88711a9c4e8add006d9aeed10d03d820fb38bacec7c7618a35bb88c40fddf610

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b496069f597824892f088f4686505ae0_JaffaCakes118.html
Size

228KB
MD5

b496069f597824892f088f4686505ae0
SHA1

5343cade3c89d0f7d1690fe3663df048c120589f
SHA256

88711a9c4e8add006d9aeed10d03d820fb38bacec7c7618a35bb88c40fddf610
SHA512

d2478f18ac1a2f1c2e89b1ef19f365452e3ce64a61c48f7b4a1ccad97fb9305abf2f7d1b921d675cfbec02f5835a1da52ff9b2d70c0d188ca0d907175aed5bae
SSDEEP

3072:gyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:dsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF423211-2C0E-11EF-AC6D-CE8752B95906} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424724574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000002fe9c481f3499cedfa94d174cd7894b60324a8b6eeb216e213323928956ce6f6000000000e80000000020000200000001ace938cd54e05bee9e2a8dcdd205e4e7ceb8e2f135976e33b58f5085064a3f7200000006bd2e8a1221c1787f9d4fa698b9cbbcc514caf351f036270b0baee70c6844a6f400000009de7c327a0f9e564b4f3dffd0e76f2518c51d8ba3e21bc1184b6ef87b75d3f24f849ffeef8bebeb1d9c3efd3821546cab2a9210200146ca90615562b23237a50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000099a4189f83220a7188e05aec65b90ecb24561b55d1fde41c6a2f13d09f49a85b000000000e8000000002000020000000e8c684ae1854cf8528a6555d009842496699aeabe64da92e1a538a073187b87e90000000cfc93826dde901efa887226137ba97728c8510a2d05897089ebb8d67a914b1fc07ebc496226d3532088d305ea2ca0502892b1dc6ed0e9e8c71aaa71d82607e39a458e755d0c70e58234e4cf733b202f1e2f1126883d32b84bd3346ff5d7c5f8db31e4f37aa951f956bb7222a4ed5ecde0c8912c7ba8ceeac369953855472a99ffabbce9af2c736970320c71d7cd59bf3400000007b623114d33073c9c28afd5f9061d41004a28a80ad6044debc19509bc470203dccee408de481a52536a87c92537ff7a4ed6178e3f17229f7e35ff967ce2b1df2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1004c9831bc0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2252	2016	iexplore.exe	28
PID 2016 wrote to memory of 2252	2016	iexplore.exe	28
PID 2016 wrote to memory of 2252	2016	iexplore.exe	28
PID 2016 wrote to memory of 2252	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b496069f597824892f088f4686505ae0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6933fe71f29a3be4b01d9923a3d5cf9

SHA1
d817573b1a6c9c0de6f71215a1b207c280ebd5f2

SHA256
6990a2b5d781f41db4d91bbd561a5ae8575051fee84a6f46df7bc508e404e2af

SHA512
3e3b0a67674f9fb0d5b86850e2745b1dfbd158bc5970d8b451fa8e3acafc17dbb2c3e99bc68703f39137bd3e850224a48b3f9b14a947d55aaaecc6aab2199b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31bdf529d6ef38cda1d5078adf8bf90f

SHA1
385b075f1fe68e24318001936fec776eaffaf8f7

SHA256
610beaef4316a9cf2d9ca47a9ae752e8f03f0d092272cf8d74c79bae9b0c35b1

SHA512
1e7ec41b6d4152274476249a24f3673780f0e28fb313b30f60351b5a517f57d1231148c619fc28c6732d30f138f20c3e6b4dfe53f4941dc2a3d18ded2f36ec74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5028dc53b828555e5c4d7bdabb68347

SHA1
f312a5fd74a2da269c909c5e0b863e59cb1dda98

SHA256
f7377689a21192351423778da9cd7c33fb0890d7515bae8207e42b5372bc8ed9

SHA512
cf62d6fea15e56f65fcc79e76fbd9f5f657a284bf95538d070ec8cf9d1243a2af5525b1ff14063cb82a4efc077cc14c153a885c69383b8509c85eac47a262808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e6b77ec3c674d7054597b0242072826

SHA1
2a7990503ca1667d1291cc396ddf91d87fff39d0

SHA256
64fda9a0bb0b55b6b2cbb132eb42a2bf66976785d5c5b84220754ff4ef968697

SHA512
01c4a10d10c1f1aa9e301a3a9fcb101d5c2bc1d4abfd430823cc166eb1d2cc97ac7df57c9d828ce5c16da1b6e53862bb18e99e3c9276ca8eeebcde398d5afe00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9702956d2a95a337a14a1fa0feceb447

SHA1
8af6ffab53f26ebce3b5cf3f68ba5b4f7980e5c7

SHA256
cd04b668192e456cef117ade1f227d5f013a2ebf555500f8d770efc687780797

SHA512
6de6f6fda06ce9542a6e370bb7abcf484a59a0bd47ed8ea561a068ceafcc0e9b4f76ae4a725d828eb5d7bc469591a1fcc3bb3a00cb8a52bdc717f40ca520fb3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c75f0c451c414e874bf2f8643e772d05

SHA1
0417454602b94251b5b78961036ac79b46cc050e

SHA256
8ea443dc193001ab457a310730b14544e342c6c57e5f844e8670c5edde8760c9

SHA512
438c0c4779d9e7a30ff0fbb8a0b27e1527b8fbf62ae19a24611254b85a0f29a1c4a686215ad48f3c240e20eba3b8f184a6aca885fe37b887955c308f8074b4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70e1f49a7d1f50dceef6c5a456e74bc8

SHA1
90cd4aa14631afd0d9dcd44e50a2a0960dddeb59

SHA256
701ee44bddab4e653d010b5c2fd5690df351403b6ba62a6dd467bda4d7f2027f

SHA512
9f89c2d5dd7822a747c648ed75c0f8a026b58ef2e1ab017fda4c9ba6f5b2fd4ba21da87559a5f2dcf2db0e4ed952006a32f961c10675ee383bd46d779e85a64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
528eef9c647bb554198e68579da7a8a0

SHA1
f0b888c2812323cccefe5c9add955eec68123397

SHA256
7adf92d420f7f915bdbf23661e0598826ca919224097c7adff109b185a354d5b

SHA512
692b2478e75d1c7edee83e0fb2e977460ad520b7a17643aae3522e4746aab7dce96448c1abda85b2aebf67fc769470af22846ec849226b1bbe130082b4cf21ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3569c784a7447e0cce66a1fe7146fba2

SHA1
e6e5fef72399d15479fd6d0278a859dec04c0f6d

SHA256
5d864d0d41a13daf303158422610136442fe7173085f5291bdf9328523e30274

SHA512
24d75d02919e44ff82da6fa9e70e56eef72483ccd0ef84937bc3dad7d0acf19e0216d9c11d50f68b5391b0cc42eb1b1569edef85b28d1de72b044e968030f0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4e29a1a7c1f26d8c7dac304e5f889f3

SHA1
c3a73d7a2b0610aa741b17ee039316871708df5d

SHA256
20d3198063cd9c2cf4d89abc78845dc575dccd4e3b979c6ff85fc65f232eae1c

SHA512
79459fc8285c058a29e723ba39acbe714be1af9c4268e567aa6cfde7d9eecac2b4bc3f37574c693e8bbfec79ca634968e8d362cbdfda68c6574146816b58e2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192a490f0dd5902dec3fbf6c4147fd28

SHA1
ff4caf3a2ca1a322114785b7ed79b179e334739b

SHA256
1cde436661228a3e4e83c6ed8e1f03da7de7847ea372d5fc26e33deab46bd440

SHA512
43af7924e21482b34d34519ce038d22e155208b07cc82ee8ed07049e9bb0cb832571935259b80db404b7fb79d76ee4a988e4c1f5b074cf9db9f85af7855ce080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d822c9d0d352e87132cdd13bb9bc4b5e

SHA1
71e9d6423feb8039a982da953032aa4a3d57adba

SHA256
33cbf6f5f77faf3b46df840bdc32e4039f741c1d24d6e7e1a507477f8762b35d

SHA512
5135707c27d6582f82064890f4fa6d9562c87ec763c43ae60874b7e6b8183b9a4544bb95678d00a50d1ed6a00995bd2cc6e2f0c9ce9d6671560b6e9f6ad362d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48823ce0a116485513ad34eef42c4b01

SHA1
e7c2a31c544a0797cf29398ceda3fb4222557af7

SHA256
292b867c43452e3d0f65ed6b39bb21c629b73a2bb55b365ece3b2c8403084b81

SHA512
288ddcb8c034cc20e339493c26d8308c377840cf8161b3ce088e496b57e9210113bf348f844696968d117b1d291a9edc2a77e228f6aa1f5baed991132974ff48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0ca6e348268147d1fec70062bea491

SHA1
187a7cf1b0a46e6518cb84b38df357ea83dd8401

SHA256
45e8f9fc3438de3707db7266cd7e678869da41425b6b83e759b540940058e28a

SHA512
cfafa5aef2b4a279fdd3aaebd91450ecd7e302c32db7d21a1a38aba86729d15bf547b8d85e8ab13e13a1b6fe740cf79d2c869237c530f83b67f7a07c66191671

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BD4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D8C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit