630487a227ff5a4f42660fac7bd963fbbea58db76382d5bb40940ee1c646326e

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

096272cfd8cb2cafc33635d752f629d1_JaffaCakes118.html
Size

88KB
MD5

096272cfd8cb2cafc33635d752f629d1
SHA1

cab3795cbb4e2ebef1a646c57039240f44f4dc1d
SHA256

630487a227ff5a4f42660fac7bd963fbbea58db76382d5bb40940ee1c646326e
SHA512

f7cc33c32c70a1955f62d67daf0e69c5dfa60eb7930c97290466f486f75e56b77f67700d9179ed560296948fbc7f801aedb6b54f9e1420a08efdf07ac919fbf5
SSDEEP

1536:RASZf2b803G0k61rHSeiMOC37RmVR85Gd18ImVHovdDq/fUBv2lhI:H/tb/gHcDq08lhI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a66d16ec9d0cd54eb8dec285e83ce75f00000000020000000000106600000001000020000000a9a79b3e8f6b61e2518690c58e13b743a3d4f0ab76839cc8029bbd9b3eb25598000000000e80000000020000200000005a98a69b1d3ae4cfe9c8c590640433a455acbfd2c6e1b98cb5e1a07002990fe790000000bf480838d26a467250051763c37a8b168124b420e1d0894cc537d180b2cea4aa505fe44376e5be9fbc5c23592ae4d9ed2dbd7ce985d50b0d50abb831552e587d08a17aeda139beddd12e935da553c6515cc0a17e479ea0667e49df5e93445ad1a3b15eae8593a9162dd3bf70baf3fbe29c59bbffdac69cd486e67eccb3ef9e64cc5d96c19e2a76e423564004ff0617ad4000000058f8f306a140faded6f92fff7ddc14eb07189be2131f59c9db6dc2148be15051794671c8d0a2f63e474198318079f4057996d81ced303c1c16558df0e967f9d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39631FE1-3240-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a66d16ec9d0cd54eb8dec285e83ce75f000000000200000000001066000000010000200000004bb2d27b0153031e2e4e029213b87c35c07e0836aa67f1ee22bd5310f153fb7c000000000e800000000200002000000052721f27ee05861c35d9f2a7f88014ac407036f98e008d71ae8d190442fbc5232000000039e631b986f4ed6b7e2d6651efe782021b42845e448aeed03d083de86c21b81740000000276a83e82591a17707b7a800cb141b5dfe1f8e3a46791be9bb875fe21c2045b975965a38327ec9cd4c9da3a295cdca33c7992c3b0d702671ba20c149d19cfd18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1022340e4dc6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425405564"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28
PID 1984 wrote to memory of 2660	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\096272cfd8cb2cafc33635d752f629d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d01e99b72362f11d16a1303a5db1e23

SHA1
13a69ca9206c6755d0c5cd655f56c6bc24d29e80

SHA256
da694c60a091e05b3bcf65b54b731fb11c87c47e8860018d43761aa524970c1d

SHA512
9eb276f77ca5d220ed551978613aee30d58b5bfdd225280d761a773ac09e2d13979632d6e2c72412132dcb3d29f01d98b2599e922809c3172beb8deeb8b4582a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f36500f8531b086a92f3dda37cd131f0

SHA1
7fb68b70e5427b2787dee6facaf568f75472b8a1

SHA256
1443732f99570483c93c0136f3ffe2cddf3b7e48f12e68c84e3cc4f0e1cf9c7b

SHA512
aa6c7161c366ef7ae9b1b0ce5ac7c1aebeca1a6f17804978bd52237b62ab792443d611520600eed20fca8fff800b3d05ecfbc5b87094027d8dd6e8cb6f4e088e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bf0803868b62c0950d200fcc97276cb

SHA1
6d3db9a671a360a6df4da9ef9489c70a97de2cb7

SHA256
5130f09ea67d2a5e564460a347b4ddec19a414899ae9ad4c82f3074c8127c6cb

SHA512
815b41386f87f4424d1e5d8dbc9e03e9e2a8581b2ddac74434f517352884ee6e600db6f559f7067e635dde972425d1bcb80862d3f98b2a09722f4cd1638d59b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8627b909e4f439cd736356db91f8758

SHA1
93c9fa9eba3502ed093abdf3b21ae3ff25c357c0

SHA256
322c677e6c620b2c97f7cc2e4f5d99a6d066ec9cc8ba490a38c60d13b17eef76

SHA512
7984bbb7c80af9d488b200659e294a98ee7cf621d9cadfb3a334d4f7a1ade497e4c84e0c6295d318032fbda4a0a5d66bb254dc409e353c3084ba59bb4e718e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8b76094d62888653eda24a6772e12b6

SHA1
272a3559b2a674d344cc411730893ed5682870ea

SHA256
ac16f677f707e96397e3c48a1817d81f06ee3fa28ecc44333876da78b9e32aea

SHA512
920556a45992a5e1cafb8c7108bfc0931a9207fd059c3076116c6711058e01d96c0f6e5f03b35a683f36ad702d4592d830db9c331a197fac59996efe55de411b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bc54aca8c8f1ec216153be680c8915f

SHA1
4edc8352590f8d8da7998ad7da131cb0d515838f

SHA256
f2ab2881e9c69a26408f2f162be62e1b0db6fbd750fe21b57d65841919ceca2d

SHA512
746dec10ec9ee78363dd3e7cc8e791dea774317cc8bdb1e73886c4625ff3aa997bad68a03145f89e48c62c0717afa58ff88fc3964ab0f4c6e31f60a9de61bbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
783c30949f2f8e85d4fa36c40f107ded

SHA1
c56108758f7c4b1cc713afbe793bc298294e5a2a

SHA256
1c6c6889a0a03e4c37bba0326e15926dd7b1234f907d828612c51f7a21836f29

SHA512
300d09ccd80a35a1d23d023298cd3530c2ae6f9425195531781d8eb6663c107b274938e9fea18f1329793c324d884d5ecf5447cef77a0f3379b5b1e397b7de9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea04f809c986fb84b666d3a8b31cde7

SHA1
da0f850329ad21a405bf553915faa76a063eeb34

SHA256
d25535f1c8547bff87a17f1dcc3a03d8aff280cc67ddccd523f94e2b929cd597

SHA512
c45275a0f6a8db77dddd818112c335db33c61e842b4a04f7af6ca4c8c994173a0887dac4171cdaebabc6efe8a10d0b18e46fc557555919d878d8090c5a1f48f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e3188aff5ab334d180b9f192fc2a528

SHA1
b2a5fdca843df03d99b71d6f2e8805f6b9487f17

SHA256
6c2a50f64c65a0f5f8abd636492fa9ff01b4317ed1352e485f7039aeb8f5ad04

SHA512
08497d3523cb68af4aebbf8acade6abf430d36bc7f21f5846f0834559954483dd037e02ef3fa07dcc8875a657c24b12a33a2e1085c5fa0e3d4966c8fc3529158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547c8496c0057a9f1c57c2f61c16653f

SHA1
58a99625b6150e1276ad8a27434b46e01764a33f

SHA256
10871f76cc57a2eddf5a2f346e9f59f61c03ed5380688d446b2d47a4ea659e54

SHA512
2b8c1296ba6cf4becb725984621e6855f64b6fa620c3e4c54e37aeddfbd7413c6fff6fa348bd99c1f6627bf370cf439dc0737dc4f46dbb9b5ff9161cff1c6be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3584.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3676.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit