c47e7d33bedb0f363334cd74718c63f5e42625a9ad8c0d295ad5cf08041afc22

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5aee82f423234353282e5f1a8818aef_JaffaCakes118.html
Size

126KB
MD5

a5aee82f423234353282e5f1a8818aef
SHA1

ed006acefec6e19a977f46e5111bc55faa190021
SHA256

c47e7d33bedb0f363334cd74718c63f5e42625a9ad8c0d295ad5cf08041afc22
SHA512

964d3634bae25c6f1598877cd36f522a5447858cbcc63c4cdccd93f313096d5bffeeae7d2fc70dca11cc82fd70d27fb70ecd09817fc30f6918a5954e2ead183f
SSDEEP

1536:aA1cH/Yw1wLIe/OLUfHL1UuBT/fGbau8Ewk3OZrZICRfAZ7:P1cH/71w7me1UuBT/dQwk3gZICRfw7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409cc78492bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a920edd732c7f1c34f1c72a983ea07895b547087e556cdd6939daca96815c4e9000000000e800000000200002000000021ccb2323a9f0a791c808d2f451c57f7da0ddcff3021033169202e181f866e479000000057a15e94abe464efbc82eccfa8edd4f857d33acd33a65326702808f165673594290344eb1b01b1ca0c97c590228f44b4dc7002d9f115322cd73e42cf30497061432054ab927e92d51f93024aceec1183304b731891f2af0616a6cd96579e624709f5dee02f0ba81bd2f453486db66f43270e2f90d24ad52b6a051dd8ae16d483125f8311dca95fbd354e80d0dca3687a4000000051b236f8d77f751c2be1c8235701460b82d20770c0d1aa353e3daefa4fe55fbdda4e2903f59e965c3375211a254adc6171613458466e0083934fa5367c73374d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ea5f550c0d4c694d3914ab1167e79de983479f1b09ca8d2279eab3cb6c85a6d1000000000e8000000002000020000000a6db4848d4a0b44d7cec36aabb5f9e93dd2b5a16e098e0f2d91163ed100fd38020000000c8b443620a9bdd3a2ded2cf23f6c9f4852d6154260f2ba6db7783c61933a294d400000009cfdec8938b88091da50acc7ab1fe4ca7ea7982f78b53a02a194e7deff80bb1bc73917c5b3f44a2a3a386b6ce7e28c6bcd731a7ff89395944e6f4b0c38b818bb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424445825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABC490F1-2985-11EF-8156-CE03E2754020} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
844	IEXPLORE.EXE
844	IEXPLORE.EXE
844	IEXPLORE.EXE
844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 844	2236	iexplore.exe	28
PID 2236 wrote to memory of 844	2236	iexplore.exe	28
PID 2236 wrote to memory of 844	2236	iexplore.exe	28
PID 2236 wrote to memory of 844	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5aee82f423234353282e5f1a8818aef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91c8e180fc8c396b25068c4b713cadb9

SHA1
dcf1d18a7a18f05fa9677673d94f10e6aa5f5c09

SHA256
63db5b3d30aa4299c8dda30cb4bb4f7000fa13aa2abaca676d2ff972fbfe4d76

SHA512
86169d62b929faab111bc40f5f83d50996465e16bba5322a25630abc877860089a35c52cd82f0264836afdcaebf6edd5b5f65f8a45f0fba377b3f0d0258ebe8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8eda75adae5c83dfd0ab33c65b4b392

SHA1
744dbd0ed540574a25e7f1914d565f1582efdb17

SHA256
f56e83badf10d6be59d8c3c33d2aebaf5100c831e415eb45bd15c2f965060ea9

SHA512
61b60bb9b88c1ee31ff0e1de05085ee60402866b300788ac03e3eec99915917159fe97e4f6728e8abea1430117f3d2f6fac2a5b2034fed4a6396b964eef42a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4a7e52be0af851b2edbddc8e4156629

SHA1
75f1160189e6224764b4505c3c66fae97eb0b355

SHA256
0edafc71b425de29613545fa84231e21d10068b0d51dc48dac4b86ca549cd4e6

SHA512
332658c3e59863166b3d78a32008f71bd8fd6c7d12b79593164cd596808cd0a8be4f7f5e97cf35d1e0911ee8e0c0631ef31f87f840b491627469643e6a4c9c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
290682b5185442557db6c9373a0c1746

SHA1
8a0fe19028cf4698cb0bd3927673882d6a5bdd80

SHA256
1291d58c459c3ca9da709dbdd8dbcbe929e8f366b0be29308702682c74f2eb50

SHA512
2274e5415d7f477b084dd96dacfa31fecdd080033a67d880953b5dce4ccd3b508ba10bc0870a7a73fa8fef52543936e9326040c6caa1be0211ce568a380cf90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e2acdf075f0e3b0089f4080b55ac87

SHA1
0e0350340e14c45cfc6a701c4d51b90dc71cf68c

SHA256
6db6bd9304d64b6b5f9b66c0744facf288ea43091fb4709955182d5435667ae4

SHA512
7a1218d595224a8bd3f882c4d52c08685376c630967d8fd2397c7e6c956918e2c606290461e7699d283f199df60ccddb2d5da3fea50d95f78435f8e0e01b273b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f60aea6a2986ceadc812958da828325

SHA1
361e386d8f82c3eaffd399d50ce59596d6469275

SHA256
08caa2aaae3e96568fcbd3ce1307a568a83d05c58003b042f95c92f44d7fc8ae

SHA512
14e8a8cf3df6aed0a436142f82e6a86f963174e5b136d986de7a57554698e425ad843349f1692cf40d0db4e36f0f3e78886d4cc838d09f7dcd90746e257d3ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb7d8cdba8532382dbafdd43ccb542b

SHA1
5de6299353384ae16d9d6aab73ad8895532e8ffe

SHA256
2be4afef898af32fdbb5a5fae1d128ce34b9e90e6cf807445040935992f05e71

SHA512
9d7834d9a57a50f84b3a3a1b2b12e69ce53f5a93628a961c20a517c63b6087ba228bb2bb242be581807271bf34b4dfefa8b328e6fc7ee6da5e858bb31783859a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0caae9e61e375d0343371939ef4414

SHA1
b41128944d82fc725eda109643ae7bf96a9f1116

SHA256
0a5819afc86984cec5f2a6ffb56b0adc8f695354a48356720d4305c6e935c7ce

SHA512
ad991bf84f0c135530c3898b658a687266517f8ee44e7557d29865d9947a0b60787649583d33b5d671760f4a3e29f1c978ab6d4284d9c31d9325da9d37cfd07c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92f29ac8a5c0f6540b68838b87766d70

SHA1
03fd91a904c47d671d781dd34d30af91d06f4f44

SHA256
5dc70965b253c248d7689f5affeb69276ec9c28221ab54af25b17cda71846664

SHA512
c15de25e77fa6ceb9b08a32869a4d53fe5ec540977172790895036940ac867633d1d46a9feb93a2b82989cc7eb0ccf49cf5110d3c94fcc38309b8e7fcf99bae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55fd32cbf3be12334f9442c0b7bd5a97

SHA1
5e7f3410f9169ec6d62afcf8739d6cd3e2fde058

SHA256
5bda411f09a4ccccfb8337dd7b686dc14e25efbbff0abdaf095bfce419d849a1

SHA512
a1d1fd5e6404d2f996c44925dc9a38fe7c24040dd053ccd5b4ca3d40cf95dfd5fd94f7fd741405de5cb55f0a7d205d942a157421422d6601a79d3f49526162b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9330ac7965261ae5dae871b5f57814ea

SHA1
a1a335169e33c1a979396f70acf81405c0385db6

SHA256
bc3a51779174df2225242ce1a8e38609c4b20eea3acda9f15fb03d0c4814ecee

SHA512
ef9f55ddae127cbfc7270ecfe988eea212780652e53907b8ff346832c4454fa945e636d9764b43e57b34ffabbfe2345b8f30b0e8b94c0f162b2a7473e6e16248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4489a6aba3631b0eb4319029f496f497

SHA1
d81fbda4d5ecd9bf559aa489b452fff30a4cb6ac

SHA256
65c3295e4d8f83f8bbe39ae9953d53c15c2f15a0116bf21724aadbb4543d2dac

SHA512
9ccc0a7697ec1644406a7281f7b0f30323177d34b21cfecc2447a3c5d79e01e67ae6d1922e858f841d29476d4a36d3b196b615a1ca986ac0735395118f234c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59557a6ebfdc9ab6cd0f5a20db29bf79

SHA1
cb0f15b810fe71ab82b5848a1e3c293c31adfd9f

SHA256
ae12c2ea4211f545172e6daa13f61514c1d2a8409f7b3e9f85f3f3713a96299c

SHA512
bfdf6df69df6854e9c2e3548bce87524c89115b8f64a8e7ffb106c3cf1828512980c343973f471a531144c166da4fe163cb109bcbf398842daec238fae61f51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25abba6bfd0e1f01ddca877accede5f3

SHA1
40db4bf9a53ced920772740ca85053f149c3eca9

SHA256
ba72767fb1510b7a57e4ef8165cf0d53b143a5d2d24c218553739fd794f06ace

SHA512
517bfc40da136d2e10be18c844a89db863eecca3cf1aa827fe1dbb1eaf7e7cd95d71098c2e24dd713f7e22ad07334d14ee46289aab4026aa129ea107e46a982f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a783880671fb68c05290afc9e06e3589

SHA1
0a0c2bb9e8908209563eaeb472f5b41329703759

SHA256
09f510af75690bfa833a6fac0a13137c30f4b5801e49065f935357e047e04cf6

SHA512
c2c0eacf1a9a9a974b77c6f5c6f7e266c1aca1d11e0fcf12ef2b436251c73cf8ad4a8b66a7b861dd76c23180b92af1f1315b06021ad4f2b3eaafda2b0ef98c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
642924009968fefbcd825557b89b1604

SHA1
21862eb0a31ffcc16de0e5d4665a36535aca1b62

SHA256
d2c8b9226f10135c70a9b6a7176978fccef5033bebb682d1c05a5fa3bbff9e44

SHA512
0e31d396e2f2e4a7da63cab8eb2885ac59d578f4cd214e78a144b42f037b07586aa3935edbdfe205faaa36383ba09081ae92b778922c40bb09fad439ccda8760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08489b16a4c3c20e1e683b57c5a6cbd0

SHA1
408fdbf2aa3b41ee8816644ec8a3404a9b6bfdf1

SHA256
b0eb17b2e50048f2c39d755ecbc2cbf17f428b6420e16352677d1f2b6287dc2f

SHA512
bc7c2a703d828ee71e0d74d82b24d64df991762f13eabe0d3f14faba7588498c84f02d8a1178f6d526eaa60975f6e4edc1d4c5b96e1de4a35a1e3b0df207c6f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBAB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit