cf6992ef9b8170a457429c00c763dbde0f4d1515b7ae7d6e3d92b93e03d5320c

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aae9e45b9c3bb5e7d858c80691f29cce_JaffaCakes118.html
Size

20KB
MD5

aae9e45b9c3bb5e7d858c80691f29cce
SHA1

4f46be8bfb37093dd0c613f5598cafeabd80dbc5
SHA256

cf6992ef9b8170a457429c00c763dbde0f4d1515b7ae7d6e3d92b93e03d5320c
SHA512

1ab23d93df0f67020de2aa9aaea898545efd83b284387e7c90776b9908889d684506914bfff137c52b5d9a4f89eda73ce2274c26fd70906a8ee57dd994327b4b
SSDEEP

384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoBFUjU:nlVBbjik+zxPKPg0GmrGEJTydoLU4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bdc77b80beda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424548034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000008f5e912a65b55bd929e60beb82fa983b0cd8e0126ba00b3ec53e59a33d7589e0000000000e8000000002000020000000e2a719f84e947868b691a7ba23383ad4a4ba21871263ca7099adc988b260b6c0900000001a1e80a12a3a52f3d6ff80a3d8b49353fbcab08afeaca7938c7f38577f9bc29a087de1679539dab1769946a0204321158b0b09757cf47f6db32d7ca04ecdb764a6a60d3fc8840c8105fb7d648dae275f911b59d138118bda8bed59906e08395b5f7f6927fc9c1f1fad54391354d64b673d7cb6cde6e2ca88be82a4ca50b79eaa5ee266448a53471b2469115a6573e6754000000039d9fc0e831c6aca7ca14df63a01bd2a224ef70498c01c239da99df3dd484a4a1c654993bb1405717c48f6867f0f2244f51159a566e5bed9ebee7df8e6af3825	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000f0ffe3456432498af6be252f4e452ae59c18b0fffdbf0e00641f31a97d3453b9000000000e8000000002000020000000d8d2a09de2d2db3dfb84e8b975c66d9fe6130937ad52c0544c85314f576e767a200000004512464680be7a87618088d89fcc18b2af6329fa2d7d98faee91ae721f53e60f40000000db34f1789152702c49a956aa5ae7202662792765ebdef3b9ced186312cb8b31eed57c963c47f44113a4c34e3d80caa9f79c3e255bb1791c457034e6053aaeca0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A66335A1-2A73-11EF-BEDB-DEDD52EED8E0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2720	2136	iexplore.exe	28
PID 2136 wrote to memory of 2720	2136	iexplore.exe	28
PID 2136 wrote to memory of 2720	2136	iexplore.exe	28
PID 2136 wrote to memory of 2720	2136	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aae9e45b9c3bb5e7d858c80691f29cce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d93f3885b6510449f2431ab4fdca27

SHA1
0a4e9cfbdbc87cda57b3c0fbb0754438a4821d71

SHA256
b15d18330ec7831460a8ba29c26aabdfc7ea3d421c25087c0020e4ffb48ea452

SHA512
419be16af725555152be1516eaf2bad2baa2afb8739c0ab7ebe80aa0c6eca58a35e8268f6795e0339d3ff108ad94f0fd2ae39f88185cbb9b5f106ea72d1f509a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
277afccc064c62dbede785125a536659

SHA1
2ba768907182068c0c9ce5c4e5de97b1075e670a

SHA256
45543263aecb69857e0890419dcc406c5ef02f5cf848aa6a6e61f818372a1ba1

SHA512
270449d497fae32953b6a5fd6b2dccf9ecdc4f9c490a64cacb508bcb377b65e2a5e09de81fcfdc244c4be679af17dcf293d72dfa781c7960a7fa96dad0e6f6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36caf9be85f57567d7fad7c01520d6af

SHA1
36b0d117a8e36ba47ccdd29de7cbe8039a053f03

SHA256
c5adc127c908ab669267e78968baa2b9cfc96b63bf77cc453dc2b7983dc7ed11

SHA512
c23020d6cd16a54b3de2f22a57c4849287c96b1124ca67cda5438946b970b245e460e96f22232444ec6f661f15d2403426f22045a3ef82daf517589ebc85d748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7664fbf8d2ab81693ea2e66384a46709

SHA1
12e2c49ea21b8ea5ebad0d085d1d32e4b8011e00

SHA256
a8102dccdcb4048a051500bed18770f7a27f54a637758ba4a471f75d425ebfa5

SHA512
1dc691fbc8f0da2c33ac77638420535a080a5b1f25ef9f4a0a7965bb1949d24e69d9002fbc8c41225b7d7f27cc96208a536ecfe51163a78da9285ab081e209ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8b64fe84bedbc3bdaa342f32551248e

SHA1
6df01209f7ea9902e7cfc716eac87adebcc544ff

SHA256
2e3907d3b46a4134ab4d8f06a8c9eb15f38292cc560a94a8ed00cfe87c297d21

SHA512
c3fd373d3f62bd142b1093cddbffea5a89ae0fcc85c1450f833e03c25d8f0962d71ce2bb6696b81acc81dd3dd0349fbd96d15a1d0757769b9d782bccdb18a0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
183af8b3d9fd5b0059033a2fb108ddfa

SHA1
cbf191410e3343b622079a9238e5d12a1ea12453

SHA256
9d8129980fcc3bd7468e48c2655da47354e57ef1ad80170e0220587ffe88d5d6

SHA512
650c4ca7f44e2a815ba4f781b5b5944a22a7dcf2724b6e5b2ba86cdf09c76fd8069f9429719ff7b590263228cbd1d736b28aeb4b23f4c793770941dc7b5ca706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7e3f8d05ef10fbcd581bde525fa640

SHA1
18130e9c2fb5fc8411fa7cd182f9c741d53bb6e5

SHA256
3fd64b6ad80009465d100868769f57d78cb40bcb52cb298ff85e17ca27c5d8b2

SHA512
ee9bfeedc415e5b5f9be7d9fd8d2c19b6c51fceb5203f3a9c4aab73d21f58ec21a6dba1aa10456899a98749d069ba3095c71b9584d01026ff2db65df16b318a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65300ef662db3f053ba173ed03f969b8

SHA1
99f1da13b15b7d1b45ac1c80fed3ea2f7a47f35b

SHA256
5c8922050b191c7d6d788ee47941a066746c844a254649922a8a4692d9d363e8

SHA512
c2c76a08e7f522dd591c822f54eee2b55d042aaaeaba57197a0fd3aa55ee4db3753743662df843803cf6e59c8dd6d3fb7e3e78eafa06934efad5851a65c7cf9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae11072957c20f2148bcfd9b3d4b230

SHA1
2c3ad88b278df50fa24be948b17d038815d2962d

SHA256
6711b21e8d752da9debbced41dff359d804903e840e236829b94457109b587db

SHA512
d2b1d11e4c3f512f4c7eb0dc35bc2c7ac6fc3b5b11219f36e84574358149a5c50f98c90216eb7d44d6cbf25a7ab6661cc3c85dcc65ad9f13bd9d68804329b1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7985b5b7b70f074c6bdc5fdf7c34b597

SHA1
71a80c08b3cd2c3244bf7bf0ea56f023d43e7df9

SHA256
9803ebfe73668f379c46002832ccea0ad70330fb0e19344e00c7a0fc25088361

SHA512
5e2c8259eeefa57a5620ef3bed64613068d88fe539aeb04f5645418196d7c43a444fa4d2a3a162540e91f01c3224c27191bc4309691ef3f644f16da5218ef4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4e8758c01cc5b1e60a7a0f2581b8a8c

SHA1
f052ff40fb01a6efad7eee0c4c57f5e1257ae5ea

SHA256
9bc374379d5ab72fd2a43c2cee19e980275c62c9f2a55049244d1b868d1b5769

SHA512
ea184854b6bd057e2aefc67dae2f30f4f28e8511e1d813d4a028140feec34a93d96cae9ffc855ad09b73eac3841d58a9c4c225308efdf438860e534badb6e2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8455f097024ab43180f11c40fb469e6

SHA1
1adf0583cd8e107ab44d2fd13c4fce0f47027b6c

SHA256
09e2101f1a3ab6b4f40c8836a73c3732e554f1e32e1c73ecabf4a06bd6c2fabb

SHA512
99ecd3889e096f6243f1a88c7b86ca4edb6cef4ba72dbf79fbbae34f2bd4ed5be6d559e06c71ff6ecb3042d81bd9f2e02db3ea2a5fb22143b01e8a14bd63615e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36e2c7874b70bfb684fdd86781a1894d

SHA1
3488b1f9e8f1f914260f04ce0629160b273d077f

SHA256
3154c8a7309e810de669f5cf8d01298b49005ec07af8356cb792c8e85dc52fbb

SHA512
13d10da01a13c74a2d188081325f2c03bfcd3997a305b616df3c30e44cecdbe056b502e7a7733520f015ec55001f6837e59085182ec0e0c5fa912c1de57a5a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e7647182e330d0aa2acfe77038bfeea

SHA1
4a6a898b02173f0dd70c6cfa3de0fd83e30b7e73

SHA256
e3d6515f35ec361e514aaab7bedf210a9acdb627cf57ada46ae95af07d0fc36f

SHA512
1ce9230dc3c675258f1afad3f3333abfa484e86e8413dd41ebe31dd281579d2a49ec14010f2a45653864217f6050c669a48d0695ed0d350fcef12bae44119b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C8.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97C.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit