f8f334264af98f3cc64960433a53400fbf5de8c5dcc9e56781d5e28cf3f0b1095e80f6578f1471e549a19037bec1953bd971f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d422b0dd6437f017c5db3a4b9705837

SHA1
18cc6720b13724b1bbbf7229d831e12c223e330b

SHA256
51afa37df94853489c00c314eb30cc6bd21e3ab817141c7a04196462c9659215

SHA512
9e3ccb81eb18409a2428d391c8659bda8157b55b3dfdf896c6c612aab766e50818b6a28616af641716cf85ae5d481290d7d3983437eeb926c49683261ca85e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ceff09d568e676834e213d8db4722bf

SHA1
def74fe4f71e97d42dfdb4eab0bd8ee243b5528f

SHA256
191e960c8824a3af0ab2c7a57cb4a27e051ee1654dbb0f010793c7e9b0d43e59

SHA512
51a49b38993bc5fbc8fc93312d9c3741cf3e8b24dbbd9dc2d83c53365070b4264f1d84a964876f00ad691196c896322ded5ac51b013d1fab64bb00cdabe77f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
542c0969e9df78c727f1f1cb332b7ff8

SHA1
e4e6b6f76d0f4bc707c9384a0dcfbb765dc968ba

SHA256
58e8e1f3708fd3f5ccf2e0caf82ee00b4a9001ce0c455e80af5f725a2f5ada08

SHA512
858c5c9bfc61c1233d18a64256070910812f278ca2979f2a2d4b4cbd67fad2aae47286ccb4ed8f553a4e79f65573bfaf094886c7e96e290269b3ea158d9d109b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59bec010f8046a4dd4e525899f03bcc1

SHA1
09d031b445a3e76b298cead60efc7acb3b429ee4

SHA256
dc5ae0a618e2a32ee05c634e9d8918d23ebbeaa9195a810087b50b376b48eb31

SHA512
7f516b21a8f2cf6e5e2d583f7323d56ca5f7de8f9b213c7855f9763b05a97316dc15b3a5501489acd9d07668d873da553c90f8e95b8e3035fdcb09b866582af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1432d3a5b23dc2b947b22d8e1921cf4

SHA1
a8cdb3777ec8ddad02397c0169253d4d52b16c19

SHA256
de8e6175a5e7b9376ac25756b48a2ca5effaa792b1e1cb688fd1e812049f6967

SHA512
2b24af6bed27fbb96d800214e3c7c693270622c6201cd2fb9d5b77b9c6345b9084fb4fe011a45887001fe4e0d20144cebc4bbb97c7579e87b3e3dab145ace66c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16860e421eaa29865d4f07c7805cdb75

SHA1
096ece23e4731f9eb6bc80b240ddc8f5f0d814c4

SHA256
61d0064d68394f3c140c31bcef0515c7f0340e9a0eb92b74941276279a89df24

SHA512
80e6ae812125e07d8d622397eb1192674b94bfef9b0784a0c6b3e3122dd5ff905a50316a6f7fa420258c8a7f5b9cb7a237bb329c45659cf5b98a0ebc301fd608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a36c1af3bfd169cdd1a423c5ad56875

SHA1
181e31f82bee5ad45baf728d892d24c0d88aae3e

SHA256
66c7336b5860b631f532fb8dcd3af0733eb86f0dfeb8c11593fe422e33b47a71

SHA512
350c41eef79c09c25c94b21c57afdba2ec8094c99688099c698642467883fd62022664c2e4448927cefdc4b4e0ca76afa1e310a570d3fcfd6e7af7501fc7b652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e4cc0410f3b318d368f855fc763cea1

SHA1
80b935fc8cc764149eb32bd9f188c37db34a1bb8

SHA256
bd0a6242695fe0ecb94dd03432ffe4e237385407ffecadf1393f31c4da29bf40

SHA512
a0da3a9e85e116f1d2ada57c3870f7f3323d50374343b86964368199dfb466dc27d988a3d9b974175a9032058aac184e6e8be561a5b23896ad5ffcc3772fb3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78AB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit