9cbd3d2eb2bfabf5a6a2d4b587e696ccea9792a156775f1895285f82e531f018

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b707712db74b514ecb534c6716c435c5_JaffaCakes118.html
Size

4KB
MD5

b707712db74b514ecb534c6716c435c5
SHA1

a9d8cf0f554bdca6e05b5c4dd046c35f83c2c0b3
SHA256

9cbd3d2eb2bfabf5a6a2d4b587e696ccea9792a156775f1895285f82e531f018
SHA512

b2f84743a08195f2000fb56027e2e0eba44148ef89baeae9c874ad20208cc5336093ef88bc01dd0bd043b6b2dad22f06277f1a2b2cf8247ca2819dc431763899
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o5O2rZnd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000005eb350e2e393c66364a0f44f8da8892fa748d4dad36a3041ec71e1b72ad7695b000000000e80000000020000200000003a550599b971d4637fd94272ca949ce5d0cbc4e817b6806ea33d15652a47e9a8200000006a50740b1045ff98aea7bf0b276ec83039d92b13b59ccb3ab3926f1bfda5e3ef400000005e123a780851bb69498154fd85981f085b6b87167693328c53549aaa28d0b846371919341819d0d4a7d9cb67197c4703531128addd5f9c392e19c936f4cfee09	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b6473179c0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000001c56eaabff83a5eddd77654cc6e472d9c62d6f0063bc580cfff4534bc5d15bc5000000000e8000000002000020000000e74a5db5a823a7730c5258a70518086d4a6f1903f044c893e80523210f7c2ba690000000793f077690970a30914884c19f99424cf66f0fe17c62a067d8355f7cddaec4095175732e6c54612b54de12812ccc47bccc609eaf1d3305ef16905763f38070a4c0fae90d6894079edcbcfb70d4c924c4532d84bc293b3eec27fd96c441129a7bb0203337e6266109170d62b4683fc69548497793c05726f1d985434fc2fe0ffc6f88131a14d7003010fe8daeec53305640000000977b61550071c7fb287f9f90c639125ff9c845160fde846bd8393b1bb77b9b9090f0e6467355b64f40d7fb527738117f7af828a1098b1feb795503bf055058bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424764807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C9F8131-2C6C-11EF-AC6D-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2252	1936	iexplore.exe	28
PID 1936 wrote to memory of 2252	1936	iexplore.exe	28
PID 1936 wrote to memory of 2252	1936	iexplore.exe	28
PID 1936 wrote to memory of 2252	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b707712db74b514ecb534c6716c435c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93984813cb4ab77302b6ec826469686

SHA1
24d51265ddaabfbaac9b5f041c695f5f61d2666a

SHA256
842debf1d407d2f9b0b24de1a80e85d237abf083dbd798bcb17c45c81e1649cc

SHA512
4f886f1306fe64e052f8d16db798bc70a7eedc2d32cd33f595278147c811233965a8fbd251b2102c34cbfc914ae81bf4944485ba831ca669adfe27dd3c39c53f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
684795c2225e82eca55909e72462d4cd

SHA1
b46071a04dec512891ed53e7207fe42e7970bdd8

SHA256
e522ce0396f59d571c8fe605c6bb8464b8d7dda89ed0c9ddbe34d6bd1bc8e866

SHA512
a3336f80d5fe81b9c8a5054f21e3520b06136769b37fc3280e1883307a200b2c64210e0173e3cbebda3ddf18c8e719b3a703d453fa13b1843cb303fe73530bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1134b1fd1047e5beb7469c107865a9d

SHA1
d0abe5a38eb2849b91f1a030f117e5f7cf56289a

SHA256
72c259c00acbd12866bdd3ca4cc245e73f261104f94c81995bc183db8c534049

SHA512
ed2f39ba85d875ceca431a37b57b546f138104aa2b83c604d967f5750dd063a68bdad38ac8812576efacd8c0a3ee82282b759061562328bf93d9101179ddf140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e19e766c2f68068d128818b84314e54

SHA1
20fa159ed6f3a9d9f0f93d9848da59869dddaa22

SHA256
c61d2053fa65f90af2b6a3092d50e8c6864912bf709eee8c7685838fe313b726

SHA512
19754e5f176b2aa7629ebe83d99f25f167402e390cdb388da42e2492da169de31361979298430eff3070dbbb3d38557c84d59c2afd4fda3a591904be5e1b46c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
687c129803ba9daf95b91708efb49645

SHA1
5e98199047ca6cfdb43b1555bf6b971a82c7d37c

SHA256
2ce7ccca4605623d55b83c4a2bc329e05b12fa63bb9e315298f91e25ff3f07f6

SHA512
4de0defe347862ef7584ab794c384dda3ff1e26c250b0611dd0cdcf25b827c8dc4d05c55ba9644fc9f0cde0ffbb55ea43892cc10aa8687ba4812c4d15fa070e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09a2f29f9cda27abcede80e0fce75b5a

SHA1
c8306361f27e6ec2d854353f1438ddbd77a5966c

SHA256
bb0417d804a68b554865b86a169d0557f550e4527e02ba2d86cde8bc8c6f620a

SHA512
bc8571e9b46946186d5ee7eac843d70b5b43f6d4900e5395ac333a192c859e34bbebc92ab9c3abb2886afd3f3f6dbabc349eda39bb302f0961b07c0a62ab27b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1beac18bed24fa992f389824431b1a0a

SHA1
997dc29e6ec8a84bd85c33ca841694aefafb330f

SHA256
f1f1eeafa18525120b103f46411926bec7bbce163d8415658d53a4c80e66aa12

SHA512
978e86488476fad7f872ab930004a323b4693bb5f625bea33a32f331c346e1c66bc51b5e90c41ab792e85cbd2e5ec5b3c7e0694f4411095619d24dc01c314e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
568b1e9468cbcca171c49f01d4be9708

SHA1
767c7bd2cd1c304544d2c1608c76365e108a4a38

SHA256
19696c9c0c6203e0335f5607e8a19746a88983905de9cd5036fb36acd00528b3

SHA512
25faab40604f44ef96481b30623e99d0da0c6e7d7466803c9b534d0b67ae4ab9cc12abd1c9fd99a5db92e8326a34d5c57b5cd05d8efeec269836314212b82dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44331af2fff541c39b6a7c7c94f120e3

SHA1
e63e98b31d90e1ba379c7673845d1d9d2be5753b

SHA256
c89d2c9e5988a2faad5400b0727ac91d3e3cb620586f0e289efbb2660cc62454

SHA512
7f1069c23e9eb48e57f813f969ba647b7a2eac01d0ab46b08649019186ee4bf056b5dfc4db2da64c97c81a60990b0fcd0039b081cfe2d010177aa05233acc564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffd47eaa5cf852dc19aa0ac8866cda35

SHA1
4e12e9934ba54e6e1e9fa798e08311adfbec357c

SHA256
f6856e3112d1def033a2fdd73a5c30faabcc47ca0b686d12fff14da0ed09994e

SHA512
bece9913f75c2dead45f8ee169a900fa03aab94631fb9bcce087af61c2315e3c28080913053d3d332a26b059167e7859af89cb30772e204acf5f80a753ad5e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b03953967751253b7da469ba2735b2f

SHA1
4b3bb5b8b14796e990ce21ba5301cc659e803d0e

SHA256
76fa7659678b2af28665c3b2f0a3840407cb87b287ebd3bea4aec5695bddb0d8

SHA512
c7adf40b34c7c3c10b7e59475e2c4dbeae46bde47a47c2a9a7433d7e9759df2c8c30417a0e23374be780ad28f6ef090741a3cf847cb6b0152860969dc783769b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12cd775fa432b3970f4c0ed837bf5ca6

SHA1
44c3af036ac5622be0ef47ac13e47ce3adeb7335

SHA256
d84ba57c524c0d8708be8590325b01aca9c9c71b0e99b7566ec0b1ffc96193c4

SHA512
46006c4f6aedf4ba0d802997023e80c2943a233d7a8cca799356748b8f774605c24bf76e4474ce1ee2158cf26d5349897f64366990be0ab5f5b2bd6fd82f1c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eec81b8b0149985d5a8f886df196bdaf

SHA1
6d199db98e0ab9a8cc09cf4c6495c1865df3220b

SHA256
28654269744dfca4601de83b20ef214e597b9afd93fd4bff4e45778aa0c4d2cb

SHA512
6599c2858ce530ae22a67daeaf5802c89657452dde9dbc8d62507a9bf4d02a2db034d37a39c7585be25ffd0fb791d32b4c51dc885e2d3c578e3fdc71bcfd8e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B66.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit