22bbab70e28f7b83dd821b4e3d9a0ef13580173f11ecd4cba9ada3519de18d3a

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac7f3a91905279329716b3266340fc39_JaffaCakes118.html
Size

123KB
MD5

ac7f3a91905279329716b3266340fc39
SHA1

5521564fc2a24cc20e2be58a490b1a2dfe5cf7b0
SHA256

22bbab70e28f7b83dd821b4e3d9a0ef13580173f11ecd4cba9ada3519de18d3a
SHA512

aed2ca2b5b8d3a604467a999c3adb92924e87697c9c5ed818b1eaa5f9cabbb72d8dab5938cac0bea41bd9fb5fc5fb7d612278b926a1526b96e1ae170d4e7f1e8
SSDEEP

3072:Bv74DNLrsSyfkMY+BES09JXAnyrZalI+YQ:Bv74NrcsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000019f419261bd4e27098c20d9f39ff226a5fe64d2c02b781ff962ea6b53719064a000000000e8000000002000020000000edc5b3fc9738172a4c79f7b23f6fee86dd1476b200d938c040980d8e22063cad200000002032f8f3b2e8ac9f66e690757680dbdfdff8c11610db36bd953b989eb2bf261d400000008cfb900b0736587d000137e04aba3abf22dcadd42958b184404f693a70dce0f01ebccb3ec42dfa876834d706542d432a2a1f99f2073c414b992e63da771ca9fe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ce2228c7beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005d721636d95feca5d1582c3fa2b5097fb79c96e3497b728fd3547df377542d0d000000000e8000000002000020000000d5abd1ad37eec880f0e3e43652161e890879856c227a33b5770dd7eb22d36aac90000000a77ab6c2a24351436372102f0ef18a1a99f54ad9046ccf2cf81d52ac06038c0af232e87e0c0e46432f43755acdda1e0ad94f2967094c539d5068a048a08da4ebfd182303e187da4d1f95d49cae73117cb3afcb96375e5a1755b4c7a6c2f8856fd2def7cb8696c37ee64348e194e0cfe693442ecc427576c175d64088d05cdb6e6040089533cd52466f71865e07650bcd400000001f6f9a2353d78682056371bafd8d5010ca15bd627c98bcbd15ac4c3848db829c705d8e0a3414b0fa9813cb378902e2042d033d3f2e7861bc78024595f0bded79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424578349"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A4A1D11-2ABA-11EF-968C-FEBBC6272832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28
PID 1704 wrote to memory of 2652	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac7f3a91905279329716b3266340fc39_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c68d4a28ef7fc818f50c683f011f434

SHA1
4e0d305d9ee883c809a2ab708f74fc370dab3f42

SHA256
f130b9253b838373170c4072a377facc13a5897100227020c4ad1b2e1979813d

SHA512
731a94fc976287021a2105fae8d05bb716a236c22c86343ca23883dd273ad4c91f098877a5cb73022a6c30f2c789be0cb33cc2c44c29c88f0538fe88cb9af835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96682795ee791e65e459a005019e4088

SHA1
558a0480c470e9715adaae071e761b17ec4c4e76

SHA256
d76927b95131675c5860fa35311b1c4e3748328bc4d7642e9bb52206098fa73c

SHA512
16a56ded1b1d501d347afd7129d12f8a8318fa20cce24c4acf3f8595c33749a7bb23f6670659516d620959a4fcb38755a2916c2daba48304eba65f0a96b4e55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ddcc2609fa81e1f88e39e1de215da0

SHA1
c9c6c6bbf7f6fdf05f43f3375c7f22fc8356ae7a

SHA256
48a3c2018ecfd272bbb10a61351a7cec73f61851289a887f387e748ad3a2d44c

SHA512
8664937ad2ee722b9db33f3888655f40e1234e6a2c6f29d6861a4cc82b44816c6d7024f90db7d7e552775faf7ef30e14815d7a45351c31ccb52b036b892af83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa90e7e92b6293ca8eb7226c6a2771c7

SHA1
a488207c43e4ff5ea51ef52a095ec53a3538a502

SHA256
e4cfc9b59a436d8f5842c1d45bfca6f7bf1b8476bb1a9b8a889f342ee821f3ed

SHA512
20fc5d7dfbf5a498e3cd3cdaa160d4cfdf10e627360bea2bed4beca8f8ac6fcffff325c6b41aaa74a55deac0145897ae7bbb8f3ee98e3225e6a286d26eae7689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cccb79dfcc3e453a610de6a5551bc152

SHA1
e0cedb903cb72b28f35cc1eaee4f6bf052d454c6

SHA256
265f74be51e26b2d907ff4535a3768721dee1a2eb1f93cd791053cc08f5ae46f

SHA512
1ef4941add3c5db8cd02d8ce1c33286e9813da062ecc986481883222e6f5b9eaac6191a69b25ef1d20f092a4a43606dcd677ffcec57aa8f20741302109710662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d95b4d23478ac0c473d339b0ca8c6ebb

SHA1
b74c31cb43c0fbdf03d1498f98b74ebfa666db23

SHA256
c1f8bac5c9d1ab4d68b20aa76ea405ffb02bae7bae546e19152ad2336559f0f0

SHA512
41f8baf0ad4b805cabeeaa51970e6735dd10fce609854833aac4203efa70b70bc8a9b0e5d0e7ebeb910a8f2afe4b6a36aca7d8cca3941b0d27f232e9c14b4cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
029283601410094c7be12933cdc9ab0f

SHA1
ed72590b4f77ceddecd4643e2b90aadd91bfe5e9

SHA256
5a298a5e891166ea072bffbe2cbf14b0e850708fbfa7717ace00a150a5326b3e

SHA512
114e25eee48a4e7edbd24af261a3854cf8491b074f3da72b99d9d60a1fbd76eb80ccc51ebda27593fc4bf0ea88185fee8ce9205f194253509bc446af3a62f61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
450f9032499df8a781470bdf64360e8e

SHA1
8e79d80aa16c1bb87f50a86bc89aa4b8d0342d45

SHA256
5f8641faa7738f1bf3d60dc81b98038e94b0c972690231ce236fe24de068e501

SHA512
253d7c79e24fe5e2f3cb13c2992d3a1dbdb4ba610bdbd13214dc0866e97f57b0a29ba74a970884a0f487a5ada7a5999f8142cf66ae75fcfea9f8a29712e5b924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1001856eeb610df7d62b6f918c2b12b

SHA1
938d4ab3df1748ee4d514c755952ab8e06784c5f

SHA256
43ff32d93c5ba8e531b7ad7d30bc51fdd06b1d9b52c262ba3e24a92a3c9a7805

SHA512
7c5100a44eb1c82e4613d8e35d977fec084df6abc8e45122bc03f2f3b9036aae570394ea875ad4a9df8dea5a106131b9d574746befffcf77ed2be7e94c3ab0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11aae64954cb6e2455fd79db0cc2684e

SHA1
2b07eb3217d69c143ebc956af2cb0c15a0127dee

SHA256
d6115f7c8aeb957d8dca4674f9f088609325c2b6f5f2d83d3125c3572019e20c

SHA512
787ff10c0bbceaba6a2bfdb196273d24a95351cc5e3ae4d37fdadbc7fca75c2e05ee06d4fa58290938618742cd80664cc4adc06e9abafc11e53d8e43ccde493d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61b4ab62b597ce3d8fdcd721ba896900

SHA1
d6983f16e1fd61ebb6979a098123da4687098634

SHA256
3a846a1cff90f6c740ddff657f241e51ea4816362e4a49122b7abcf03be72230

SHA512
75187517a0846cbf75dcfc0026d8993366508db0e232700c34f0203be9b3d1162586879db21652cfa15e6a0910440a2cd5dc0d10f238176f5fdc042d10d5a7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bbef618aba5a03afdd93431d5a8f71c

SHA1
74584456a9da88d8f13b99f8c72d561b4aa629b3

SHA256
b87c1a1471b4993b168c338198fdcb4739cd4278907c1bff56476eabd6a55369

SHA512
46936f3bcde48c5721d41ac63bb41207bc635cb5020d5b5a9fb87f40235565f68d4ccd57601245d0cefbf8ab3d4b4f639efb85add87031bbdc6f602aa2ea6c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fc33e3c27ccb5bb3d148f8d90cf4f2b

SHA1
39d2ac1cefe31f3e64f438008f4edbee81a8fab7

SHA256
d76b28a14317e313355d1b88659a953ce176f4375f14eea435ee328129c8006d

SHA512
0647ff3254d957178749ad552905ddae564fb7633abadd7fa304f1e1173fc9b9ce88f7f4162bd8940c0ec3a62c2313f05307230a9358018b9becf4abdcf7f681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c12451e3b4bc97eeeeff43a98955cc44

SHA1
884251125258ee5918cfb558118e75ab6a80543b

SHA256
5c43ea6b80a0553da4547aee4e646794fb531c86824042f7fb8e92979fbddadb

SHA512
a5d530a1570b98ac4a1dfdd588aa94f764a008bfe997a4ae8ae6234ff87471a4858759bacbbe2312937679d3468b5596bef2e9c5cd5607b6451947ae38519c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4071a7ab56c8c792db59bf5a805c8fc8

SHA1
0ce7680a8fc87dc8b6909c2e33fe13c2906e3dcc

SHA256
0bca6a4238758657a8bd58b65555688d60533c713f336f7d198e8671edd63c66

SHA512
091ffb307776f0e909bfc3471b88ae7f1ae87207c41964d2dea542000d7ce16d64c24a45abbae141bfda84036e4d1b75c8dd7ab94c4ef5e9ed93d2da902e2d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf3c838b489fa795bc8705392603e52

SHA1
473e67957e2255e190bf4155afe5c9bc46663811

SHA256
0ac71ab0f786a216e25473432cf6c11cf4adaefd84fdb4004c290a78a9773b36

SHA512
6c81a8461b62ee47e0ab7da9ac719c7e6a23add59afa1e3ad023091c1db4042fae6c098104b6c4504d88a56307f75378e51e2f5360bde468cce2d6e360997b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11fb17c817b1d36376e30d3a38aa2407

SHA1
ff98c958c79dd515ddd972ffd9d49c2e93f6d743

SHA256
42e8740ae8fe9400d25bd570bdd0c273e804199ce2c0f2566add5f6d71447cfd

SHA512
670b07f8a9aa9fcc16d2868dc2a0d69400c8d28f9751626a5f255fef185437b03d30807225069edb25bec77f3eee4d80fdcdd76320635987312b76e251305682

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2484.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2514.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit