e8aa94e02f56ff409e8d5a917785b9377cee24558e026f95c50d0a4cf6b1295e

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b10796bc3e398bda45f4bb0d587ade49_JaffaCakes118.html
Size

29KB
MD5

b10796bc3e398bda45f4bb0d587ade49
SHA1

6f19a8c31388737821ac40e5d4347fce0fb5d8db
SHA256

e8aa94e02f56ff409e8d5a917785b9377cee24558e026f95c50d0a4cf6b1295e
SHA512

a08c24ca20cd9c333d2388b9b465a987ed99bc36f0a9589bacd8e819c4a934447a6ce677a864c335808556bcf851070f98f58edbff2b9940d3151eeccc9e2da4
SSDEEP

768:KNFn3+u/Bbbadjgv3W1TX6cMN6qPD59hStqMNu:gn3zbbadjgv3yTX6cmPD59hStpNu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000042f9becc8b83569704202d5e03b1d563b0993ea3800c27cea21ece1f742fb8f5000000000e8000000002000020000000e8adc837e8aee05c1fd336a876bee2d435cef0db5947b137c4bc75a112306c3b90000000b5c6fa140713c27460f4b58b1be27c9ea81ee23c2d196c13ebd170393241d12d12228e26ba2365c57945e28dc2cc6ca85d796885cb2aa9ea6c2933a59f8eb7fb72b02fab1e035e35ceb36421060485128024bf57c3f9e16adc8d1033260038d487e19cc69cba480d627fc84252d0c7f0d9d38657ab4557f468d32329d88bf17f9439aa7dcd026ca3eb0447321dab623140000000b3ebf844234bc2c20082cb1a192398913a3608ac46e0970873726dd5089bb087c519cf5e07bfdf9c8227afb66c55c6d8406ce9cf818f9d09302d54bce35afba7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ebc65789bfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424661792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81B52C41-2B7C-11EF-AB3F-D2DB9F9EC2A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000e7727232c5a7f0510b355d1d73837e64f491c856785e982adbc2c803380630c4000000000e80000000020000200000005ff32bb5875c6a3e1d81586a85fb7e3320f7288411ab75b6bb929d67d34915ee20000000a54bb828ec98f24565944cc050d6b311ceb94e64c884c34e30043caaacc1121c40000000f082444e085c2b26b05e68f1cda65d585ebf27ad61fd17d882f3ab5bf10cad4ecceeeb8919541d6e9610221a24f204261f6e4b6edb42ba34acfded69c1e6ff44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2712	2516	iexplore.exe	28
PID 2516 wrote to memory of 2712	2516	iexplore.exe	28
PID 2516 wrote to memory of 2712	2516	iexplore.exe	28
PID 2516 wrote to memory of 2712	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b10796bc3e398bda45f4bb0d587ade49_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e1528fd24dfb3b2b5fb327d903d709a

SHA1
d10a521236dc0aa67953df3af07cc25010785cf2

SHA256
f6c4acdd74914e679e3bd5c277b155e7eee658d53cfc50bf8e88a02fc2b1acf8

SHA512
7a466f70e0ebc5e600d6e6e4d7926b2dc55dd9b85bfd7912f543dcd5f213e50d9157a4993841b699075a95b3e0f848de80052eaba77eee91641e30d6f9ae9987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c07d2a13de367fcaa912229a11d2891

SHA1
b7416adbb736e805e878ca445444e032ea6fad97

SHA256
4875d8a3e69e42057570085a73e162619914bd303ee51e8807c86014e8e2c57f

SHA512
4379a63f8b14db7a085df4d737356593707aef4c418d7d8435d53ec486b590b1d6fba66a9e65784d763e5a220964d721018b112ec2017110ef415b81115aff4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0179fea69783cd8970993c9d3f08d04

SHA1
7f9c4bffe6384295570e9a85ab75db9c34cad150

SHA256
007d4ff2b99fd3085ab680dcc4f23aa4d3c18b1bcf727be640e3b3b95e96a19f

SHA512
51e6027ff8ee3fb090017c355e055b0879c73284de5e5c7ac423c5bfb664048bad6a3c9f320453290569f1fb3d7dce6768dad5990d8c18687936c08a7089ceb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50572bd3fb1801e6fcf1be4b06cd2859

SHA1
1558e3963b90d7cf2292887f20fac6d23b3f52b2

SHA256
9d0700b158f500646bd95ff91790a6915392da7b5e71c364603067c463e5950c

SHA512
fbca7febec7d9df87ca0e0e55fdd48c776bcd118ed0824bf4652b376f24cb97e2e2efe6ca5389ec55ff770d5c6e8d67418a1490b6bf659f3e00be79005b63477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
147c4fb808e1ad5123eecfa0e9810e82

SHA1
de871a0a192bfaae6f84923210b68c27d7fe3dc1

SHA256
9d0d770f855553641013fa4b91915c23a009b348127f656655f8490359697757

SHA512
16e5028512edb84d3c6a3ac6a8ec36482234468605155debc41b8057142f051fb5295fbe6283b0f3be71539465c973ea71890704e937f8a0e65a1277f72a84ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1899a593289c4cad067071f40148dfe

SHA1
f1457a2d3bbaae36ca3e13b16fd6fd260b3e68ea

SHA256
3ee52a3a7c56aebda93c721ebdc1d8fde5cf111a9535d7431d3ccf713927f409

SHA512
4571878b3d7e0970590ee1072c2cd57f385d515d8e79f3fd6639d5cdd0e8659533f10451a68563a705648d5b740f6128979f8de8d0ea51a730521efa81e1fcd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bdf7ea01e6c8b096efc8d61b6228776

SHA1
65d7e6b33d5383688429856d4a7a49d183b6bdb9

SHA256
5010404b89423ff756bc01bbebb55840acb517e000dbfb5a00870ce39f3da1dc

SHA512
31159cee409a0086552915e4d7b2ecd2fb6a098492e0e74f913371ba082541e9eefb44f4c5a3096009bcd67686056d1594e34291fe20b10da4edc2264f3e89d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18527033900508b97360b8fc9cb3a149

SHA1
9d519d93b8776646c20016bb7edf9887527df72b

SHA256
2e7d4c563d1ec4d4d35b159ff2d0bab4f0a2b9394319869d8e23aa74889dccd4

SHA512
35aa2d10a4c64ad33480559dad27a5b8c7f1752511136a9fa4852e7ec753d72f51ceaa4a7722bf5ca6adcda9c15b8de71b2438e1cdca518aa0e2b710903413b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
910aeea27b10422095219c060c587356

SHA1
e6d9245344611b4147fb61a18ef43a07d2d6d2af

SHA256
6f8f0844ad1ea158a7fb3d6d03a97d7d67a7058dd1254b17508d8e7fb41eac79

SHA512
dedaabca5408549253d7d4f22ae3cb36e6d4f96ea9003269d29af2f61294d9f940a4889fdb6d8b8b110615f865e196dd4aed3ee96d7e3cfdb9326a2fe9110c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55d10b2df6bf72dacdf2e31af019b307

SHA1
86c5d2d294fffab13cb7f5ddfe7fa8d81fc9d070

SHA256
bb44203a65a586f100b5ca256b62ee8be95b846c2de7346f88f977819225878d

SHA512
f34433c8f457c7cb03381b20c20e0260228de6b1a0deabba0451ea5b38f0de301421abc68210937022834729b130f9ed8dfb6e76b216f209355d90e49de659f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c31fc9f3dc796a3d05b1aa3c4529ff5

SHA1
230d64be867f42397e515b1b481d96de3ec9673f

SHA256
cb91b2f2a6a8bf7612e45545fa8a4e73dc236e9163e8d9ef0441dae8468f13d9

SHA512
b2cd52fbe903304ae05d437954bb834b49fd7e55ebcbec1854fd1f0991dc6f20d329620dc02be498123261d3bd83555ad236877e7d7c14d5e8340bdcaafd28e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f820ff73969c212644a6fad5deb5c68

SHA1
4e8fbfe4695aa77f7bb7d8401b46abbd6236faf3

SHA256
5dda1ba477553760ae1b39c613dbf85beefb1897dc27ae5f09f2b88193680f92

SHA512
c096b9b83a36f92bc5b44be8b19475d4a78feac568bc7af9bf38e6e309127dc63186773163ba189cb10fadb80aabf486aab9823280d41cc72a3f7b4a4139e967

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF03.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit