d5b4b5d1259adca6866599c6055c4af127c56fba340dc1a2ac3d4a9cb2510cef

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ace037a9365583239fced87268a0b12f_JaffaCakes118.html
Size

460KB
MD5

ace037a9365583239fced87268a0b12f
SHA1

7c38796949f04a6410a5acc1522335ef9d24fa3e
SHA256

d5b4b5d1259adca6866599c6055c4af127c56fba340dc1a2ac3d4a9cb2510cef
SHA512

f0b370d40823b9def63054886e0da4f8e5530f76138357a04495da53002fe0512a964ef373686526ec3f2a72bd4e9d51294c7f2b369248b6180eff4a97251284
SSDEEP

6144:Sh4sMYod+X3oI+YUsMYod+X3oI+Y4sMYod+X3oI+YLsMYod+X3oI+YQ:t5d+X345d+X3I5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424587393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000916ead3bbce353a670fb38f170c6fd74a30c66cedc268a3a36032d1844b16c5000000000e8000000002000020000000c8b03364ebf1fc234a875a1aa15a5c95aadc13a736d5ff0b8d73d35a24cabdee2000000011e2b949691046fb464e8f9651e3ea6e01807cffb7eb49c4a394a05fdf83de554000000009cb3b351d77f5bf841943911d069330ac53d9bc062643f0410fde5bd1d8021483c8604ff54db0fe6c9e43e1530c0b7892ee3833c5df97cefbb14f316a64dbb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000089b889928bb8d4dfc182ed6b3581581ae62c275057370287d5b54fa594d2cf55000000000e8000000002000020000000d3d044cd40972aecffd28bcf9ba69e28e18ee41e8f8586f093dffe837ca9b24490000000971b95d308b1cec8f1eca43923bb065bcb82cf5ab0118490f382b315966c06a70c24a7803f2cbe7a7c7b5e1c4a9f017fff308fdf60479a14fe75cf46893846466b8cc972ca2739af9b4be95281cfc471e9bf379cf39a394325ad260097182edd7c49908057233c6a2ec0531732f509fb1a169570660dc2b10acdd3b335fc0f6030ab18cedb63962985f5f8d09b19305040000000e76b4afb9435a3919777c2d66786a750ff9a7d4e825ebc59abd13ff4663fc04b998d405d07cb265958a2ebbf72c179d076d55d079d2a39075821814d9c049396	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4911E891-2ACF-11EF-B918-627D7EE66EFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70138c1edcbeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2592	1696	iexplore.exe	28
PID 1696 wrote to memory of 2592	1696	iexplore.exe	28
PID 1696 wrote to memory of 2592	1696	iexplore.exe	28
PID 1696 wrote to memory of 2592	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ace037a9365583239fced87268a0b12f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4b9564755730fb3a035b6d8fc55bb4b

SHA1
be3bd48e0e5b7209570ff7ad45293b2a1898f3ae

SHA256
6be7552bc4cb642d67010cec2334de105ad3d378c0a3a6c654e257eb741f1365

SHA512
162088f1f3fd6be9f5613724b7673c99bd6912417e40be585ad9a060f5a8f8dccb2b63024e64edf5be00b9892d65b933201ac3e42ef7baf856e3b95d5c813afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0a141990d2b7250dfbdec458fdd2a03

SHA1
87d7f1baac7946e0f9b49850d8c44b75a80c48f7

SHA256
dba7ecaf589090634688fd1abe6189fe91f62474fc9c1d72395ea07ebec080a8

SHA512
82fb615409e13c8dda459117572dd85cb698be6e98ec56311830f73d492b3c17b359a2e8270f0d77b4f8123e165c63c1f3b1bcbb89f4de2b23b2baa4409023d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
193c4646df6c36d4ad21cb1ef8eaa2ab

SHA1
fb2aad57ef5f4c90e2e96cbb0de112c19f67914e

SHA256
215ee09e70f238c622995a8c35e2eac1c73ca0e35e8459124fa390984c8bab2b

SHA512
007e92bf1e629cc3bb5d4974ab4586cbf99d3e01a72e83afa3d8490148a781073c378d3394348ab8a8a582b1c1e22a5fd0e11d6fa344181c42799713df85f289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba5b62337ba369a7d54f95f6e0c7da42

SHA1
3a928b37629191f579a7ff767b94f830a3f5f496

SHA256
3e05516c9b92dd92508dcd8be1a74b3358df9b07cb77ef0730f77ad968936adc

SHA512
3ca6f9d7f498c8a61aad193168a80a998b30a6e6b5ebd945dc8e4f8e41039de4b3b0cee989a0bf6798e27d8ff9662cb3a8a76e2dc245e18c3164b93ee7262efe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2f79254675ce65523d4f8047d4fd20

SHA1
21909e3079d275c71ef25097d1ac4ddd8a8d61e3

SHA256
a8fdbae87214ed7cf8527d35a9622812936b70682a24f7e6fde47127cd2ef269

SHA512
53f3a2d69a71fec05911a7327b4df4a85cdcd7ed4cc71dec340d8f61dc4f728a1c4b450b956cb7302b059a41745daac87c910f4a1daf99ae96c467cacaa0df95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16f72bcdeabbcdc7ada7165fc8c6620b

SHA1
71b365be2d8d72247e2ce9ed0661ecca46b2ccc2

SHA256
0a1fb39b4e102db2a8c3c896c32e6194cd936015dac5d14501815581a8dae598

SHA512
6fa0f74d6f0ffde16ddbcde17f716ac64bd38387fcc2ebac0f114a868c40bb69527c714b1f5ff3ab12b1bade2aaa58816193cbced38814244436fa17bdf8f34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca81ce0713f1e2eadc7ab7c4ed28a6b

SHA1
13696f60bc63ef0c99dc9f31e33e71970ac5a775

SHA256
2824cd8395b3b3de45a5f8e8b8b71253f4f98560a80a050a24c9b923a27d0991

SHA512
58af777216de05fad158fddff53184cef1fc5c227c269f9753025d2d3d17730236a00c1813f5a8dd01c00eeecd18fd5ed9da09bd69ab86b7be615e33c9016d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5fa603c9e081d181fedb305416241ed

SHA1
3e6cc68fc18ff94753f30a8aeaf290278e1774b6

SHA256
afa30fc2d4c46c1f87d8ffef222e123bc13567bc26b84d21af72b6ac3234ce75

SHA512
d959e2d57c8afdd32fc46ad1e7e7075a90baef05e91e6c0e7fe6edf4325c85ae1640b97ca2a151e8914a2c7ddd942851460cc6702f3a779d2808095d95ae6443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99c958ef12242d97504091927a15d97b

SHA1
2a512602359fb63d05f7ec9f92f43bd89f5b995d

SHA256
d6663de4f466eb6a35708f1ef8db1912b135a7db88e2e6e41a709772df3391e8

SHA512
5ccff72f0351fa85183a9a4ead9bd5ab25ecfbe7d87734ec968b4cec5cc344bdf4e20e7b1025908bdd2e61a0ece50297a8d467d515d20b4d075b824b8194e039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d96ce02bf0c3c7a9ce768df1f7c577c9

SHA1
670e3042c72903b47ea09de1bc5649bb14cb8838

SHA256
81807a9eafaef66ed50189c5a14176dccb35062b7348b367919157367cadbce6

SHA512
b24fb98b50d0c718df788a18707ca3f59c5662713b1b781566b656718ee932f8c072817ba3138f94d0edea6e7925f9898f8a566fd501cd2817848f7a9664c8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0755d16959484dc0d7c12a7b31e919d

SHA1
dc693f0d9cc8663f5972c242e7fb08e1bdc08b17

SHA256
7c11cd39a481785b8b7d640bb55604a8359227fa4a34eba495609c6b7d1d9806

SHA512
c60e7ba8867695d293c265723b73e4528fddd6e51783ab9f0e87f6615edf78f8f6f0a27b4ecb94a9333d673b81ff0ee6aab575146defb9d6717afd130592c72d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9eaa5c5fc3e6acfaf731e9e0f70463c

SHA1
c48652d8460ba5d2a30d050792b8e54357d2a690

SHA256
790ddf58caefe1b9137dac2af2eb9ab10d09aaf4a1167fa08a6a89f651768777

SHA512
9833d76bdde6781e4be63fe484fbb44bcc51b24e241ecdad9d8562be9d144b037c2865ed23d3c37a60d30ba5adb04ac65303488235a2611dc3e653b5eda77e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04dfa95071c7cd0bf0e953fa188509f0

SHA1
f924f218f6e6f5fb6ebff2eff599d18053abf263

SHA256
eb9a58bd1f04187060dc4dcbdacd0b1af1613dc544d23913df095112bebee2eb

SHA512
b2bad577a6b8e530af658574e922e1eef76d5a7f1facd0c8b608b1ab2ad86a0ea20d80b00fe09f743ccd63838e4fd149e11b4386460796a70b8947147ed1e194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15f74323d8c3f6ea84f385f91aed3970

SHA1
f58a2bf47373ddcb39c7029b43f42525f5c33cdd

SHA256
d077dbd86e2c61a7c66e5fa8253997747b72b70bed51e86d522729fb9164126e

SHA512
8a674292f3c65ee8ba5cace269a4300251636484e73b44b161401fb980bab6cdc35dc56b52885a3efc0afddd0480f1733939e6bb0b10e7a4245dcd0bd585e2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22196421f6d8bc543e5ca94bdb59dc14

SHA1
d050aa0c6dd0721e2395c0e1493f9d21f3c7cc06

SHA256
eab47b596d6486e6b2f3ff2e6250d6400862471d3f56bec4002959cb4b4ee904

SHA512
ac74559653d6c728694b6d1a16f38287012adb462f316f559e94ffe69b5abf1d9b341955236dfaccae9d9de756d0b8254d7a81a4f8880c703c18ec6d44569cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f39cb05f9e7753128efa77a505ec35c

SHA1
6057e7db91cf07969fabb03c4435297cb0544053

SHA256
2bfe9e443f2e82c8196b09a8521a4fe056907e58585f2acb1da4268f97f7effd

SHA512
8fa403d465ca28b4c8c26073c4ee4da3731e72386773cfd91d06fe8dec49c34f009dbe02fd0785249a5643c18ac83b6118e27257bf98d6b30605f5462f8939bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52c736530bb3fbafaf10a3f01cbb199

SHA1
4a792b02cb1ad40fa5652ba5657583dba66ca799

SHA256
73269413341f5c21a1bda34aeb59a85c2eacf84a79e948e6b09665a279fd89a4

SHA512
58c047ae29c2e8bdc86106380142ed0816c0abd3a3fdbf191c3a5413fdcf08129615a75d9413c46e2345dd82ce81c488d3fac4c8b337298b8f68b50207b5fc52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C5C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit