c84a98d99d2fe8532012db62949f33113dd7a18a31c33962099c7fc89618feb9

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa1b07a153af3cfc2499c7debc532b5d_JaffaCakes118.html
Size

462KB
MD5

aa1b07a153af3cfc2499c7debc532b5d
SHA1

8145197e78b698a4472a9a0f5538374776a38e50
SHA256

c84a98d99d2fe8532012db62949f33113dd7a18a31c33962099c7fc89618feb9
SHA512

5d771f85991dae6974d9fe24b4f3a97e75a9cf9e73092a434421901d0aae9e9b935b777128e33f73984e830f937018aa2e135469dc737279d1a7e8c3b405067f
SSDEEP

6144:SgsMYod+X3oI+YhOsMYod+X3oI+YcsMYod+X3oI+YLsMYod+X3oI+YQ:f5d+X3jM5d+X3I5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424536162"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF91A0B1-2A57-11EF-A155-FAD28091DCF5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000b900807b0f1009c4ce1571493ebb020b5dfb2006cdf05dce045a81b05cdf6f9000000000e8000000002000020000000d162611195c1cef8d474cf03c4442a23211c184d59e81e09fbef7a78308b8efa900000003755b199f892aff9a0059391720eb06243fcea155af30091cd19b250195fc7043b0d34ad44ffd1f72a0ab0094ffa0fdd8d8e4c960387071e0175b2f7b78f26eb5287278ab2d23230e9332ff35f614053517d33f857ba8942b835cb3af1a3ff3c3e263a737f8921338804d6324b05da3df981698171cdefe0f231e7a3897a817cd4726ad04206e52f68063de48a073f91400000005f6784d8d01700015a050fa14f28064a4e2aafe60c53da17dc7ef6a8d7bec35f399ed57944e80f7bccf9310dcf939f2529101afa37f5fe99cb221ab13acd155c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000140eb1ddc415c732cb6644d3d2eae5663fba670e83c5148fb0111fc5dfe4f1d8000000000e8000000002000020000000250c860a2b780d8c417d937cdd05e47699bf5aa10a950a3dcbec83367752f21020000000aa0b228675bb1bd6e73403c5cb3f2c6e966e01852dd7c2014d3b19eb3c8c83d540000000662691a4a35fa244c4973a2f37dae95c7b67057b963a75486f269d1e878b7af0fe3c33857f1a50ec39a199ed9c81f3edbdb2c42d977cdd57b92b1fbbd7d80ea5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207281d864beda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1468	iexplore.exe
1468	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2768	1468	iexplore.exe	28
PID 1468 wrote to memory of 2768	1468	iexplore.exe	28
PID 1468 wrote to memory of 2768	1468	iexplore.exe	28
PID 1468 wrote to memory of 2768	1468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa1b07a153af3cfc2499c7debc532b5d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743d108eb829e54b3943efbe650fdea7

SHA1
8d81c7c6d8d3c8500e32a4d50dae3d41bd8d60b3

SHA256
967b96dc530483ed6623053639cf0a51891f5602f944f6b8b3e7a69bfaee403e

SHA512
d1909217fabc4dd3de560b0626c768ec4716adc37a74066ad9e5726858f9a99462eb873427a603e9de6d6f1901180f6a0a14b6d7d9da742ca46f28cdc852e858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6868756a14ceb001f9e1c91f9c99b021

SHA1
fc4a196889dcac1da31d8ed9538f83c18b196817

SHA256
8caab9f42e4da96f778b7dd676b28935c85f6f54938850ddbc0a62b7363535d1

SHA512
5dd4dfa7e4487ab2ee224095a8428f429f53a15759b2866b954ae70c93ea1b222cade085c7e97b9b61c22fffb46b8bed57203ebb775152fb1a8edaf143efab4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f57817c8b7ec9dc1bf25b10a8e4b963

SHA1
a1e61453e23e2176b6ca3f50b26885601664491f

SHA256
1987e835f7b3e9a1e2ec7bb97e996cd3aa9160f73ac04b6e86b8e94f3dccef3d

SHA512
ee44de4c126efa79b5f3cf696c58c8ddcfdc59f3b8bf46f366ee5133dfe3cb1f5c0439513e3d4f983cb362dc159faade3a3d2f7127aa4abcc4464d44dccbf35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fab6ce9726fb1fff3ffdaff136e36c

SHA1
4b1f14d612019945d9f55a90515459c60640b3fa

SHA256
07be9fc497caebb6eeab5ac706fe240d864086ed9fb8374420ee542e8afc8e5f

SHA512
9f0a7387203900a8170c99f27c94ce23a045ce6d875c3804ba4829fa4811ee1122b557180e0b94fa2b293f1b1eac546af3f11cab452a95b0fb37b417209d8208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc71ef7d290005e6afdff495e5a82812

SHA1
b0d28ee6a8ccc7d050feb2c2ac609dc599fb607c

SHA256
e9710eccd87d73dd98e290752d1c222331a9de57147c674099527387f997370c

SHA512
bc33efb460f8916fcd665a1b9b12b45f5c93445f90488dd3b77a23de325150d3dc118b3fba11f011c0b89493540819b8593c953d7f9f2b0bf0a4a9173038310b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc49a197d9eb0fda2f09e2042a5811da

SHA1
1abb2486e4239509e3c3adbe30e459a92e36fd32

SHA256
c805e78d2611ebe2c329cb0c1012787dd0e32df92d278c4c25ddf4e596948af7

SHA512
d93bd6f14b57796c0b175eda70f0c080f01f9b47f9a13e11a9222d3573b49e47acb15fd98d0ca55a8369193c6f0dfb00359c5943dfe2ff439a09ef4ac4213adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f413747d1cec2e94ff712a7dd8ffae2c

SHA1
5e1a9d6ddc4e197af5343eea536833000bfec44a

SHA256
8b45c298631af4b6d8157d3bc8e9e7b6c55fb5e3dbd75c82bb88d84c3c8329e7

SHA512
2c58376129de000ae5d14b953a9b3061d213c9c86843711aed9db70a368c6a356f17279f079ac1ee81a39be3b7a2fc791ba45258564046f4f5b26fdbddfea448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcfade51d75b9651aea705932de541a5

SHA1
aeb260b183aa524d69a8dd2882e07da244648787

SHA256
5e0bdd2f9ccd60c2467ebc03989c497bd012b3d216a41dc05c6067c91ffb55e1

SHA512
2d9029d46b22dfbb36627ad78144cfe2686a1e285b097d63e67898f7080859a68ed4d9344f818eb02efc1f3c0d93dd6060a7ef276447a1dbb1d9e3519c357ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8f917dfa9354de87760234d19dbd05

SHA1
d8275fb50467e17e04abc8417ec73120fee7d837

SHA256
5ceeaa2abbcced4b3c5755739aa3798f9830b0c5c1eb849ec59b53c8a030ed60

SHA512
767bc275191bc4c569c344ff6baf89ed3e97fd291fb1698aaa7009a3f4fa813c0966df01a1c6c0f55e3952c6c542dc0e00029a5029da89e3faac6bb0fd708409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c37b40d5e04479200fbc79c266237dbf

SHA1
f9be6d164b8a49e06f34911ce604376e76edaecc

SHA256
ccdc885b50cc110a11e5c81dae272676e31e284960ef3d3ff2c0c906d78f948c

SHA512
38928019792a07dbc5215566d3a13840560b595f4ca6d94fbffd0f5c3900febd4ea112365c08f60f7fdaa948e489318e59ae8c3b5c46c3b40eae77991f4efaa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32f4f43ed79ed39670a6cd64026fed8

SHA1
2f60b87e7b07b58d197f503fc76326d288e107be

SHA256
135f99c4ffc8da776298e87330e52d7234b69c52f193c9a61a9316f9b100298a

SHA512
c72e0c92631cd1f6b1db3cc6526dacf5cf53987979951b1de3ddc1e13ccdf9698a9393947b7cf8b43001a63cd14478bb78839dc5b9e734afcada6b3ecad9b57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb1d84e51a70742640fb1c4a189d9276

SHA1
8675cec72215bf356e01b6433cd555f8532b29a0

SHA256
cb99278aa72f41485f5da1acf64f37db4e9498c53b818dce818385f8645ba38c

SHA512
16e64969562be4dd9d8c8b32d5c4516e1dbba75467bf02c7bebe36ea274f638826b867e6ab3ffc7ee55d9e79b28bf638d75f766384a102af75e06399b7ee87db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d16c1f1038e83e09e93cb0d8f1c511e8

SHA1
de60b88dedea299e5ccea5ea3ef828712ed2072e

SHA256
055c96325fb51625ea6d07b815f3232082ca34032daad7a321482298b784ab38

SHA512
2f11ab4929158d57f669021bc2af755a1cea3a640c5ceb164385ff22d51c780b99f55bef61796b2260e4dadf24ecff6de375148bcf82148be1891da9137b1153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7a003bd1d118dadc56766b9686b2129

SHA1
4152c86a1f4145a01124756a055a2ccfb88b4986

SHA256
47a5a231bcd4018a2509d5ccc37965856251bfa9b6e222ff41b2ce225a8ddb68

SHA512
285b601d0f5e68c0982b7fa0e9b6964731baed8087e5e4f82e0ebf02b427074567604f3733de89989829f570c30d5e53cd4c1b06e64a9fde7283b8495455a4b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdcd40e632d8dd9f5ed06fe7f7e3e02a

SHA1
beca254bde3b10363baa2941639d88910183df3a

SHA256
655e5afd9d3eb483d7795160b52daab70282ffb03860a098b05ce2fdfd8ad14b

SHA512
7a8bdbace57ce9b0685083a0bfafcf37f80cfe7cfe0bc9419d6d084f2ce3adca2f7ddaf45c19eb055569db77046b0134ca71aa11172de75f1e50c1d9a4945f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3adfd87db590d94edeb06a5262c381

SHA1
b23339c2b0cafea16134c5c03133c283518e8ee7

SHA256
c9fae3c13eb944e0ec62a322a5114d5ef43bbaf5d1f3462824a71bd0c5d4124e

SHA512
bea72894debb3ffd353b770f5241018548944edda40f4363bb2ccad24a531836777bcd93a6f7275881367b568c55ee1d996f073a2894270beb6325c102d87a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e232c537c59a72baea00debaf47e598a

SHA1
05f3e0d918246af006c55215cad7091de6e5de2f

SHA256
bf4777e0579511d333cceb17f0247a032f3e23e560f892b501b8177a57176f2a

SHA512
2bd168a7b4a1123fb9a8b6fb488c55f6ea77f435c7e1991d7f399218621f23a73acd05a26091d02cf6625e045b86e5946a8049028d92ba36e87f4195f0629c49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9AAD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B4C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit