23795872de9ae30dadb0d0ada8936aa3535cc5d560a1d9a9730beb7a456b8c5d

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae6457376cd0420317d9f0624c2a46b8_JaffaCakes118.html
Size

51KB
MD5

ae6457376cd0420317d9f0624c2a46b8
SHA1

0d5f9b58b473a033a8ed4d241b11e1b1e6b5557a
SHA256

23795872de9ae30dadb0d0ada8936aa3535cc5d560a1d9a9730beb7a456b8c5d
SHA512

94a1799011e6c6fa50cd5691b12f3a110d775fd1c1e6c36eaf92bf10cd9fdf969fa05b9d369740eecce45b8784a7e5aa5484d0997209034db2a71e0f2a2330d8
SSDEEP

768:S597HGZMsFX1OFArFhEFKM/FrwFEBFVhFeIfxvFvLFZVYzAv:S597HGZDXIAZhcK2rIETVze+v5Z9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f1226a1ebfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000041c4db76a72099d056e17a12bde5737974f6b3ca91612c4ee616528da352d332000000000e8000000002000020000000bd0e652027bf995107d7a6298d580938e798be3eb5ee93df80def358384c1e8820000000bc924241243cde01676bd079ab5a58a241d3afceca8b0e6b8677f0289e90d0554000000005014349aa5adbdb8fc36362eb685bd3e29445a9d051346d00af645f05aab2d78518a2850ba11582314a00d55c7eee8945904e7a5433fe407ff4310f5040454d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424615796"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000088a5fedb12f48158e86a6a64095f7551ff8bc3d371b7ceca9126395639fcd3e3000000000e8000000002000020000000c49a87dbd2eafce8e7c9d6fc42df7e9a08f4c6e9e04f5cca6c8c737d3f417e6990000000848b93fee13ba358abe45a8d50a07fb76269f419e6d61f5cddab6a77e9049bcccd2116b55434b0fb27ae6047c800aa006e8e9011a9aec4f5d14975f32de5d2b4214b65188c9bb28408453559e840997022acf10755f0df93d2655c0c51dd0ef170df5170d08ff19f5f4c18e7d84ae2dc4f79e9029d8c30e67827d999e7b2eb93aa4aa81196dc4650ea1bef31bd25a5e94000000064b6f203901927ef359b2ef1f1ccf191b8305a1a2d8adfee4f24322269ff0b9744b939311367d6d4b67cfbb69295709fc4a199565cc3ff45323d6a6caa33ed95	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69FE2B31-2B11-11EF-A3C1-4A2B752F9250} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae6457376cd0420317d9f0624c2a46b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9853340c9bab33fb8b8198064d44a90

SHA1
1a45b3d4c89de13ae308e63ab4882a8a4fe782f9

SHA256
88ef16547095bfa004f08108f693abd109c590ed4410022418cfca393a75e7da

SHA512
4703956ee8144a868cffee617054c04a37bea838cecaf91ef3d1de6c420068aed3b4687f06e8e64fc0706496e847b60bef4a8b209cf5afa081abf1568085c3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30f3ff0502e2014a2b3da9eaa92adb68

SHA1
28bf69b64e50e589dd51741bf032f2a25f8dc6a4

SHA256
23243fcaed026b9ca25500cef302f5930fde3b8e215559d88927e6d3f0655a0e

SHA512
89cdd65449819ec4b330b24d6d8bedd564999aadd70e84307af1ceb83a76e25e92b4cbed81c167132b210ce266d374e837d63d31d0ef7ba83579bdfe6a9a10ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b49db5208a00531bd77617eb553a0c17

SHA1
a52aeff798367cd84681ad4214ff7a99f2b72ca2

SHA256
911cacdfe6b0541cf11c6f49a126d5919085e86bd70af68d860a12dab8a2f56f

SHA512
cbd3e2f316d78ab25e0ded65af739c008896bc2a8a92852d45262f2efb53649799993187514b7f6603e5c35a491fc19fd8e41e777b58eb45f525834e9d54b6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adcf394dc4a4f01a871610afa8847703

SHA1
2ab0b7d7e27738c38eae49245031aabafdd00525

SHA256
3b120d93a1992b2d9127c9cea5f4ff2ee3bd62df125c650ad3b9be7a8251e111

SHA512
0b56bfef5b24931dd9cf81b89dd61c9c6e381c0047cf070a3f1492f2a0f8eb45217811c106ef04723cb95d7504213db77c72ca7dce1e34fc98484c8dc5b7c2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac2d6a25a047c51df47e338b31e7a93

SHA1
344c4ee5371e4e1c254170dbd37e81562ff9a331

SHA256
978ea659b9c596e991442905ed8ca6d93b4763b42169517c5cb181cd6d72ea12

SHA512
4ca803b5623b5a0e3854f45866e3a4994e521a741829fbfacab0ad8dbef6dc8db8070ffe9be999141bbe8c56753f6d71ed13f41d49f847733fdf99fc5f2fdfa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5f45a9c7d3e02967981964fd277e618

SHA1
be108f746ec92d17fcfd66c4f462071875272531

SHA256
37445baddd832c3ee982b2aa7be0312269147faa19deea88552b29dfc9c96fe2

SHA512
3d3643d54f68dd04b92af84e3198b7fbf5210b7071aa1877d9ce511e4a74bbb1ac63753ab2fe11a6a0b04bd795471cf874ac343d3d826b8f9034a6b677436237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c705c8cc950db25293ec8dddf8aa6e2

SHA1
60b05c648d5fd5d47fbcd0f6bf6f487fba4c5e89

SHA256
c2e40052a7242c21280c891f4f2db1ff7725f660cf4c7b4fc94d27675eec529b

SHA512
fd43c63d2039380c2eda686bc181420fa87102af92677de404f26182f8cb42cd31aa987d31964a1d2216838e59cc09098b9eced856f47a4ef48e44e6baf4bf43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e7281edbe9dced33bacb9b46e930c85

SHA1
72f0217aaa8b951f2df186c34e99c89fc22c2fe4

SHA256
64bbd69e9e9aeb81b819301ad548e087f6b6e2802f9ad461a3484b49affac085

SHA512
f4b498166227b43faa5166eae84d4de455a550f759dc8c3461ede3fabb6e74f3c62745f83e3eeba616220cb665a9ebb5533f0b538bb107ef521e441272e8aa43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4965abce87c0e406e4c21ec3b3cf4c01

SHA1
eb895b1c65f9a2fa902eff717c1bfb03033e6a67

SHA256
fb2876f2e314835ebe1ff031c97408ac0a99bdd1c7e1fd779c0f5d652fd97c34

SHA512
f7095c19bf902cc25478624311f10350ecae91ff03ba350056704e8e8fbd513c184fccd62545a9000f5d09080e15968751178d73f33ec6faa55bdfe62c41b121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdbd3d06c5477cf2aca03303c7e19562

SHA1
83da41a553240bf6aabf61e2dd9db3f5a7b940fa

SHA256
5d41d18c8994194d2aee2fac7ecdd5c826a50d101c1837a9d4e86f4cc999c925

SHA512
90d756dbeac4ccf7656f803b611b55c75e6f5a9e595b6e45bea707544679b79e7192247bde21bd0520c9d0b10555d925e5ede7b03c359741839bcd68a4b1aa3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085b582e039f7e65b0d59b7956da83f0

SHA1
f64253606d47f53f5054b7af3d5c8f593322cc53

SHA256
13d2f2e2d80de4eefd3e9277490a0d18bbffa1e84d2e40494edb0a79bb066d74

SHA512
3e37d7bb062d035f60a2f148415666ab6ba7fcea3569887d82fc2bc5287a5c7522afd78dd6a97afb1f300fad568af4d0f0be00e4815b5aac1916e5159ec94b65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9628d5cc9d92ce76a55b41e8f74eb7c

SHA1
3fff9c66a69ed62de90f9484ebcc16921efd9bea

SHA256
dd6720e2b48a4df4130441adb93828349bd2e2bb4ca8c5a75d5d68b2defa5e55

SHA512
a1f2c4cad4dda56dca4e0462abba722678768bb375f5729d1aea74509479824420e863a955ae31bf649afbd2d4964d5f283aca60ca7331258119c814c37d3550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c076114a38a56c9a6738839d92ab7a4b

SHA1
bf3a9a9c23e94bb388f4e10177bf5e72fbc09bdf

SHA256
8a43245b552781656efd120119ccf447cc4d7e94133d9f387177808ec0935ada

SHA512
ca8a88f33bf2328823d0e85feb846df4051b23a2aa43c920f5e99d5d5c244f0420c68627e8b96a6d7d3e069f8db50d944e067baac3fc6f115eb7506f0372fd5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4958544292f8bfc8e4bed9b9e198c685

SHA1
fdeeb3aede0db89d30710d878fb3fd0753725077

SHA256
42276c8ad11ac5be2d9f81211160080d9831c22b276d659d1f76e57d52ff8a5c

SHA512
ccc98f13b5003b1cc8b786d380ad98c35104b300a59a4cc9c7c6147c239ed6208af36cb6117f78a283aff7e1548b53244ce62d87a2eb1024c657f0bf419720a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
365a7d2bd1f54b584409db7937b7224d

SHA1
8efe0a838508acf6430e7f1d9f6aa248feec6611

SHA256
8fabd32b4809fe4301fc525bd9bb45be8d5ea7adcec8fe101941aed9c49f2947

SHA512
f3a7790f2e54a0c1076fffe9130491c84de27b5ee0b4647aa1528a175f3bed6b5eb93dc04e4873e08985db14b0fc17fed10a3f052857e207764a073abfc93c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8233ad48ebb9dba65e90a4c89682c89

SHA1
07592aead39f9e9764f1018c973af9e57af0340d

SHA256
9726dcda77a94aec3a51afbef93fff0c4899fe32ff4de8a99e378d9522ace04e

SHA512
e671fe7eb0ef329ef40917a6efb3bc1184f05959e62dbf820b686a3a775f036fac0dcc1804a2bb7f7bcab081f5fbf9ab4b170233a46fdc28430acc4857a184b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7adf88d40372e7c61cc0e6fdcba2f11c

SHA1
1451b564f1f2bc09cb0ee2ce33772aa62a4f1c43

SHA256
723a0d41736a1e5edace630693b0069cbba69cb1a3acc4d30fb69e855d795d4f

SHA512
07527426c5c2e3081fca552881e77f30a800ff5f783659c430f34ffa64230725db7afe9b43fc130c36ab5783230de6cab2082021e34764799380d066f1fbcda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C80.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit