ae28545b3712b760e3e6d3c11e81dfd4581fefe88a1ebd586fdb0daf0b456841

Analysis

max time kernel
136s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a845bb7f70050cf3311dd81dab1b4665_JaffaCakes118.html
Size

22KB
MD5

a845bb7f70050cf3311dd81dab1b4665
SHA1

d72e687b82662795a51a96a8e0641c393ffd52b5
SHA256

ae28545b3712b760e3e6d3c11e81dfd4581fefe88a1ebd586fdb0daf0b456841
SHA512

c1b8715ff49dffb9e83a18f7f0744991ebecbd6fa648204b154893af731eb64825e2a519d845f9c7748662db9e6561b7cd0e468aaf62bbecdf6a20abecc632fb
SSDEEP

192:un2Ryiqa6bf+JL/pFxgYphGWGwZkPBGKxIZmaBG91UpB+aBGJ+neMwGi58wsGfwC:/haUKFsXWXP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c2be0de0a2fe48fba804a6cbeabc635b964e21721110dc9ff11328ef588ad002000000000e80000000020000200000001f0d9aa17f74c278a45f027f141740d6f64d28512fc3d0928a492b9bbfc0e00620000000f30a4530bf1d9e4a3569ffeb1c8a62a6d4c3d23316cbf00b251b0f5858cdbd98400000006e3d4d35780911a43cfadb6d6569428ed0a73f3cc0176b60e6209ae89f985bd7ade0390b46f14d9db2dc03ee540be70a5479010a2ffae8b976c6880dbd676d41	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424507376"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000093001e65d9dbd8e64a1cfe323e380ddb0880313b9c4bdf6834efa602ea0a84b9000000000e80000000020000200000008949acd42714928b7f35911b8a182221d338843dfc00a1fce0fd9e101a42a4949000000039f38e3b289f27ee3e3514c115dc46415c4fe35613c54e31ba4a0b4c1bac37d78a9b1ca1180fefd94d74d782142cee88c6f6f16bc46da9f30476a6960b3f5071263e30062c12a305ee033e297a90ca2616125d207e0dac509a20c349425ad2a48e6ee3727ede074cdfef2136902040e33e1194a78b0d66f23b8cfa70e0e15048f355e7f6b14134f00a9fe3bb34e3eb7b40000000ab629a04636be831d5bc2f9442968108d20e4e21bf645a128d3bab30c22e57f3f4353de3a359632a8fdfd376a29340bad7353880678ef310ddcf5bac5cdea18d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA80F2D1-2A14-11EF-AA16-D671A15513D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609ddacf21beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28
PID 2576 wrote to memory of 3060	2576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a845bb7f70050cf3311dd81dab1b4665_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7436972b43d4bfedbb65d6fab627d827

SHA1
e02522ec16a7d658b984612c01ebe42bc2d1e89d

SHA256
345c0631c14ce9b66533779a6a1cb8755a64f1943e8a90af84d80d3ebafb2e2d

SHA512
cfb63abf0880708b66e28a3e37a82707ea43f1d1063ba2fbe65deb9a8b8031b49bb07b767f664bb5fa815730f2be508d730ca321e486ff2584f0dca2b9d89996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2725b16c36989fe12c45d76d8c59886f

SHA1
63d7c5f00f528dcb1ea1a1c8fa0edb34c83aa0f1

SHA256
c36a696b7c681734c8300e17bea086538121eaf7dcab1cdc48e015dda528e2b7

SHA512
d33c15f870aff1172253d6705b6e20086f74b15a73c8d5375974141f4123b2a7a6824ad1ea7777f6f751350c017a314bb2f721fd514e4ecf46f05006de1139ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790278e8da7dc2abcbc96891c81521f3

SHA1
fe3e09ba48218bd54442fcc2bec1da4df67beaae

SHA256
cabef69c8077fee721564a1344648aada51a714bbfba2078c013880f64742f2e

SHA512
08bae2ecffe454b64bd0ee3088636379503d97461732bea4e21772df1102072345519cbcc792a24340e90316a7655d1228fc3352c12ab4443c8f9550c593f742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
622caf5adfef9e99ffbf00c467ec7ebf

SHA1
cc655309104b05944c8c9bddfcb6c960767c6b53

SHA256
e65609af539a0f9e1b08367cd6a024163147fc49cb21615a7e6c1ae41339a57f

SHA512
907a89d17b9bdd6c71e00e4e018f3f42eb999f8e79f2c87bc7911c7fee8f165194ae4e5fd0fe5a495bf0f5ae7b3bf8e7d0608a280ca8bc3748de52ef4243f4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf145215322456e1468c7c88ccaf1e1

SHA1
e7afee050976719460c182b809d5f9770e15e913

SHA256
d2cf8ca2695d9c2be49cf26a68fe589493a3a28390b49c46dcf25b87e3f43070

SHA512
4205d1c2aeb53a9232f123deb5d2ca594b028e14a047d9d2b615dbf281e8a258e9fa7825504d158d4f640f52a5a465c1add25116c9de7f8e16cb1c29eb023f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3a0363166c77b14a1e257d1194f60d6

SHA1
cede2c3110c0ea1d685fb34b6d4527e453ae8344

SHA256
9260ab0b76889ba53d5dfd92c3b04599fc585c4720b90be2545611be3631a085

SHA512
e2a37c6cd725c5bab3a5dcf95790dad33db332ca3dc4cee6362aa3d40aa680ac9644e63c45f977387fa18d2eebaf7be2cfaa61a8e90b4b6dd253c375c6feb5c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44844ccaa215c12d14d6d49e42586ca6

SHA1
ae0203a59da657f414a7ca32e09f5702aafaedbf

SHA256
8f251f6d6857d9204e489ec3dbdc94e89831c95da1ddf3d05e5aa31c36d9840d

SHA512
2b4bc38c9e3bea29aff6f3913623de4d828621b7f4ac10805fee1f0fc37428f775023eb2d5fdfd86a975e2ddd2a8f69f6a5b78d705eea93e68ad93a225a8d862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df5bf0e1e426ee267158b096b5fc9677

SHA1
d36bbb56352617de0fbd38611cdf91e2070adc02

SHA256
2ee6835a1fedf62e60628d1d4be2fee4eede8f3467a72d272197565aa0086cc5

SHA512
9515b3cb4cf065a861e365f49649f15af19d0e1d873ce13aafb164ed7ac75c5dc5a44cf29360db64c47352536821b0ea1257d8981ddc9435b39466306e5b9ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ebda147ac5d01b04b474425b8ef93f2

SHA1
a5a85962cbe85c07ac24b9e1873784fc73ab610f

SHA256
c04c72449c2c1e39df3127fe8a8439d311ed7000938c66c23412ae79db93c563

SHA512
601dfbfe239df3722a17569216139c4fb002f0041efe0cd37bdba4604467682ed53c4b538b4d2ec4741361c2985fbbca02177b599cd34a0bbc7de972cf963dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa78cd8e56f8c99b66b6389444d92cef

SHA1
739345b8dc85b16d093e6c4b9b991ea0a2bb3c5d

SHA256
d2015a49d44682b9a1ec26481030a6cd5f14aebcbbc20fec9fe10c58418d8c40

SHA512
c5d8fdee604717162391d5414a1106753167fae81d3c8f4ee591fcfec5c351e1e280a0093086d02311518f65d1caef255dbaf85e44da609108108de2182355fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75cc9594614f34e2e38e7a9eb237e26d

SHA1
d04f18f359520520cb96e1a34572bf44f351d929

SHA256
c26b6c624e3fc6ed809f06b534d8297ebc76da23876027f9f5d6faeb456133c2

SHA512
492eb4be0e58b05adee7ed56e97f37224843d553b32b12fd4c955334317a5999fe44bd0110e5c1f04fc702368e0acb274bfd3978dd2d8a5a4034c8eb730b3895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0578c806535498e86b1e81b130c3aaa

SHA1
d25961658532512ba7ae3f6fce53f050f0970625

SHA256
92b089d5525ce5fe4f2c5401540711e9dd701185126b0233310e8dea5d42e2fe

SHA512
445bd639dd7302b1cd40cad684023031f4ab95719633853eaa1fb6d7db944ad1d285b9fb484d4f54dce6e6e51117e8cf668346ba079f3d9e8404a0b92f01ff6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e5e64913ffce4b6a65a3991596871a

SHA1
77129de88309caccc62fdd8b013546d483bd7965

SHA256
e0d56cd2e8047abcb9db36964aafcea115efdcd2fbc1d9793822e5ed68a0a9d5

SHA512
c2f7bb093e71615c7cb8e5f78d14f53e2a13b647459f94245114ae10065953a0157d242c4b052c6206af00d849b1fb8ec59bad240f7176dae52e15623f8199d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25eb81d2c69defa0ec2a34114b6e00f4

SHA1
146fd343ad94aeddfd7408cb23e1ed41f0528b08

SHA256
1a9965cd98318c9ed6817f637a6426f4566333832403d6d352bc6d8be71f59aa

SHA512
e7dca10b44164c6776bbf01ecbfa7e32aa66aab7510668f72a44977c61a62bc7bf894e91c4bf0b1cb05673b62fd9d0e2e9627ce343e5482a08301430bc871f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
193a13218e34a19932d967d71fbb4e60

SHA1
e3f22f1b6198591ff8e3cee0e679b215afcd51db

SHA256
12a43c9fee6eeb6e622625050a4113906c882a24323d9103c7cd7bbe0748139c

SHA512
0bb532440f2b166d4ab5a9e537b78a15e53c10a52b0767a3b3078830ae8b301b708e58bdfaed8562a3c383e4ebfa3e7355070f3fe9ee25f2078a8aa56492aecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b059eff6ae021e7e69839641c69d645c

SHA1
502fe7c12c6137b8826eafe0400f031460cb72e4

SHA256
ef1d38ea33b5e945582defab9bf8f55f16f61a4ebe173c9127cc53c5544dcc22

SHA512
58e75df7f401359694e81cc1d06a2222eb5e440b9c025be6a99dd240e59391f5c4796c1118815748006124bfe151ca6cbe26fdda6839002d2152b76f6a6a6d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2ca549dbd1fbc4555bba586ad6660ec

SHA1
5d86f1fb32b378a89b97a0bdbb8aeda084983d2b

SHA256
9f45099de34879210fdf235377c2b602cbe6060b28d9caa4db6ebf6f40ab970b

SHA512
6cca4034717e453b366ec79cad2f6f5f54f013c2ef36e1f81905b5312e8b4898ca7e9fc1543cfc28840ab61134ee88377909b36fe60f85ee503de31e413a7d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9070.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit