8f1a0173ada24e46d0ce98cfb41de2931e95b1ecb85dd1623bffa617ea2ac38a

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9a3bb2fbee8949b940dc9da7dcc947_JaffaCakes118.html
Size

11KB
MD5

ae9a3bb2fbee8949b940dc9da7dcc947
SHA1

c5e6cd0684e94abe204be0031106d3d730046c68
SHA256

8f1a0173ada24e46d0ce98cfb41de2931e95b1ecb85dd1623bffa617ea2ac38a
SHA512

9d32021ec74386a0b08ba8c003ff945d7e3dca406560b02b21052f22cdc9ee9ded737d1a4bed6ff9eac922c92c70342441a0c78025aea104fa70c2802b4a19d2
SSDEEP

192:CqyMgBEOks1QTxE6av//X7/phH1adJ0XibpkD4asZY6:CAOkjHav/T/7H1afb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424619459"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED1AA591-2B19-11EF-AAAD-627D7EE66EFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000005a9513b12dd7944fe8a82070452589765ab72d85d948329b4c3c3d727ae7cf00000000000e80000000020000200000003496db7cfcfa231a9747d721b08361155421c23b47b318bd2371ca0e04a26c5c200000009323c020e41738b230d4900deb3ecc74b949e610d2c6b2b6143c6eeadba67d1640000000d22cd7d8af389acc80304a40df5e30923d1654501dafe7ff613c7e71691f186a9a014739205e853878a9bcef09bd206e00d4c7ae379d574f0d60bcc8f56cb98d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50075ec426bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004d37646d09e732bce1afb531fd660b50f2569e5fc06829e5b2ec33f36ba861cd000000000e8000000002000020000000703470f5461226a05d983f4629b4c14c3896bc1fcfed4f6eb075f6550f57286e90000000b621b1dee6bc19828ba481ac383af61b344761056dac1fb0088acdd632d8f5f17ae4b08ecfcceba80c556087003c0d36ca4cc7d0457656ce975e68a5ef5115de700233b3bef38c3d70724fc6cb020dc705075e314b4a2e2d9fe5967551cbd7dac0369f04692836ed93b4e9e12b39556b9ccf62da62b669d6089c1516d319c1b118aed0ec16eddf5c1a211213b635ab0c4000000041a75829d2ef083089e2381c2ed3fe400df0b9c5f20304d88f3e527117033206fc8da167775ee6a276614677be6a6c5efd08613408641e51a9906e43538ed3cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2320	1548	iexplore.exe	28
PID 1548 wrote to memory of 2320	1548	iexplore.exe	28
PID 1548 wrote to memory of 2320	1548	iexplore.exe	28
PID 1548 wrote to memory of 2320	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae9a3bb2fbee8949b940dc9da7dcc947_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb692a27b456743dd54e3081d6441717

SHA1
a90b742f4dfb689cf5fc237a4c95d6dbec238a2f

SHA256
04914dece2d8a9684525d9202417daf69f9e44278dba6177057fee119161c741

SHA512
07e6c74334faf38bf3dfb16242040f6d6b1afc1c55ea322a76dfef24fa02bd93fb169681ee59ca8877c09e37a74c7c7d477835d88c6c9782530cbd1ad97b186f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16e2cb9cfb04452815b138f0e3788c65

SHA1
3b4a10abc837ce7d9120d9eb0497b49249decd23

SHA256
8da15f247229d8812527c25ea1f50f5b0acaa93a4f90ac1ef567901eab824500

SHA512
38bd3c5f3e342c0b8aa70471dae353f6edcfb66f87bdfc997e215727f61331982ddfbda083d5bab3dd79ad431f43241c812823f0e2bf73d9f315f8642a38b3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0339a2f45edca5cffb60438357852a1

SHA1
3dec007bcd0a3e47808bc508305ebec8272b941d

SHA256
1e1bf3de2e67e56e74ae4470c42597a9a162fb1b18204201d8ddd79c6dbed6a9

SHA512
837d47db99ea17de26b027d3c183f4c8e03b768986c64719ddcae0342e7f48bbc377db4fdfd7117de6c2f5bb54c847a76c6baaa50d15d888964ab94c38b2a448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7c36eabe5236c16410837c8c024fa6f

SHA1
87a9f91f5ff3ff286eb3e6827917dd450b353685

SHA256
c06c32ad9da6ae033e38e8267c42ed460e06a404b0143f666a6f8e001c1120f3

SHA512
503fb02b27e518f661a073bca4dd0660dfcfb5885b992e2a2d96813d6aa144da5ce7736de5f9f7a9f712affe764fd1c00af0a03fee3ca9a667100334c7048458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b58abbbc9ff2d04b7d24a12e4fa8bda

SHA1
828caeaa8b22c686f91733813490e1fbea9c39a5

SHA256
e88b51ce8b9a6e39f78ef511c5cc375b78071fc5f094ab0f71879b6707f85ecc

SHA512
8db8ee2739f1630194aea0fb3b51050f82b74b399105d526b12e20602b2a70750aedf6278e9675baecfdb97a72186932e78a02635c0a6a17d278e48a5566f3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed0538d2a79e2bb1831c85cd753ec934

SHA1
c23b8a822a335b23bb1ffdbc89da716ea07c99ea

SHA256
812abaf6df1bd998cde3da04691b6028d86bbcab206766d80925153adc993d55

SHA512
6fbfd25d5875352f93fed4d04b9d1e5aa238bfc3952e96d40081439eea31a6a7dd137499c2e6276ed4ee0ae87a0b26c894c71b8a1cd3597ffe6cd79fbc90e29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
104f1b45510b5c62bca53e5da27d34cf

SHA1
a97f64a1cfa5d98ace440e55b86011b88784a08e

SHA256
d7497fb2e874a53d83fa3081d70fcf0981b4cb1be6c142c5b97c8f5c0537aad9

SHA512
7d5bd692385ab68747eb1e5f99c26c4262de4c07b7d2ea48df51cea052634aea726c7fcf3d88705ca15dc0dac9f4f21eb776167a6d3209059eed1a58e06cd140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed6501c265f0bee6ae487ded30700f4

SHA1
907fcdd58e25dffae43088e49f00522a8d25d4fe

SHA256
f2d1d2fc73a41e24ed6765f11f6b1a800a5fa78c172310322ff7aa554af90457

SHA512
005d7f88d69e375241b43d25369260cfdad984cb85adacd48f87012af257b3c0b24d655e1aae8aaa10f7607ed3a9f04c2f58adc7372314794626146621e00d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dc6604224c2ec01daf8cd66e34fb9e1

SHA1
e859d638a19d584dd9d35320424165d0d48ac02f

SHA256
524445a1266eb5660963d796f634c998e2e67e106a99c9bde4ea73d81b517b5a

SHA512
fe85f9a0a3cd3c48c7d91c2edf02f91cdd8da5fd8295edc47fd07dca785a57dc49be691ab4010f889b896deeacf4d005501379f23b37df414d38e4d2f2e4b67c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40f5d4002fc8347f2aeb109c3b90dc2e

SHA1
266d1036415e565f22807f6313e6c09ee14e8b6b

SHA256
a8462a3fc9c34a6848b917da94f7ed328874747ed5567e028e1079803f67e85b

SHA512
ee479f4e8efa41433744138cc391d601e8f6a9ee3843e1014d450377ee64598f8281d4afd12692041bc11b2dc0cccb965a93b3151ef7d22801fd4173826c2e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7c9d80a9dab42e11c4942b4d66d77d8

SHA1
0ce4e2b95ced0f82cb2208c2c45b5e89445b4dff

SHA256
5c15ce1bffdafe125169fb15c5c969855977ff94a8a2e26e20f606aa7cb2d570

SHA512
24afd06b3ea9c2beca32e93222dce0dd15c2569568a9eadd4e1456fcd4b88858aa3432f0d6d4a196ca38aba6116e9aa598ea24981a6100b1043893a64af6d0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cfa01393361c119de817714e4576cd9

SHA1
0d59491b2a05dca72f8953e1d164394cd54abf59

SHA256
3f8a6bdc6962fa548f6d455bc8314b6c8cf087459052d265c8ca4134ff14adc3

SHA512
017e7017465e0939e360e8d11a620c8ceddda616ef26ccf629623e1bd62302146e877f7dc7a411ec417957bfacb32ad028109f4951a240e114458b50e0e9b420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb1afbe3068d87f56ab695bebda5d77e

SHA1
53ad46a0f1b0a4ed384dffd46e17d6333e1d1378

SHA256
1f7cc9db98bdb8839064a1377b5324289b2d6acdc3ba7bff9e350727be8a2f12

SHA512
d2cd43c3af8faa146a304658cf61f854afd8a1b6f040096703e1a585d1827c1ffbb564ab73fa224fcbac9fa2ff1201db75ff2faa0855df21e47c0c7854e6899a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3672.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit