6e5d24623c239ad77cc78918d36c441b513df74cfd0c6c04a495ac56e36fff51

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16299ca1e98250d6439c46cf8b18c423_JaffaCakes118.html
Size

22KB
MD5

16299ca1e98250d6439c46cf8b18c423
SHA1

db2b28345c79e29c3770a09fdf5f5bd4fd44edd4
SHA256

6e5d24623c239ad77cc78918d36c441b513df74cfd0c6c04a495ac56e36fff51
SHA512

8cdc6dc8ccc9a5b57aa17b95eb2403560936f5b8d0714a161ad4848029b22dac0d6ec9a3ab2066dec66131449d1166ae8947d7e2a74422093078fdbab59a9fd5
SSDEEP

384:8dXggQhaTLcfsiV/yyRgOhWa/1WauLCPggGbMBDYvuFOZ81fk9rR:8KgnkVVUOhWa9WaxxCwYvyOZ8i9rR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425656639"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d9a9f2491935ae29ef5112d63e8c6ca1c2cfc1125d245a5c138ac74b1f6d62c0000000000e80000000020000200000001a75d3332c52636c03b7703cfc10a14eede9e6eb2354eb58dcd22ec434df1597200000005f5f4df5c5a1c8258a1e0ee105f0d3da8540247902d9cbc19475015c4e7f6f3e40000000b044db58748216dc581dacf966132079ef6f333179b1f697023adbde2034e4010c8675448bc4909d61ab9ce3e37c5457c33bddcc53cf47721d0bd799dcc46d2a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000439ffbd93f8ab5d185f5f05df6cd94ece0ea62452522f696db2503f21f013c70000000000e80000000020000200000003a4656705aeed20ab45e1a7b229735b34c8689d922802a1d2d8215c53c2654c790000000394f7ae3d39c3f93e828f05ea035d80f6f3439405a4bccad1a216b9586a40e5b9af57dc3092057452bec7ef348f7f189169d33d05ee1002cb37a534aa7c6abf3fc2d6f68576ccea0d554e1c9c96a56c5db5c3bf9ed2a207adcfc74f248779c3537001b8b18091ddd96258e659bc94203c76b148d7766c168e440046768bc1b1f0c2113a98a7141b53daa3d88a078ac1340000000936a8cbcf2255fff57b0a64ef617379d0421357ada3023e61f52211e26e70246ff0b6e6dd93f2c6318b59fbbcfa59747e1fd2b3bbc165ef31f4c658b73855711	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1E28271-3488-11EF-91AC-F2A35BA0AE8D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bc8da695c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28
PID 2844 wrote to memory of 2600	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16299ca1e98250d6439c46cf8b18c423_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41c778aefde6c52b7099c85d3f8d0034

SHA1
26c6414dcfe7742acb6da39c4b37011ed5cdda95

SHA256
19f0b00e9659863c69e388422744583fdcd289669c7ca62286768e8b13ee4682

SHA512
32c4d46e94e41027298346af71e4a4513c2d1f3020c1d6e1610d1f0f1355b49ba5bc70f14a8c994fe851267a65f111320c149eaf8f02ff8dc0fa19ad3bc99913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b1bbaaa1f5f9de18632d607c7e25421

SHA1
8bc965e767d373f6ea9dca641034a981e9f48edc

SHA256
44662cd3b3e8994b029c1c3285e8d34b8d5ec4289a9f7488b51daa836ded9972

SHA512
a681e3d599f25e310f38f719a4a14722b8848c31aa1d3a714f47b668ed206af32107faa6b1042583d45f9c7aa3f82706833e91e38434c03da94f014472e6a9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ce73fed0fd1497bfce7431a59d2a31c

SHA1
4077566389dfdeaead4848379145e07add5a88c3

SHA256
4280abdca166ba5413c5cac2150f52e7b47521f29b94352a758c7cfe57746bb1

SHA512
69638f64f2a736c1562adaf74383110bb4ace068b20a3a2f2a32cafbbbe87d6f5de897e0710fac0a6cc94673c0f5578f92388ec454e4885b8a5b274c1eb1c995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7924054a583800e8d1675af0c9f2e8ed

SHA1
ca17000bd85e5c5c3b11f815b3d0396bda135cff

SHA256
0bb59930d6e1cbf837b0496d22c23075b33ff785b9d0a05272f80c3e325c3079

SHA512
f85a417159215d5dd50fdb50d272285004c6589bd1daa7a984331e2ea3ec4a57d31bdf5087a4c74ec9d67235627849a31637f284e683e379f5541d50ca6e4394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33fc865b450da9685b134a497f8ba9f8

SHA1
8323ce61d8ed3f0f770505a3393180d8181cbb32

SHA256
1792705873d3f292f220d03f3525fbe2f7684dfc115d81a521e2db11a6cfec5c

SHA512
ab5c095eed7605fb39fc682d4b79ad885d99a3b70e4f52a07ab2074393265a9a1a719349e4dedb5b6427b4691cf9c2f691c28371444b4df844044b739370069b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84539bedf67572c9f5197595efba0630

SHA1
cf2041b83d2b792d8f559eef3b11eeffc5ab413f

SHA256
792babae6698f2e3de8f0946b3abdfb4a317f57b2f7dc2f188da7de1290a58cf

SHA512
ee91253b39507f91477c6b7cbbc278656de5f37ec3d23c9c722550f97ac4c620b747ff125e8fb799374d1b4a5bd6394e0788f9f82a9ec00a50ba612ec80bd011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ddbac65281bfb426f6f1a23a676960a

SHA1
7e8a6c23c4dc193efaf52b4d2aa1318966edf3ce

SHA256
a40bcaf3c746d5d1fc24156c30af81464381afdff9b1422e0a3b436eb5ba6cff

SHA512
6e35bbcbbffa9a682bc8a504f8aafae62928b8671d16058e8670257416e1382f5b8a2b03e4e5673549fb1e43e2131aba958515592e2f408979c4d0fd5a2dfdb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4500b49a7421f03097836c4e32e2f4b0

SHA1
74d0d94df2bbac684b9e5585e2cd145ce4566b67

SHA256
a15e02a0b358652dc6309ca769082c1b567530d9374d115afa015bbfa4446eab

SHA512
0ffd0972278b483232d5815ad7ade11e6d28dbf9087c841c38c61fd58d6ed83378efecd2c6f17c477e2ffd40dca71da376962f4ea69dc4dab0eb6886346d8e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939888a4c6dee76776e6f4aa0c3fa749

SHA1
fa9fbf34ca12b389ce6dce9a77132dffce235ac4

SHA256
e898d02da9ef6652d52382ecddbfd49fa958500779d45bd827379c2d07373c88

SHA512
ff82d6e1f899761c3782dcc6b74c1023c593e6c813bba84a6e58655553c3ac647a142614aaf60ecc7b02ee9b53f370da26fb46cb30321aa7a9ec41f5214d7c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab349B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3608.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit