1d2a3256b43ee17f49afc44b2e6782252be8d5af0c3ed36aa64f8491d5ae2287

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa8bc1b8a94f8d4d683b1f672c7e2c89_JaffaCakes118.html
Size

174KB
MD5

aa8bc1b8a94f8d4d683b1f672c7e2c89
SHA1

513e1d397da4ee54c02d0b0715ec8e95554f5968
SHA256

1d2a3256b43ee17f49afc44b2e6782252be8d5af0c3ed36aa64f8491d5ae2287
SHA512

c0d54013919dd99586d9f8bb5843cce0740181103a3c959811721c97fdc1ef0f114396961bd54d17315cb26d94cd38de3afec98f6bf95f3b8b9e0bb50a0dfd41
SSDEEP

3072:SkudqyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SzPsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000fd1e18e04f84cdac09ba98a26fd89231186e4197abfce7f08c9340d44d2eab9c000000000e8000000002000020000000b33caf92ff32d1f6682a79f4720ae18fb90af2ed5e3936ad071588b0d8bdeef990000000031216acda94f4bffb83d7579995ac8750fc3abcfcd309fd6501cf922af7e522e78695ddf08a8e5aba5a58a3a578580affe8d620374fabc9c14ce31613cd69e5ba8fe14bd1763cbbaf5d1a74508e02c27041cc3592b5c150a69842f51df5fe51a6b1775fba61a6ca9d08742b895350960a2b56b2f38f70bae6722141086286a8efd420e6609607e6257a143d1537728240000000f7c10a783888233dd53875b37b9387db6a83c9a6afafb01f83d2c3d6520301eb30ccb03d2bfbf2bf1dc570cec65ac707976bca0898759c9ee94e21e66dfc70f9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62207DB1-2A66-11EF-A5CD-D671A15513D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000fe57dbcf396f88c7f66a8d21acd387eec92c9aaf95975fac167289bba04e736f000000000e8000000002000020000000a4b862e2e3b271c1b5543184030c16a378da6f6afd9599c25fb4de715fb70d7b20000000777abe65b11c71d8ab13470517c2420d547b5a2627bbec608890e53c4f8c7eb940000000fcbed3fe857e69badb9bc8e6de31bdce0f27e27b95efc7ec13d343da70f342a842100261b14f43f97d39d4d45256a15ade6598bb8ea2346da0ffa5120b40eb8d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424542337"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00e9d3673beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2464	1916	iexplore.exe	28
PID 1916 wrote to memory of 2464	1916	iexplore.exe	28
PID 1916 wrote to memory of 2464	1916	iexplore.exe	28
PID 1916 wrote to memory of 2464	1916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa8bc1b8a94f8d4d683b1f672c7e2c89_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969094aac2847f34daa41f378c5c22df

SHA1
8051a3c597169707072457911ab8d6108a82b618

SHA256
83490afba5e5ef9491f4187e04f0ed1cf17ef40a44157657132c6416176572e6

SHA512
270f9b3aadee86cc35544f47ed1f72f5df6cfcfc70eca51619737eea83fd4c276b30d9ba0ad408f2cbecccc72587da5f57a10124dc8f4f7e141b962dab1916ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ac4d0c3c53c3908406d8293b372c58f

SHA1
86ce7384207730350032a6cdb110aeeb08c4379d

SHA256
161b1012692b9f425bca2a51743bd0c1d26b6194085a1c1251f8a36bcabe4cdc

SHA512
97393813026cc427f815a0f417956c8ca8e5f31114e13a4b080482c0801df201227a0366e4a9ecc6d0c6f5df2ab4d39f27e8b2a4ce5d01bb5a30e20dbf9dab0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
888fb5542f4a3f48dd233beb0407ebfb

SHA1
d2ec4e5ea761b9ee0eeee073ade4fb84f807dd26

SHA256
3f0067dcc2fbc43fe6e1f027dc80c28d4b5b129e590ea6dc059e25883abb99c3

SHA512
ce9f068c3dd4539a0a9b4171f509cec6523e19a4eddf4306aa639a68780cd65e6a7e1c5e92d98a3ded46cc84b18856b93165a236c75b431d07521c35c5e56482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cfa432ad4d2078e3b02b16265251717

SHA1
ecd8ad9afdcf65e18f6199ed1a48812a29ed930a

SHA256
e54681b8ee9d6a3e312383be30192588b25b47c66f814225bc9974bf1d1e63d6

SHA512
f703ded580f993b75a96059a7b3cd31d0b473d1a537ac74f3a2e753f80cefad9d5a72b65c332a75bf7e520084ad2cd5596b65b08d9ec05d5865ebdbcefc63a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2462ebf32043ea15ca25909624ff7da2

SHA1
2c835abe884ad50d6ae9942b2029131c645ca2d9

SHA256
0b805b684c136918ccfac350e3c207d39db30f117dbc0d35d6838e244adb5664

SHA512
448e42776033c40db11a66f5e90167b3cfdf1be392a5be1535f451ce4894f4ab81653fd45ffdf7ca3d44d22aed8742e57f26e76ccf09da0ce15b96047290beac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a48aa49fa67f34c0fbfb6a92b3bb0a3c

SHA1
d60bded334b5f49350c102ee468612381cd2cdf8

SHA256
67b753b941fef4cdff9c12958ed556d2653ab5a743efb09e967d3863d78b48c2

SHA512
bd4686fd08feae581fc432cfe2e8cf75297df02d398e8531b601272319b2de04330bec5d6ef92ddfbbad6bc0878704ea4d303d132c911bc8c40209fa78e7105e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d81ca4f97bcde6bc2cde96f039f74e0

SHA1
73304135f16742741b6725a3e71465caddfe35f7

SHA256
8883e597cefa94f174dcd5d1cde235a31e64c0b425f4934bce7a48808fd5a7c5

SHA512
a711b042e0f945602f54289a22a7e557a4e27f0c478e7cd24bc40d6d05b715f972bcceadc93bb5dc281c4798c2181ae452a678ae9da2c9c60aaa2d7105ffed63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa7693972c3e85283b0b8ad8e6b518e8

SHA1
acbc5836714bdbc4a29cc54e3e2fd35ac9713cd9

SHA256
bb0f75a98a11656ef8312ec246c4511ec82b941325b5c6f29e200b164e3a2e50

SHA512
3dfa284f21682a21050750620febbd2a4657858d18637b3bbadbe523629cc15309050e7ac43fc373bfbf571614a0dde71eac174970289ee5012900b21a16def5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
530e615344f8a5d6b0d71ee4c5b2ac07

SHA1
9a17233b7bbe27edf34ae8e812439ed9a4915679

SHA256
26147acac969d87facbb648e8b8fbf3ae7f368465bf4742382ba61b7ee18785f

SHA512
b1c0cdcb4792a4a8eed9ec0ab4303d6ce371c216d7206f17df375325d9db96a79c60371da7c721f6472f5e3fe1dd4561e71e80006bfca119b11ddebe3f3923da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ea3c372c9771bc8491013c265113adb

SHA1
3039ea8c5f328ca130cb8b10df824261fd5486e4

SHA256
13b0ac53e14396f390c6973f858a492f615b04f0255a9850f0c386f57025c0cb

SHA512
38aaa30e84054718f7161338ec155d831acdc11264adf793010a854ec7401dbd1b9ccf0fc7df949a095d540ca0810d51b28b2aab2198def36e8f5567032d2a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8875d41ccb207380b69dc3b577b3ae1

SHA1
6dfb6e3c7396b16da1c211ca61ccfcfd5f0df32e

SHA256
5aee635cd4bcf17826ed9abbf4ae2ff616585e527a2a0ff16e2073effcf3ad21

SHA512
580bef2393539fd73672dbb3e5b97b77d8bc46c7b1d941e1db39fc4a295f475f0e7dc4605ab31d4ad465f7eb46a1ecd9221f9c306ff0787f0467ff5a4e1c7b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7be2ab279fed89839e10fab951293b1c

SHA1
dd19509c8016a6b27b826dbb6fe0f49eae5608d1

SHA256
276b3066b6fa2d99fcd945e0ca3ea8e902c45a5d4e55d55dc5dbee0deab8d31c

SHA512
0b3283759012bb68b0f14f87b2116e893fde0b69ce14746f1925f19b327d1843e22a8518fa733c8dae666bea2e14c34d16075d6d262681ddd701c4cdea7a225e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad7d0e045d82676bb2db7d06a3190bee

SHA1
30d2c7cb39358e4ed2b797cfa42a290ddd89c1a8

SHA256
33d3e952db57d7ac7531e7ed56c38f4155103933dee452cd2caf4f885f76abcd

SHA512
3f49abbcac1db815db524d6f91fda431e4f526edfaff66faae7b964cb270663a5f42659046476c53084a05274c3ae0a2fc8861aebf05de61e6323096d406878f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac8bd8f9cc74ef5092670615151849e7

SHA1
9d9261f7b43267c3a0e724254084695668bd582e

SHA256
140b15e9d33ade7f2644581c47a8b5e6c08dca883e5e44430e7ef23a0e01159c

SHA512
cedbd531aca216f0f3557c29deecb889e1d255f42b8f86af2221c837da7985a751b4b58a7cca6857429e91f8fa84fc40a950526a30ec4590fd536084bfacce5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0e8dd2add04faa592c0b3e52aa6b7a0

SHA1
06f045d9f35a948315b00451451f4123f43d5cd7

SHA256
dc294744e941ab7264c90f1d3492559738a4755a15ee390aef786f5442fd4fc6

SHA512
f7c8b6aa52abf1433e32d262a8a485d518b1581fc7e4e985ff8d0977483b0ea985a39e1cf827deb810fa749d920a3549c23fc657ac90bd308ed83fc5c9f4331f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0967f565ee40b2fff56d16bcefb2e0f1

SHA1
03be5507eabaf1cb6dd609abce05ce6104f644ea

SHA256
24e2e210311aac9994bf6555edada3faf9bfa10964743109d06ab51539430576

SHA512
2145eeffb9c4e16d7248cbdae96efc2b88541791f81f0fc8b75c808bdd0495a3a3bcb6ebb7f0e3dd3fc23edfd487c21cad57aaf0b8a0a3d8b24261ccb0d9035c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A48.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit