dea37565673159dea664b89c7b5ead82c4c1f6f4310a416b6aade78f7dc8b799

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00c72f1856775ca8a8c2cd3665474b29_JaffaCakes118.html
Size

12KB
MD5

00c72f1856775ca8a8c2cd3665474b29
SHA1

29bc66e9150f5abaa2b0d46be2f6c71e52e7dab5
SHA256

dea37565673159dea664b89c7b5ead82c4c1f6f4310a416b6aade78f7dc8b799
SHA512

9395e10c6c3d21a7c7c8608c33028d27236713e8bee0d594ba12db0da88150bf1d24eee285d9bb469748a57daf9b2a5a122689e6e494e42e4dcf95b677e9be65
SSDEEP

192:waQdVIIB/xf6q5zDdPjiV25fyi5f8zbLTY:atJ6GHdPWufyi5f8zbLE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007e6c7bcddc28b60964f85de20e3c932b6833d5674479235a2ff0992d0d6ad66c000000000e8000000002000020000000621e1da6cb66fbdd5d74cbbd378cf7274b9dea463116e7d90bb10908ada3448090000000711a33767479ca5cb57c59ca85ed515b32a43a988b37875d4593556b5e78193b38313bdcda12619914986748b29c7ed74bdff7b46b1870b77b9c0a3e7c667add5e86870efeacb4afc9bfa8197b353cd9b279eeeeb894e9bb787a27a35277f9cf467337a19921a15c808b808ce45e5252b7ce89c7089ab7834c2b911b5a968f9688d26028c429f4f85bd4cba1be5e170b400000009a9290ea366ac446873b4c320a7da296bc6a21cef86f8b2845d0fd07ceb5fa7bca07164483cd54e6a9d14263e4815760911b814913d710467b018fa9a3488d5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000009da9d837f615816b759f4a7ddcdecc4e5b26eed20d75be2151295c7881f3f9a4000000000e80000000020000200000005637ee7862c4fc8d970714302fa7056a269c8635d856cc6b09486fc23141f4db20000000c02eeb09dcdf8b27eb7182a9e4d59b3869899bc04586c9f16c1027b8ac9406b740000000a2af2250aeb92d16da05b724f81cc3a498b7fde8b7086fd870f0b1b41894431caef0d435c8a9eff9b99c23504859baab9ab0ef98236c8873fe2fe67dece30795	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25528651-2E88-11EF-917B-C299D158824A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907574fc94c2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424996644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1096	2916	iexplore.exe	28
PID 2916 wrote to memory of 1096	2916	iexplore.exe	28
PID 2916 wrote to memory of 1096	2916	iexplore.exe	28
PID 2916 wrote to memory of 1096	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00c72f1856775ca8a8c2cd3665474b29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
940e4bf661484f9ea9675d7744ad5760

SHA1
902d274ced60919de9eda70a28dbab0fbf44264a

SHA256
981a14b3cd4d93fa8593b95ebbbdabcfafccb524791c1b1a63a1411490802e7c

SHA512
5c9ae5269d8d2436096dd83f20b377cb1fdfe5420184a9e67e7dee9aa068474259b36f6f1e143d81e84b9b2ec8a7b87ec62625c9566ac7e044842728525f2343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca42b89e8089e45b8c8bd96101bf5466

SHA1
94473ba6a99abc277313c779e8523b5419e6f908

SHA256
7d8b509055fcda6e340bf6d21e8564fdaf51a28067bc3d57ae86eab52f30f8db

SHA512
28aa913be2b9648c9129ff53bb64959e59c842338dc8d1cb08f7dedee55c434e74e8fab545a43582af8df74e22bd0fc67d15c1f5b4cef2a35e9331618748e2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
619784b14f9e21e2f870989c22bcd678

SHA1
de13ff2298092f5ce038e466ff64a00a04081ee1

SHA256
1188cb3afd10ce62b37a36f74b7b258a2522f9677e6457cb3775f7b8672cef5a

SHA512
bdfd681bfd1de70daa89ecf1c18e7a8f37c98b82351d246da05173d75a1e571e16ffaf38829e920d61dc29b065317183af193e4ee0ac7b4d470808c2f4d515e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce64d4fe40898045ef6958a15a10b2a1

SHA1
d0473ffe5a883ce9b2d36b45fc2c8554ac2edc71

SHA256
8ee02b40fe32b0b036af0585d5818e4a86213413caa23c3a2a8b8a7508a94e64

SHA512
220c186077a324225b0440d987a2a171e1c58bdb9bb01f3a9da5ca9c6cf8ef4f7d9a589d9eda58ed5ed223f6d2250e284ba052cad5a2435268aaaf8bd00f428c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4adf56e9092be9f4a4ae0c4986dced0a

SHA1
b410e96b90c1d57d3f067260b310b86c4d5eca59

SHA256
72a0dabbbd1718a7d5c9598ccf78f3ce36d6497014a2f8000b32e0e0775e88ec

SHA512
801bf74c8b915988fa8a8962f0c71515a2d214c5ba77dbed4e94d8d0f848b1f76a91c14b6b95458b0733e52c5427eedf64093b2b645442eb4db27c4943613b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8118ed6e39f031b2fb89834604a8c103

SHA1
210b3b2fc4e195ebb742eb111892ea2a045d4648

SHA256
c4e1e414ad23d0b8482fc5be8feed0c49e68ccccf642b3ddea68ee3bc91590f5

SHA512
9d22f07bb63c3b21b5cbb9e634d29c53189a4d7fac10909a533500cc02844b3e77217ba2ef10dd5b0291d6a06c93349233a2782e67dd15c6a25e23b89cf10823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff26b02795ce70c8d9cfbae19676e54c

SHA1
7085d2694ab41391bbbead033853409bc45963ad

SHA256
a5b5a4fa749bb930e219f0926e980f0f7cc15cae219c1220168bc5cde5fb2dc4

SHA512
70589c9e47f0536ea59a9b0ddfccf1b3b1608c871ed1ce4ebc1bcc8e2c68d9670ba290006a0dbf1d94245407dc4ede900a90dc9c2320706f4ec099ffa2036b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b678543c47822ad45fd9a1437b6d9623

SHA1
00b0e5f3a78ee2453d78b6272d9c654f4b652078

SHA256
9aaf4d3ce5e06d2e6acc2dcc0711684c8784c2b3dfd558d3ae8bc88b7c735134

SHA512
a2d0980f9b418dc5c4eba6b9a25b1d3a6e378bc9383cc1fa29a39fe89a57cb7f2738905e438bf2dd2d23cd69eb4520bfc4d590a73160e923170884cbb19ac811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4843c0ec0f0ae126663cc079232673bf

SHA1
d036fe8ef865d70938f650c282df83ae46461ee5

SHA256
fa90aef71a36e0ce1a1881859e9316d234168cac759f1b1804245a27eacaa27f

SHA512
9d299a0206ffedb06c88609be520a68e9afafb0d60198940cd5250c6ac9170c2af0a068c7c21fcf8dab95c47de7040d3115fd8780bb36e1eb7294f253bffb32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cf57feb3ad6140d5fb76427b6402790

SHA1
6051bd5d025941799fdced10b2404e3ec14fd15a

SHA256
b2eb61c0d4bb1c03dbb0bccca718fb645cc13cd589559c387fa10dae32a7439e

SHA512
458fdd024880cec9a746667902e9123b16fbc4cda2e04e2e6206ad8dbbcff6175d53bfbcaa0e4254ad4b5de010433cd52ed403c4451b2c774b19721998fdb461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d21cc9fa0132f0fdbe9cb0ccf9319d

SHA1
ef40b5099a421e14e93228c93696875064176584

SHA256
a0c9ebbb86c4fd0c86aa276709e7c3fda62afe4036b84bee77ebbd7b46079c56

SHA512
90b2e68e681a27b9bd563ebfde008b756df7f1032c88dca84f9e7a36bdfc24781eb8787ea26120d0c46b04069ac6640f3cd03f3e1a6d66a443a0e6eef4fd72b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c258c8eb50f3eea3a43fdff3ebe63e30

SHA1
7c7ea8d493e1906e944bb8b02a9f826664d4e6ed

SHA256
e8ad73a2a49077862ed4d9d68707d962cb6fe42d2918c4858570d2889c7c1de4

SHA512
4e06c4d2c170b176d7513b435adeb545d9b67c930b6b959df58595a5106c4b1f4a7c08bcfce6f79cadc7cd6701f6bac1bc910cd85d59098b16a37d701b1679a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f508feffc4a398c39cd4aaaa62c88ad

SHA1
5b742b89d3ab378ca7541143e4b09a579f089d4c

SHA256
1f24eab05e62510f4d260235828a5b604eeb439b8bf7fafa607713368661e1ba

SHA512
d1861dbda4c5e0935f38306f4c4da85639d739e63e8d837d9cea41b381acd855025ab8586a859d09dcbecad94c7216c494ea79b64cef086bc7e4a29451c1b887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c09a6982ccec776bb9414fb41cb7e02

SHA1
3f6332b1384e77cdb0389ab68a72d50c6a67cfd9

SHA256
0475168981286f12a8e7dae0e5d33d56b43984ca90f89a673e0e19b3807ea7eb

SHA512
db9f10021c08cea3224c20a3d89819abe243c56d30ae23d05162ea05f6be114ed20e230b29c08aae2d574240f052a2824f4934bcef5cf58bee643ddb7762a834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34bfd1a8f43cbce79b5f84e8d8ea3e1b

SHA1
d7356e75ea855984ea6f2b9201bcea96d1024f3d

SHA256
722e678c4f35ee364b5428ab717559d982db5ee29c4e6392b9eaf810b197ceaf

SHA512
a5a37825863c4990991be44c3918332c7b67f0bb4998c4794fca71d80aa078a73a86b3f3f328f87d95c055fefc472d1ac9b171f988a3f9c7dcb1110a38c79d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28742d6e40f4dd7d1a4e8733af21efd5

SHA1
eade57f9b00bc346bbaa8a41496379c9273bdf53

SHA256
c9d533646b53790cc8bff11eee1114d668d0adf1c83590f340c8068d812acce0

SHA512
d54d9b8852bb7bbac0f9a816770b2c4abe719f7d8b29c5a00e29c4d4d2b0ef7666180ba7bc5dc0594f604ad4a34226f011a837f6dc4a0885c965ef34290d65ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC7D3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCB7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit