d72b2a82d6fe638790121744629d584acadc40e0eca140cdc45beece812ff03d

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0a2048e3ea6c20fc056c48d1533126_JaffaCakes118.html
Size

6KB
MD5

0a0a2048e3ea6c20fc056c48d1533126
SHA1

6975389bf4be4baa0fecfafc02f4779e8f4131da
SHA256

d72b2a82d6fe638790121744629d584acadc40e0eca140cdc45beece812ff03d
SHA512

dbb46b8ca22ffeca8fb908c8c782280ae5739cc208c686ddfc2de61b8039645eff4d63bbd8cc1b43ef6eb68cbe41588f206f59d672bfa552ab985d9adbac2d35
SSDEEP

96:uzVs+ux756LLY1k9o84d12ef7CSTUSZcEZ7ru7f:csz756AYS/1b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425414428"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000505bd5b31dc64735ff2b9ba1547d298e9d363be4b3e9e7c0b0a653f62eb7fdc4000000000e8000000002000020000000be1f082104690573d5b8c05a1a2ca51ae3b3c69dc8851516624fc853df8c46c3200000004b8297d8bc2d56d96fcdd5087a094ca86ac770e75e52b11f8e8dff96b0ca924340000000041865decff8422f515f5662a88c259bbdd838418d67b19e18e56c3480b5434ebfb4e5d0e3471b426ba0234b2997aa4f2faaf097257fbe95f4c3d38cbc06ead2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80787eb661c6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000041e1615d9db1e463dee077066f54a197a5caa9bf3e8779b74165f17b0806168c000000000e8000000002000020000000e42dafba2188df85e4011223ee287684cf4f1ebb2fbd380424fa77f38b1deca59000000037927969ded99422e9ff54a9519becbf50810772cbc477a20d51890697fdf700b9cd40105ddc54b53838f1b01573adb3dcc0843dd20d8cb1ac22824fa1806a8c33630dd70289ed375ece311fc929d78cd350a481a701cb95d122004785e61cafe8bf541f14b135e6e34f1d95f9e7418842bd951ae3685435e3c4dfdf90184e19a98ca4953a80a1dda571bbef44043b3540000000f1a73bfaab7f8463baed2ca98df807e6d2ae24f6ebdd3365945580980efa609bbf34a8ce9f3524726c2766ff23f6b3f48a1d44bcb6be06d46eeb11b3697c287e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E171C511-3254-11EF-A490-4A2B752F9250} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28
PID 2108 wrote to memory of 2304	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a0a2048e3ea6c20fc056c48d1533126_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3914662a011c86b0f5fd20d5d41cf5a

SHA1
79986b242341da04a76d1bd1d444c08384f6b625

SHA256
16ebd73f83d06b68372d069c90429ca4420a1e09ff605988ce5c921613403688

SHA512
93f087fa798e5b87d69e5a76ebb87b74698b45187ae1c2c57ba07d06df41e14fde51916896d083c1dde03e4dc04a87dbfe86dc0ec453d31853bb2e14252b61d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f13fec8a06deaab421822510d358f63

SHA1
0e1549412aaeab330c8f51685cf884fad860ba20

SHA256
c04e314bc504f5cfece96e045c82f0f055050fda1c6125166522b18908f2416d

SHA512
937c3af6582c4fb47c8aa19e3f0a71afbcfca3b2afaad295743a58377a3ce2af7cc73ce72d27e02cc5c099584ba8d5ec3db0754759510604e6535136789f356f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ffdb43c87b13b32dadd29bd22b59c2d

SHA1
c4841d7973dfca58ccee85fcb80cba742511d689

SHA256
99c76a2e4c5ab9c0ff9ed49e54a6db49e8d45c90f98c0d14d247f8c3dde1c531

SHA512
c4244c39c176907ced2b7f26c256ebc973b27904d1bfac3c18d2b13001890b4e0c4b1533388b76f9808cde96a2ef5c773b8a3c6eb9427c1343b0ee667b354e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d71d12184472c1cfff7f34ba4c3313a6

SHA1
198c1e1393c6d7424dfc55219a2df15a996e6257

SHA256
817392d8b8170a370f00275cf4cac084e535e9584cfb07342497582bcbccfb77

SHA512
5ba6b45a04fdb3df0a58bed40f5abf497de5e232ce158c55ba2382dabb27fe7534d5d162b7783aea60f0ee8d57e7fe56a1b34a4d6a3f5bb6a911938b0548fded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f4aa97bb0db7510853f20f83be2651

SHA1
7f34aab865554c4962fee340d9bf0191ae5f2b55

SHA256
d91ccad2c3cafeb4a7c8ace419d0588f8c86ea6395bf15bbe2f1ad6cd47a4cf9

SHA512
b69071e5935e6027d8224fbc368490ffdef9c8a2a9231980b497d7971a9566fbe7434c4b1e691ae09ed70fdd848f9b3b2daa5a496c5d45daf31bd022c8ae6681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dfe91ea3294d509821e13a087c9fecb

SHA1
9f94147c94a16a4ff13f21cd094222c407ed2c94

SHA256
d0cd5d5eb9c40048e5aae9691cb455cffe5672d7460061afcc4ab3316f132b2a

SHA512
bc7e21868d2c0157fd6246401a30f168b6f64f5f6ef73fb4d987e910b2f8422f75f0cbd88dd9c9aacb71db4507ee26f82ea76669b27b3a6d605cae22242d4285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e614cfa24923615978d7ace900cb863

SHA1
7b9cdce9310794c52e31e098e76bb0fd21203a1e

SHA256
6450f6b46c75bb4c6b7ab185c221dec1943893e899c71ed74ca1d3dc82c5c831

SHA512
ac60d9ac3b065aa4a0383c9f09d9401f52644f453734d91fa44f7e5f83c8a43bffdc757451624e2e99f34e83a34c1eba64c8ee923a824752b1338d6f1dbc3bdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f971eeb5e5b95267a5a915e59994c944

SHA1
c96305b285209884f01d14c3b954e48fbaa205ad

SHA256
20d092d87c26d59cfb5603eec5ab45a7498ceb33b0e25f5431411b11fc2dd182

SHA512
3ac3637f8844fbad7103d0508fa3c44383eae8fdd90ab12285b1857af874cfab7f99029244c71ffd761c85751c9869f638a7183b28eabce30df3d45186d63179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77883c5a07aa2f2c773e19fe65745934

SHA1
9fd0305c2fb17371c84ffe4ce17bdbea626e9592

SHA256
42bb635a5d40cffcb9b86c6198312d062a864aae06aaf64e8dceb3967b0a4c27

SHA512
5ce67c8828d6a1020029e862ae7afa3ba0755b5e9d8dbd89ff1c04431c0e24f972f44e9f7461c15e19645f8d00d1e8c13cc983401403d403f88a58e561b91059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5ebd2ef859d159d7ce897293b86461

SHA1
f73b7c3ad170cb40f850fd63292b0772d40054a1

SHA256
8f1fc983e16907fa499a19684b5897b8b2801c2ef57894fc62509da5c5f462a0

SHA512
ec218a4937f910b5fce46af003f44cb05093f500de08270a2e91470777889522f89e97e67b51be085021fa9caa7baa901d3dcf9e147880b7efd9be43a78458bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
238bc55bb99f442865f06339ebe4ac35

SHA1
c7fdd42c7aca71a3251a2b5df2c38c1dce56945a

SHA256
28a7e808c9a2f3f8400416e2a2e5d373d515262f2a1782d390d294d1632ccc07

SHA512
80b9aca99dbfa0bf94e1ec57fa8d21bdf45f15fa57e7690eec16be822d96709a0fe8a9d02cec8449796337817a9754b3c9164bd604c326f9a4624a82251cf8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
891b736ba51a9e6c9c28ba4cd7892c8e

SHA1
271f9dac5bcf6e64725ef846b25bd564eb755ab9

SHA256
2a1043086b00bd64ac683fa1a9a684bb119eb02e174db3ef10cc5693fcac2cc8

SHA512
0360ed8ce79605a7dbf3456c8167917979cbdf042712fdfd45d57cab32b58d255c0a8f2ce6280dd42d65e63bb1dbd9a594f629f8908ba12c9b6ab2ba774345c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a17dfabf29b9ea8b81e219508d3a8978

SHA1
7107a15027320ef4399f8a22b9454e147bc5ca7a

SHA256
14e6ec5832d88bb3c93f053292db60d472d7eee8ab54cc2fcec713618f52ee38

SHA512
a5d815b9442f715182481dd00f5dc4ba56fc6e86e3130d9daaca5ffe21b208c63db8e17ee81d012960bd3f90d4807d1e180a23786e3ecbab2ef8f709e490c335

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27A0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit