5635b93c5f53591d77e23ff6ce79fddd5a52d08648810f2e49cb9a9282025079

Analysis

max time kernel
138s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf6fe4fa9edd6bb252ab988b745ff9d_JaffaCakes118.html
Size

72KB
MD5

adf6fe4fa9edd6bb252ab988b745ff9d
SHA1

e432302097146f4750944525bd2067c7bde00684
SHA256

5635b93c5f53591d77e23ff6ce79fddd5a52d08648810f2e49cb9a9282025079
SHA512

6b5e506141556b847612f167e46958bfa31f82b3f662e3b5d1c8f6830c4839edd31ea3082d86f9e3a70eadd3aef4b5488f82e851c74ccf6cdfcf667e1002f9f8
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6sT6fXpFa1I7aDkoTyS1wCZkoTyMdtbBnfBgN8/lboi2h:J34Fq02TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000f268bafc41c9d41d96433abfaf883d5197477f5b71fe6dfeed9e8400cc7c187b000000000e8000000002000020000000d0c2e9f8f040610c05f1daab54e02823eeb15c99f6af9ab47457b15fd17046ac200000009fa255e3b6d3496520108cba59509bc61f6dd498f1292d328a2d0edec2ec3683400000007b20337d2dca5df51952717ff959e6ed203ccde06cd808e5d263454b0acc7a6d35fac010e5cd1ae3f1e678bdc6b604a04396d8ad1924b138b7a969f88ab0a2af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d840bb0dbfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6050DE1-2B00-11EF-8B35-D2952450F783} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006d1793e56ed2c53c78df88248f2ee8aeff27d3bbdb942f064237ca56e86093ee000000000e80000000020000200000003a6bdbda6f8843df9c2625ecb4499ce88cdaa4877490c7eb56609169a5877e54900000001cd82cda6f43ced73b3cc9d2badd7f69cabe7abe986d517805ba7fa4992ef2c2ad5ae394cb2d4ba66f77d5e7743485f91e957024c5e1592a05e6c7d65fbfa92e12425774ce851eb8b3c79fb3edbace412fbabb321a248f4ae9d87c0bed028cacd32b32f9040b8789625b72990c9e529a45f7ddfd36fd908cf0fbd438b4cb4a8762a753c6fb8697b5585e6c3da535adf440000000e7a1c3b0cb29444d2e1594f8cf402578828a5fe105e2dca3ef501a00ff3124685ccca3646fc46e9a8ae4692d771bc03eb2d323baf2d79bd885f71873429eccc0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424608702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2664	2260	iexplore.exe	28
PID 2260 wrote to memory of 2664	2260	iexplore.exe	28
PID 2260 wrote to memory of 2664	2260	iexplore.exe	28
PID 2260 wrote to memory of 2664	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\adf6fe4fa9edd6bb252ab988b745ff9d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c11730dab89bb6744830d8691df78cf5

SHA1
520db22b895c9e150610fd393f90ff6a28b955d8

SHA256
55a8c33c8131b42c0328b2f49243470bb72dfcfa3a3029c39f9477eabe304b66

SHA512
77da08d7d0d35b39e5e0294e033c50235d16e8b2326975a9e30e2494f1e4a70d8420f4c8771c784508710fcdb1dca724867cf3f54436e8e645fb575cfcb54ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
929a5b879d613633b3509bf990a073b0

SHA1
843af81d89d0d04f269e57472d736596f57fbe7b

SHA256
b4713e775383268bfb1a9d6116b6fd05b93990e865990af08543271fbce32c1f

SHA512
2dd15390a575bfb108398e9f3544bba7353599a20754701fd7ad94e0ab072c756e70cd359fb0042799233786af0585d609a815d4343effec6435aba0835c8fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c603aced2b2855681f77d6f702bab817

SHA1
52e738b1fea20099c8e5da97d6d86cf389be3140

SHA256
5032882bca41f16de8058b75b5f9c151a160963e3167a3f7fb416e4841d64337

SHA512
b5992eb6d45656a894424b6ecc11adfb844e12471fef0135947cc5a4a91a9a27ed6d596aa4fcb12fe85080d1dc3577a220a111a4c4d88cb928e8bb7d0e2b6290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a34e3ffbd3d82db303081d5bbad7ab9

SHA1
597f12263f649c3a24c5f4bcf83951be8434aafc

SHA256
b072c8d669f2b7377d76d59bd18deef2f37ffa6cf2c0b8f81efca48a00f8bc88

SHA512
89d52e83d6e79bbab2ad7182fb0b2777733a777a307f2d656d3191152c88fa22758a43ce64e8d388edce49a9fc29720a50e4174c74381070b7b98438ef2719bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc58fac5ffd6312d58deeaaa5bf429dd

SHA1
baa70a2676eccad2ade225e2d7b20b7f00c5ccdd

SHA256
7817f28a7a5c02e4cc7510572743228bdf74cd01afeee937f8f84b513d03c6ef

SHA512
1bb04f12d7ed000e1d37e208913874ea4e0c9e3588b5b4d37ebfa75742d0a7b02cf4772ca7e7a9269b9a0f260ffe0f9299bec7050ebf9c18d55967c0527f1a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06f07a220e17d0996f22ca4acd8d8016

SHA1
20f31f1ab7d73b4730339434ff70d0aad9005b5d

SHA256
75f177bcf9049839b43d60f9d8e5de1ada524eaba749b2db409c341176feef96

SHA512
4fbe423adf8473b88b20729e04fdee357f44cdaf59413e5e3661ee09d689abeec01558feddc5c49c79baf4cd2572d30ab543f3d6c32d51bf7909f62fb546a9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b4562dd057f04e48539cf06ac171bc8

SHA1
13534b6847ddc4cb1d489bcfe0bd20cc584e8ed8

SHA256
d2bfc4542e26a31e7215d288e69fdbcd2b7a7600fe5a9e65ae8de9b36f66f414

SHA512
bf09c65c638a44eb91f43dea9e129ec1b24c8bc6a3bce5740409b924de7e3d60bf2c4020cd43c41348d3d4aabe4f8173377b4c329d182f293f11201317685051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735bd85be6e31bf850b107fbc13dbbff

SHA1
131766099da2510fb7146e300034a48ac97f3953

SHA256
276b391ce0e03e91fde8534f0f8836546e5526a54703f5162a255d1d121075d1

SHA512
91097b2e047e14b99110dca950c97155a57f7f7decd3420dc6c80013e68f1564b285e8f75f1d0c99c686d1ea8472c34d3b31726ec3786a07a2ec9d16a351382e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be9b738a69458d3e4f5ccb2f37943d0a

SHA1
d70eeff5dd14a8ecec192fb121a8b32ea488c80a

SHA256
23b2e628c5c957d5be7ac625a0b00c6c1c5c108057d70400dc6e6e4b52852cb3

SHA512
6141e0b25358e36ba309df609a96ba379d1aac2858c321d3e1727ef9c7572ecc0bfcb79b715b12e6e51dfbe571beafc63147ab404c4bd8b0086ea8f01275c22f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25c77fb38243eb3e73f71ecbd4f1698b

SHA1
1933da62122e37a9c6088fd9b2fa8454792fa5a6

SHA256
669bf237dc99e82ea17309ce73dfa339eaa540660a747cedb8c64acf42374a88

SHA512
d05060bf9cd8f192c8b768bd789a85e90e577d28602837ca7cbf84474a5cc081eb63e6431ecdda0cb52370c457599188768afed6eef5e3fe7a88f65323667f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd2b391469e9610d50f3b05c45e31552

SHA1
f8db3a609164bca521ef75b258a6459cae3095bc

SHA256
4b85a2b2e3ef5345a7d7b4d3c82e99f3b08c5507e953074b1f2261c0327fef6e

SHA512
582919ba5fcf259e94a6122ef7d697e29a11c7355b9c8060f50ec21a43705dc06bf39ca66e2e2c9767c9901e625fd856f8e7bd02c64383c729eeeda3b22766fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5cbead1596133f43ac5ff80b3afe898

SHA1
a0b38447b6fb50bf67ceaa21abefd32d24c7901d

SHA256
f1e25129e7612f72ca70f826398d2a54d202214303220bf8a840d6d1deed0044

SHA512
fb0d29b1f370a053b002e540899df1693d45b781fc7e2d93a7d0f055efdd84a12b6ad586db1b27102e9f4413d7aeab843fb3adbf521581cf7e40d76f7ce89b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434602bc5f67045971623ad70fbfe8d5

SHA1
86ac0d2a4f769fc716c1c2f6e95d1deb247c3bd3

SHA256
a7e9a52ce621b58246e095241050d61681914ba5fe4d7133be547b212486e2dd

SHA512
fc6726f3e16b22a8b250d28a23c7e6d7d2845a617896d06b2218e24a5d874bc675e4228d2fda763e7b61daaddb66c6ec1366e281d4545e80eec28064e32dfe44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19b762b10826e29b71ea45c0d0e5599

SHA1
6a07e815a947059cd0d959d54e11d397f1ef2cff

SHA256
656412a6c21b2d319d035bea236c865d8eea166ebdf9a75b680c396f3e8409dd

SHA512
7661f23e449e70bfab6cf9230f32befe390e7ab0a9bc6a2e4393425ea366dd2a27bb561ea5e14bfa961a184a903487260e7d7c011ee0d2dac8cbfc8b68e18456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e62a9e59e9039b85a10ce9f27bee16d

SHA1
bfea8507feb84e0c2502d75de5249bebef99abf0

SHA256
ee51064db75a66a805f498eefa5fef7ab742b7ed604bacd0e00d6068ad4683a4

SHA512
d846bd0823b22a401d7da0d422347f24b2b7db37801959c77bee1b793c08ef036adbc8321c98e3ae29ddc40faa9aafebbd22b32cec0dc34878d8da8022975763

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8354.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit