13268ef6e291503b144c9c072665188b9e938cf3bbfacb6a8c3424248d3dc178

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaf0ba0960bd90d3dac395d1ce16ca5f_JaffaCakes118.html
Size

102KB
MD5

aaf0ba0960bd90d3dac395d1ce16ca5f
SHA1

0060f8711db275b64d4a4f9b2497d23ff84f25be
SHA256

13268ef6e291503b144c9c072665188b9e938cf3bbfacb6a8c3424248d3dc178
SHA512

c1cc1f6582d35394c30a68a1a9b5b1302120025824be7c90b485e1911cd6132a242d6deddce6b0c0a42b89c1e0d12c1888889e56fe9d5c59fd1ff6d0e21bfd1a
SSDEEP

1536:/ggKqpp0jBVdUVVVVVVzzSSOOyyy66IIKKGG8B8BxxxxxxxGGddttGaa22hhjjZx:/ggnpD6Vxa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0ac2df7ffe16e4ba96f11c28fad926000000000020000000000106600000001000020000000205ac09a6b659fc727be994e06c55916f795dd3b7d6489318bc79ac9d3966c92000000000e8000000002000020000000b2fc536f9ee086a88584820044e58ed1a65ad92c6712551f60b0529b6e28abfe900000001da03cb0bf73d47a128239a799f01f2040225f1f5e6f4b20e72ccbd10b149b69a58d04ebf02af87b91875242e6d48d90e4e06f0370338f93cdb256f25ba6f609ea1c6cc19461e87c62a820da3977d2f699c1766351b561618c51d3d1af1b103ca4b1e23565a13e71f16d4832946fd4d9af79339e745bfbefbb9344a796bbfe09f2f428f6fb3c71735aa84bc7d6854452400000007ebfa099300a0289cfcba694aa8345fd35075780d928920e831d18278a852fef4e13cc240533ff851933acb9741a8a9d3539f42521f40d07bffc6ec099079793	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8BE71971-2A74-11EF-A30C-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a0ac2df7ffe16e4ba96f11c28fad92600000000002000000000010660000000100002000000043831f7740c6514b3ab8df63fcd190110e395c2cf0afaf2a61f23d85e00237c2000000000e8000000002000020000000fc52013fd5a5b6ba3b4c28826e9b0186c9ed5646846c65a7de241cf16bb9bf27200000004ba7d9d4331f9f6a41d8586c98f7257f13441f54bae76aa92162b15280f1a81840000000ef157b171f0ebe7d7bcf8d3fc2a03c54bc791875dfd09111d7f65cd60b8a820675d64f91dba99c2c851b0a64eadd281a9d448e658a47821c8ce6a651d651af64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0029396381beda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424548429"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2512	1728	iexplore.exe	28
PID 1728 wrote to memory of 2512	1728	iexplore.exe	28
PID 1728 wrote to memory of 2512	1728	iexplore.exe	28
PID 1728 wrote to memory of 2512	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aaf0ba0960bd90d3dac395d1ce16ca5f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f10325fefa26c030510b5fb1fb8182

SHA1
4730ad4111824053b54a25a03a7874b84e6ec8af

SHA256
d54054437cf567d20d48dac131f8b2c33b228cdf4cb2f5a53052f68ac765d1d5

SHA512
ba4aacfec0e17324116448633ad954abb1405144b6c65d8478f6bb5945952872488086aaebc5269f2212f7d431334b5797b973b8501331d66056e947b635c29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84bf87574f10628c97412363a4fa2e6a

SHA1
909159b1acaeb7b5580644a06001e22a5d294e6c

SHA256
1ef4bbd9cfd85008babbdd02e43dbbd273afc7c229b6381c935c644bb9c69faa

SHA512
55b77b32c66d9fc49c843c44e71b136226f136b32bb5766d2f1922d37d787cda4e60ffed410dd2e638c2d1295831e3612155da9d56ca0419be3bde7d5f5050fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38dc0b0cee51bda21e1ac7fb8c93d3bc

SHA1
29e7f9c83254f27463d80f5fdf1b3ae52b65f23f

SHA256
34eb29479f1a08829e138928a31dce7ce4b16b05215932c44ebdd38251db678c

SHA512
4067f2e4cd51813db06ce4ee1ccaaeef0c7f41ae66b439081ff352b889cc94e27b3eff20404d276c94a142d282edce15d359d163e87c73f67a311dd69daf93ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f53271b05d272f7ca446876c615418d1

SHA1
a6cb0fd643c843a34c00c0858f75df61b393c2a3

SHA256
68b52578ef3132ec320eb0059959f897d0e1d4b9de6596ec24dd939a9bd8a06f

SHA512
4e274e9feff4f12177c653355c77e63197372e2c42dad8dc38847cf95bfb4b60d90965a3c2c39e6ac2f1ba3de4e6bc2e0c5da0d4602664542cb582aba9873700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca91f72a5d70b74ec4cd0ed5f7603d7

SHA1
53b1a547f0e4cf68241d59684ae425b6aa205438

SHA256
6ed9dc06c25685fcc0e3ef079ba26625a38259827bde30b2ed67c756280de44b

SHA512
383d63186d25ffc8122cbce94bbf05b13d35aca09f97e94c9813987db5f7710a44aaa4218d0ae92da2b2e7b0562b08b6cc826cb5c87941d626c2b0387957e28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81243609af7c318d0efff38c42aacfe0

SHA1
3868fb1cddc1048b39951822ef95248a3da4270f

SHA256
f8fbe465ab28a5d58b37e063d3779893b9c86bcc6d75e16c666cb26dbbcd6c8d

SHA512
a754ea70c5f4038cbb7dd8421ad60ee6b71fae2b0e190939a4bdbcd506d17a980c7bf5bc02e59e46aa4bac9c4243eef6266feb8caf124738953225c2703a88bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a69b3d39a3fcd78e7f455f01675df089

SHA1
dd85b565c711f3521e0988bcff482a2e5f319b44

SHA256
843de7fca8fb1eee28015796b9106a6ecaa284f3674251024b95b2870f298af4

SHA512
62e5e6a8abce4636af8ee0b432a3a538ccd0753ed80f257ae8bb6817741f035d4ecca16d5994f3664a1dfe7bd0d8169c7253c3f55ce818d6fd2e3bb7d4e6f70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5daa3b956b444abc5903d6e23419e087

SHA1
8be20f9af7786bbf3e7259a36ec0fa8b5f866896

SHA256
eac221c33fb4edc20b55f6eddbd3f2c5122463247a3fc85d12015abbd67449db

SHA512
fccf0385be098f55c808c0c5ecafb09119ecffc43343b7eee77592abecf58a3faa9eb279c27e6d53a1885881690bda83e01644dc3c46667674b9bbb2e90c3104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5b22653ab4cf930a4da6ffd25f65a3

SHA1
72a498db595102033072697594cae77c1d03e2ef

SHA256
6f607a2a982e99b8fe629b02d5bfe3db0a32196a334aa2a50db85eef0cdecb30

SHA512
ea9123ccc7d8f2b73f6c4a5aa74bd5cf2e9426c26810643737120c7c0a7e4fce33a39b85a10d59b8a08e32a056c217b1c3cbf9abca2589e25f828e2d1c9e6c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5ff9566585e1e0fa804551703859213

SHA1
0fe7d7ba68b27ad6d6ba45dad17b4e37094bbad2

SHA256
0da8ce092a213f5fa3006e50ecff49897d660f141a885e1de6e920283462f288

SHA512
f5b5260860514403edc8b9f416302064c699fa8517adb5ac22fe196ae46d3c75ca85d6b82d474e410a0ecab185e51420e93d8cafd057aa9eb5a343ff7df150db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7485a49aafa9a25db00c14dc054a969

SHA1
3e68ae01301ac5fc2414f8808b042c37cd5eafd7

SHA256
f96d9b1b872b4140a30a1d54cfbdb8f565cc608460ab7b34c14045b98fe38f3d

SHA512
2a452295a5280eedde742eda4c845a7acfcf1467ee76e0608ff3edaa510aca1b1932fa4d0c3f9824eda77ea497eb2fd05e01654fcfaae948ac8f97618f5fdb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4191938e849a132debacadce9c5f995a

SHA1
860aa930cdc17e4892b51761e5534ca67d50d8e0

SHA256
326fe7e187eb3e0f409279a9f7bfee2aded0918d682e62934516293ca9293939

SHA512
19752456ea8a2dbc7443bcebb1a24eb722fc860796fc0cebd2fa01552b2913556be290717a89d6f8489e509b854d79086a8c34058d52b1495aca29eb1147df15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0baa4d90263afe0b44ef31fa73d771fa

SHA1
73447ccb47228aa5311880acb25019df3d3a626b

SHA256
f3b26d6ceeead067ae140c4cb383de6a1b449a7529c8bbd6dbc6e41d3b76fdae

SHA512
57904bcb130e01bc60e8c93b1746dbd0ed4b2a136cd1bd9428df6e9b3581a9d11429ac7b7046dcaaebac641338b4459b3ca9b1eb6363a0b62828e38580d74dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fb1e9d152a50f97190fcb44c06b77af

SHA1
05ea9c88dca8342dd740a4f6240f1b87c0bdd5f0

SHA256
fd961a797217bfc230d15953e98a2fbe642469ff6636a2039374239a58680a95

SHA512
3ab00e22e4e174bb5e8b6d1cde0065100c26fb8aa8548c143d2f2ef00c45f9e6b412079a138c612ec71663d2b38860e800e2e7b3d24eea19c3b9ece2acbfbe13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bf1fd42ee243f04bb4f9ef08056ed10

SHA1
3af950324913b4e2703a18893ae1b32740c69832

SHA256
d43ec73204eb32f08a4e49bca0f1602a4e9181baf5bd2a4b7140625993f6061e

SHA512
2f518cbf6d70fc73d99c4063705e463a720982deb7edf1b8293304f8ca55d6c8c4a41977cd28eb478faa28dc12aaf8d97ebfebda685c3b04ba419a871939e784

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab477D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar487F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit