3a3839a0aa22c9454ca208776dd6fdccbe2b66a50607f68f543743f667276c2a

Analysis

max time kernel
147s
max time network
141s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f6d10a709497b1c2db5ebe685b1a7f3_JaffaCakes118.html
Size

6KB
MD5

0f6d10a709497b1c2db5ebe685b1a7f3
SHA1

ae7bb9c810bb907570503ec3d763d1f1402c22a5
SHA256

3a3839a0aa22c9454ca208776dd6fdccbe2b66a50607f68f543743f667276c2a
SHA512

a6b21c18e6b01d527a636845115f9925275a293f4a688e2930e4bd7d1d1d2fc5ffd93ad4ed5b2b4443252003ac79b9d55ab9f5cb5756317c2bd2de698b486f95
SSDEEP

96:uzVs+ux7XbLLY1k9o84d12ef7CSTUWwTcY/6/NcEZ7ru7f:csz7XbAYS/XWD4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000008c4e1870daa52d2af31d120035c86763dbd5eaa215e0aa8baebae99f7cecb643000000000e800000000200002000000080e12a9619783af00a0b4ac7fec8e3b36da50a65262b67c8268be19d25de3b0490000000000593624174a52069445e777950212d1858f8237c36b0bfd741a2d96d7818146f992a3628bf4871da59464329f25dbf4a94bd73e2b0899263a3239a6048afb21cc7bdef4be89aba3a4f989c6d7fc942201389f501c48d297816e2c0c1d569b6f2a59931a5c3881ab4d7228a4d5379dafd94b63b9d260fd82c473ff2601e759ab5acb0e452c8a2d1ad579357ffdb9eb840000000eac8ce796986151ad1b859634a3a96ef8eb3f3e7844b52fafe7f7fc56657d7022b77fb1e0375bdbd35942f30258cb822f9ac11e59b2db626bec6fbf6c85715b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90953ac23ec7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000eeea56044aa3dab58150e565257509aca336802112c73d081b35361205c76953000000000e80000000020000200000005a40dbd6b1f914741e182e80b0bb1a8436b803693c05bd2fdc470a79c77c8818200000009d5e269db23768223e3cda1f36d663ac46dd1938f7b55486b48a6e4be194c65d4000000062d76c8f522d342acc50fa62b57fdee254060516c5db5b80e09fb03f93892ebba984c53edbb3cf75503d77525cbb42c4a0ac48dc7a342e4c628cbc88dcc2e3cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425509339"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D47C3291-3331-11EF-B9E1-7E2A7D203091} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2424	2488	iexplore.exe	28
PID 2488 wrote to memory of 2424	2488	iexplore.exe	28
PID 2488 wrote to memory of 2424	2488	iexplore.exe	28
PID 2488 wrote to memory of 2424	2488	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f6d10a709497b1c2db5ebe685b1a7f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1324c83d07c8bb1e956eea84ebe4654

SHA1
632e0bea840e700c25d9bbf597379c5e5926cb44

SHA256
40da099946007e07278c0b64dd9ab00e58e5cdc03757dc16bbb9b6e1e1aa1719

SHA512
d6bf0a71ed68948dcf96a04fc2193e03d35c73ee881d7ea16cf29567926395884c258de508b43b5adbcf990bdeb853c8b83afd4244d2c6f88fae7c06a71838d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0c68e6763324297c76923a383233751

SHA1
c4c9b089d2422602123e352a9c2c8ab4e960a680

SHA256
d37d88a4e52b575e91cb7498c069b7093d0afface5d28cfcdef15a8c2f4c2d81

SHA512
605ee3f559697304bc2de761e2bee99ca6c0e65deed4c8269eba639c8c9237bace61cc663fb32a85d57af8af256495f69aeda83e69d1107adc8f45e06ff7db7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cddf588b88179cf395dfcc5eb684bcde

SHA1
8a29ddeefcb28e63f8fa7d9a61c6563bfae97e57

SHA256
c3be8bfc427b350c3c180ee912480e035ce1f9a83ea00593139ba50fde56b602

SHA512
a3482b1f5d50b01c719c34f1a0230c208c27c6d5e2e49ad13fec1f25c04ae6c06106ab8d1c03a15bed0d1fe939cdc4cbfa5e5b0c5b39063cc2adb908e0e56620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
171a10960f5ddb25cac18f30d32b3099

SHA1
4b7acd8242074f997abf93f1145107d5bac72aad

SHA256
ace2dcadc4d30a138c129220cd2c880a884ed2b084ae65a9350dab6d3603aa51

SHA512
2addbb47c8954eac8941cc746afaf3b5724e647e959661836f00b4a50d0cb180118539445c275edde0375cbe3f7068f55a2268d1842adfef99b712ea13e9ecd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
720c54f3323b2ffc127409d8273c75d6

SHA1
5b76daf5ac3ff9e41cf07f8ed671fbfef5c88948

SHA256
c634bcb41d4b85a965f51ef7989d35e8dab163b9c6000150c2d0ee965b3df220

SHA512
da405a27ee7557238d0dc7e6f4ff8e4c032e67d97c2d4ced4e70e259201716d7a58b8e17d79e8ba719cb2d55c9387fb2df7b61c0d0e7d426d58aec9f1a8c2e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
548386be7195870ad5a459fa1e2681bd

SHA1
ed30e87a9ef82b73c002c43363c2ce8d76349f5b

SHA256
21a6d51d9d7c4d3d3ea1cc48124fa9b14dfe9b94781370dfae4d22e908ac7de3

SHA512
4df35bb3073396c4add02c32860e14cb93900ec90d4b30bd22aa325791f53e20ad325d1cd4ece4033d91e5a6c5e06bc5a46c4006d299072c1f2a19219bc50f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fa0daeebd4add6664bf792ab531c3cd

SHA1
8437cd3f82d5b7e44a7b319bc1fabcc01df5146e

SHA256
05098d2bd43b621b39c9ae93778d497f1fef6eedd61d8e62848ae7639efed01d

SHA512
68a78a108b956bc5b22afbb9c2c4ddf27404fc516ac374d8f6996a5500df864dc76e0d5b51774947b9d1337327649ab9fc5efd93fb4ab3276592c6c9cb7cebba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3919702144fbbacb9ffc5b865112a394

SHA1
c1052e5d2548f67b92dffec3fea0c31989bed5e6

SHA256
d2511f7f259e3394acc37533ddbc94d7cf5451b37490ecdc8a5703f10b89a276

SHA512
f4ba9aaeb66f4dd1b1dd274728475878efc992e28a066bfe735634f66656d685aa73904273a409be7b4fd9b9342175863541060bc8b93b32855aee344d173ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1e00c620d9f6bebeee9ab96c4cf3151

SHA1
ec8f9acf2919d170c05ce2b649a702e4dc861e0f

SHA256
39c24c84024429361f2eede505a5888f3a34c69026d67687c5422fffe3593e40

SHA512
d4f1d59cb4565e72fbafedeb525a9aeb779335b8d488ec7422ed32141538c705fa23ce144716e009f6c35281bb77f3822d7f1afdb31a8fa357a233f4c3954bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac6567e4d284042d4a5b9092469b450f

SHA1
b9f7124e5067e2517d7ab402e30f379f98386be0

SHA256
22b08e5639c06df948fddfbb266bcd75ca50559a99aa4ae9b961e0e47808756a

SHA512
dc3a0df38e0b97d9e91bf172b33350af1007a9fd4af5932cc457b6fb71228b4bfe7d8817c2b88b42dd56a4024d696f0c4946b96c0ca67313e6b2fefa4db5af4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f90d1facecac76eab0c152d3da97014

SHA1
08a2aebad511cd9c7a291bd069e61884db156057

SHA256
3c96eb852554cdb8d4e0426c118789a4dd3e56ed8b3ba081ba1841881193174d

SHA512
96225e43dd259fab6dea408d13d2d9e27d8ebb0447b678232cd54b81c0eafc5e1fdc3ec3ced8b502301d051b4760ca6f8d8c57c3f4a015d513ac3d425269fdb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8773ba9d22bb029486ce249f3b19154e

SHA1
5c218a7c5d6678cce02bda3e6395f6906bd5ddce

SHA256
1b6b05517fc3aa8b25be6ab697c056be659de71de08755170a6001327aea7fd1

SHA512
c97e4fb632a33c6c4b39b2f92088431c4a826a74a1e7169070e78602e731b04d83efffb31078bf40f4fbb5313cb6e2555c861b6e5959cefbac5a531dc7c76ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2fb212c0117bceac34c87d308fad09

SHA1
626320a2a8cd9afd3a01b73bb2ae15bb6993876d

SHA256
034609aa6718a3718cf74977522b1b99794cc8b50692c54e35415f03b1f18c73

SHA512
1ac3d1d09f4fca3d8c2caabf7dfd814ad2aed55a5415854f84465a35205f9ff4d89d02df7b196bb01ee5e3304e70317c54cdb6f41f584215ab94421b05a7f7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
930090dbda497d5e241a780bed570792

SHA1
e51e0cb75dbd6fd802506032015037ef4df1fa74

SHA256
2e81c2136d926311abf4b6897edcca881af8facca4bf9ba5d151e9dc2facada8

SHA512
5c66a6e7e5205ee473d2cc4119d68deec9a5acabf45ce44009c8ecd38ac046e86941a6d023a975f33556061067d806ce475f5d5a1af613b49e971c4c4a526a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eb5e313a021b3c42e12c4ae8d422fc1

SHA1
e02f8dcfdfe3e577e3f6448c47073a677173d2dd

SHA256
e72bf06acab3f304cc85f6f8a607ee6e36d760ece7f314e5211745ba08146e5e

SHA512
b1b9ab9078f3fb2a33b463d68d171f7a3dba22e3592ab842a50a4552c654806e50bc2403366f30a76937cc3f2371db14a7235c0c3e8818bebb013c50ab0eed22

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6AC.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC77E.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit