8f36bd6b46dc60dd645cc7a6c42399e453c02d0d511eeacb09dbe31145f95c2c

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab4a8b085d836725aa69adc813a5b9fd_JaffaCakes118.html
Size

345KB
MD5

ab4a8b085d836725aa69adc813a5b9fd
SHA1

f9d2b90cb79fb9957b80c1039c09dd7f12b2d426
SHA256

8f36bd6b46dc60dd645cc7a6c42399e453c02d0d511eeacb09dbe31145f95c2c
SHA512

c36a2c9fd12b38fbfe12c03c7bafeff8cb7593f11cd9adb3f734c356960919fa2e4d90475b65a47d26c839fedf63a1079a69e2d742acf9fd5601f693b91f078c
SSDEEP

6144:lVXsMYod+X3oI+YWsMYod+X3oI+Y8ssXwnb:lV75d+X3G5d+X3vsk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000d6238f336ec366894c6a3959452a87e5326569ffbf3f218ee7585a43d8ee79c4000000000e8000000002000020000000261e089c2ccecb3f569ee584aecedc924072e2e22beb8221b8f8c750642a87f290000000b5c864f7938a8478a29eac1ccabfb16325e53737340957bd13c9c33404698a1edc84bf1d548131ebd2aad706b2db33bb1e0b6abf02e16dc64f89e78f237a1a3a84cf519b32a0610a8c6971d3eb90f89111d9870f79aae18f5d0061cf9deba80be314142323f6ad0633bdc111f0af33f8cee1689dfe103260638c80f61fc53c39958303d9d425ac94d1c1517a9f2ce780400000008c1f280303759d5bd89de065008e4fdc7cdc03252d198b050b1c9849444b99f698edb8455fb90071dbce6a8dd73ada35aa509e0cfbb40607496a14ead0f8574b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAB908A1-2A8B-11EF-B0BD-CE03E2754020} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000e1a648771d05153adb3d97f4b5cf8099950c83224c38a7ba71cbe389693eab08000000000e8000000002000020000000c7a13c9284903a8c1b0529dd959778e85eeec71fbb20e15d0479b811d278321e2000000083c8838776883db1f7165c3e61fd284cae90a7493dd2e9f5bd7ae18a853e906440000000eb9efd273da16aeba9ef442cc91d2b74be63f99f259c0476bc9d170361669575e08d10f7015c7515fb245da2707601280ff14cb23caab7ae0fa1d877564cf3f4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30754c8f98beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424558377"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2332	3040	iexplore.exe	28
PID 3040 wrote to memory of 2332	3040	iexplore.exe	28
PID 3040 wrote to memory of 2332	3040	iexplore.exe	28
PID 3040 wrote to memory of 2332	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab4a8b085d836725aa69adc813a5b9fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad7da0e3ab746c746ba79f920c2c2bd3

SHA1
744364ad9138889cd9a40c4cbb7c327f200e62dc

SHA256
62ec101e44b273d023b7443f591e193d0a9c3c9ceedeacfbaff4289d1ac71da5

SHA512
f1da0daa8fc188bd165654e704a1844ff0de77c622d34e53d4b1758df7d45d67d338be61202f41d5bf32adfb44f0b2b09d6bceeaa7a2712ab81d046e3d88d141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b69ab71d51adfba30779c0bbc5d21ae9

SHA1
5627846f9a79daee78d37f37773f5af04588fb54

SHA256
c3d5ccc3baca5b1c227f24a88af3721eba3c0696265323e63da895712bcf97c3

SHA512
68bccbb6e73c84717278974f41299c819f61aeacf55c28680ce610a394a346b14db40b6d59828b98b437434874e85ed9f7875ec52170696383ef48d326f332a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
822a515ff476fbe2997e76556fddd85a

SHA1
142ab84cd8c4214e009a8be469d501ed64aecd76

SHA256
5dd5a90043bc61139b77d45d26cfdbd7885038f03a88ef8d659a00d1f528b03a

SHA512
9e4694cb0727c4c8615a4e1deeda830986c3e7ff56355c0573e32155a7d35ebf309d0aa49752c7464bf3b044fb6ee41b52bf9e2ab7f286e669ea6456867ec4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
706b63fe784aa053124b784e27e1f98c

SHA1
dc8887cc592b128a941af263e1841efd5ad690d0

SHA256
1effa4e40bbc1fcb5c6ccd03b9a818e67a86747205e71d4ec92dca824f7ae407

SHA512
997eb332d94e8dc391584a116c44d7a430e36f5631bf92d1d7f8c397fb75215de93ffafeeca5e422ece5ccab251bca49dd8d7724ea8338e60d2e3a2e997155b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5e66cfe4596f18db3a9b7b648c68275

SHA1
1c223c8276b995ce8f323bf5919066d5ad703994

SHA256
600dfd9bd3c7b404d3ff6a24b2fceaa09adb3516ac7105e18154db83f9a7f244

SHA512
3471381f445b42e32e8d2d7ed5bb41cd0ec2132faeab4d9cf8aaf7d4759a022d96bc62225307cb5ff011e0f106fb2c784d9d91b3ebf68104c7b0c0760a53df69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840133f31546e5606e55fca41a067e6e

SHA1
87b2a4671094c4d40b9fdedf021145a701235004

SHA256
f8910dbed317ef7345b0ffcc05401cc9a99f8bbd77d14b98a17a81c8d64df122

SHA512
fddc72548343f6a2e23074b2800a1bdc2f6c5deb7242c5d4c7e17d8f35079999b2593ae6837588af87ca818f7762c43e1b2288b3aa207cbb79f828b37ff787cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c978c549cffde9651e48f46eb638124d

SHA1
f786ca936eb97689387f68a0d310a75a4ba70712

SHA256
c982c65e8bbe212a1da74d01f0282c67fd9354fca8536bbe18afc9ef1bb35558

SHA512
8cc0b340efd4ee6971a221e43458bf665b7c6432d4a1fe6d0d51a4b84796cf56be3ac72119f26f17bb796d9aa10ef4c34e91e1a797cd6660906294f000369656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf423566ff9c2cb351a15ee6a5334fb0

SHA1
b1d1be18a640ddc6ec1ce21c82fa77251c0a58c6

SHA256
079181f40ca2170e4d18d346e20e2968a588dede6240cf6bd5628ae6f6d87b95

SHA512
98d87f93b73afdd11d253c425519b00139bf60a11e99803262f721606da72d9fb5ef7ff2a503f04500242d84d31496d23c38ec6aadcfb83c3ce8d3ca76d72558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b585f03acda71183826617a411114191

SHA1
7232fd6153b38eadbce4ccaa0ad4569e920b5e05

SHA256
81b361a62074fb9325b1326c76a277d9bbd55762d1d921847cd3833d4ce09acd

SHA512
dc485e06f19bb793485d8706a3ac3d4a5aedcb4e0a04a2534922b0f1e1084856bc445f1f0033631145e2079987d23c4f1420495d75f00441fe1954ee7f58b20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d082f9a3667cd37aea354efb3d03ff99

SHA1
06e81da1f65608b8556d9603ff801ad0727c635e

SHA256
e94f8ad3f9516229f4bce9d71619dbda9eab87efc0fea3746fadf6dd96ad1b92

SHA512
0234506853d67a1c7ccc519293900b6cac28dc6c42b449fabd458e872f08eefdb3a20a6297833a7b944ae4d78358f8193bb67ce714f196c80d3485c07f611509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcd4660588db96c56b99456025c3700f

SHA1
845c939012843a5e402e207ce1ede232ac178354

SHA256
375a78ddadcb8eac82b3f56941be95b909ae5d5ca6b38bec5a1801949ca4310b

SHA512
a2e1b2fdb5bcfcb78c688b6fbf9fdc6b0603ac133f12d443ecc2487edf3c8d391db273c79dd3ed53f8a2d9f0db4c5b35dc1da700e312e1d6bc8249cb1631ef9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7de285e1dff9beb6194baa73611c29b9

SHA1
1209ec074f1f190b36d3e36a59b5b8c1e5db28ae

SHA256
2f8b7e50bfa9e0858129f5933d6792bd5643fc50b0679c49844f09506ae6bc74

SHA512
647d8275e01e92498c43c846b431a6ca3499d476734f0f024403504cc1d2c9f1fcb5d79c9ca061a106c985f3a4c5bdaa0cf87cf8e700b48a6acd9eede061a351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f563e0d74b699a67ac05fbc670132d64

SHA1
9f0526109d009f5edc8840de5426c30b746d046b

SHA256
b08340e997a070d40e59bee73ef3dbb15e7b547b1892d40243de7f91dfef7a99

SHA512
a594a3aa964ad4195bc812b22c784d124ee2992ce0c60fb293d9ffd676abff8a8e6ed908260cbb54658c0f0d091ed5b549ce36aaf040a579dc74991843e084ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8cf21d2d0d7260792ce452f89695d79

SHA1
5e99fdfd9c9646129bebce7bb0d21211b84c9cda

SHA256
ca80c51221edd2c179121365973ec39e7b96c97eb9c0452107306ffcef2f3cd9

SHA512
94d6a9aef3f40ee7ff03afe385c0735759004b14a1ce518529effcb972d5dc36eccd763df369ec9a6cc3c6357396758e5c9a4b4d65aa6e3c0bbe714f2976736a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b469d9b7b4533991bd47f8930e8089

SHA1
daadac6e0b2d153f44fcc6731343b3bba54b0aeb

SHA256
c9a5ef0fc82efeff1153515c2ebc6d75da3c0ef4183a1d1f621593a01ce0e7ad

SHA512
92f78bd2a7c9e9c381c17476bfa61409d8afb2ddf76faaf8084faaac4639ecd0ef530263e59e96abb725f8c8ab87b1c2cc575c9857a38257e6ce621741f8a0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69523e93c52ea3434fbeb497fc1929c0

SHA1
18663d785f330d7d6c555b24f3db824bd28cc309

SHA256
068c5a30a641aa8d6aafad7da6a2b28bb2e2c632bce13024e0a1428fb78351ca

SHA512
b53db666c7ba44d8ebb53bbb490463105b70d0e7ce2d521e162c080b158dd124abdeca7d51ba541ef7ce18f8e1d5b9498e75e3beb6e49bca1bcf7a680cf2c2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec5c8b89bbe6c473033fb847be2a46b

SHA1
80c4d5c5bcbd54ccd466abadc0a9468a49fbe65e

SHA256
d62ef278d25931bdb3ab7cd97d34b4a13d4e5e4af45ee36b1c35ce6e06b8d5a7

SHA512
9b41f51e831c20ca59267cda8b90d9107f1444980d0b523ab15b5c7657a992b888b2b1b196d607267c6d76c68eff8667bd25a45e280c3036534d0c6eb72489bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3527.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35E9.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit