cde9338f8a2c1c9ae37f57a624e61991ac275f75d670497ad7719873227e97f2

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0dd1c8aeb9676b309b36acebf9b7f70_JaffaCakes118.html
Size

211KB
MD5

b0dd1c8aeb9676b309b36acebf9b7f70
SHA1

ac40b615818a37fb0fd734e33e093468c28470cf
SHA256

cde9338f8a2c1c9ae37f57a624e61991ac275f75d670497ad7719873227e97f2
SHA512

70284b77ba660bb98edb505695be1238ee9bd5e619aeb1ad05844adca22b0932f2ae3ab423ab2c10bbffffc85748b1b4b9fd6888cc4444fd5ec87c1a7522001c
SSDEEP

6144:/ft3ezDSPImqSUlMSKC5fFqln4oza/zA0Y9dQUAR:3t3ezYImHnSKC5fFqln4oza/zA0Y9dQT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b079f7fd486ea8cdda918f6bda164a241b305605dff49a23790b7a56f1278523000000000e8000000002000020000000bc8a6b73e927b5d75f8506e6338db169825334637ae786d6d91c4d88146499fe9000000012bf5367cc58040b916530064e1545c34362b22c0024e13b4511291e2eefb9f117c04d592f2f5287b234a91cb688aee02c17508c0bd9b4375d141447f2dd9cdf8409d80a009fd1953beebedcfccd7b642badea85ebd8dde9e32c6990499ef82a66c32284f25b4ccb4b595bb9f4b986f08f3e6bde446b83aad85fe8b0828ddf8992efd3b1f3d54f654292b072f02bfced4000000060157f747cef6918a2a23e6d1676da709c7d1cc0bc91b9b1a85e468cc039f8730c7829bdcb27742df27cefb776cdb8e7b2ad2c46b575810e802e6b248af09abf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c99d0183bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{278ED4B1-2B76-11EF-A3C1-4A2B752F9250} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424659065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008fd46e10dfcf43a40d2cb14d6ace926d0ef31ec892fa073748b12e1174a7bdfa000000000e8000000002000020000000a957ea2c849083c207fd077f86bb3ce798a3c157386b3a23c1943ef80aa5a6052000000033a5ec2d7e20d4c7c090daa7622dcaf35eccfc1d06f9364705e0d5567c9b0f92400000003e1b2894bee82b155b9054c5528a10dad3621d75f9e1226515dc80af262b53876851267739dace296fcbf69377da9d0db312137d3e3a1cfd9920b47384f2ced5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28
PID 2104 wrote to memory of 2144	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0dd1c8aeb9676b309b36acebf9b7f70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

Filesize
2KB

MD5
818482961d2547a8bf3c30df557b1a7b

SHA1
84e5750a0fc823a8b8cd5d1869a5e706320cc6dd

SHA256
ed4decaeffe67498d499b84626466b2d981fc40311bd9cfa05b24ced28ebb7fb

SHA512
c499070ed48a80a3453a40aabaf08624a28f24ac4a97bdc99d499c80b4d24f818407d7e639a977187e53aa592f18de7d692710b822fde9adbafa72c4e8003924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
1KB

MD5
285ec909c4ab0d2d57f5086b225799aa

SHA1
d89e3bd43d5d909b47a18977aa9d5ce36cee184c

SHA256
68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b

SHA512
4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

Filesize
488B

MD5
ffe3c88e67548e39761e43c6743dfc52

SHA1
e581e0893e399c4250ed0f5bdbb7623fec770b51

SHA256
51d01a466168237c89af5b185dc6eacd103dbdd4dc9d78105bd9a67e7aa24fbe

SHA512
bf04f9693a3ed3ebec88a593903d3dc30591411746b87686c533768a43d64190b9a3813942aa4e2aa7ea19d430949d1a26f5c9b0ccca1ec97a356ac82a646198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a6b66c331b45862d80e6d35ee746bf3

SHA1
9521cab487a46b8104c93da1654fb3e6ffa586cb

SHA256
99a85cfe48295e6eaad3237a89a4282569c786a7c45aef7f298aa28256482874

SHA512
f408a8660f93501a08a0ec10bc85327c24fef21c3b24352f0d53ffb92d7db0629448ae1f492afb6c3b33602066b0021c238c505a8d9aa530b585bace13490bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97fbc720b38d6985281fced8208134fe

SHA1
971257d236fe20af73038a396120150cd88d18a6

SHA256
01e87a2a6a7a9608f88e6031601efd60b7b6c9d4d84f9884a14384eeb984d720

SHA512
5aec9c3c18196508eae926a1682823523389719e0ff7a8a5a9cc167cf323596b805a197dc9fb34adea5b42b59a99d9a973952e50222012369bb7ca87905153db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61b3dedf481569a2267d46893d41358

SHA1
67c775f774ef991d841f63f154839f83bf774e94

SHA256
31396364bc123a9e2d37a4f68a3ad9b346dbdc21145fa7391b3613360cc95049

SHA512
b89573188e4eecd73beddfbfaa72360f06162ddf4c23a5aa844bc701cfccc58203249d6946ce840a469520bc1c0d4bb8d16d1953de7656f1366704b5afaeddb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d0fc3cf2fa22c5e991a3ee778d249e

SHA1
24b7690dede75cb8a3ac4ef8bf96b16af0b206c8

SHA256
44cfc8523c1f1c5360f8d70352bc615385845da542564020c6f8221113521af7

SHA512
cb8a724dddc31647ccb5653c91d24d250fd8ad75ef4d5dbdad57b756f3d77b0cc968d26a69d9c4b5bec89b5369e7fb7f93ac64ef4427676954a760f18bb0545c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
306B

MD5
d8e2e55069d0d41a9b6f074e7090613a

SHA1
804b7e47247a070b53acf6d5194b029efc76327e

SHA256
536776d33affd7a68ed391513bd0a014b1ac029d02272cd8ca21db6a17fc9e72

SHA512
bb5c6bf13bd807c1de161b2c249d3e0cecd0ebf5236b0e02d2c33f8b099a625fa92c46287800cb2e0b8f7a18098f7c888eb14edb2e4a280640a43968eb209807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
306B

MD5
b9838bf8aa5ed8b565f5ef7ac81c604e

SHA1
d2cdb8b1c671b4986f8ef7a5f3ab9d706777e1a1

SHA256
90053be4496b3f30248c55371ca2342ed66352dbd415992c6f5c3a7545680d37

SHA512
a44596debdcf5c43d32bf4690565af704125249ccab4cc56806543ac4bf4c620770f4dd32dda80693296a32acccea4e0c92c3a38208b41e33258e4c7c4e0fd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\9[1].gif

Filesize
42B

MD5
b4682377ddfbe4e7dabfddb2e543e842

SHA1
328e472721a93345801ed5533240eac2d1f8498c

SHA256
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

SHA512
202612457d9042fe853daab3ddcc1f0f960c5ffdbe8462fa435713e4d1d85ff0c3f197daf8dba15bda9f5266d7e1f9ecaeee045cbc156a4892d2f931fe6fa1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FEB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar808A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit