cf55f35af49081f2541fdd0f8e8573b92a00eb4a315f0b40a738ce28a1a38b64

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36963042a18bc1a84456723fdf078d65_JaffaCakes118.html
Size

31KB
MD5

36963042a18bc1a84456723fdf078d65
SHA1

835971a478ec2b80410ea45e3f671fd964598140
SHA256

cf55f35af49081f2541fdd0f8e8573b92a00eb4a315f0b40a738ce28a1a38b64
SHA512

c78dcdb3182dc8efee175dd664b870961f2c4242c7bd5396a19dda5d3135be4bbf2765f2801887c46a89c5c978f1db4bd4365637268ec642000e1f3b98288617
SSDEEP

768:Zcd9QZBC7mOdMswpC5I9nC4X3g0Ww3wawkWdvPd:gQZBCCOdE0IxC63g0Ww3waw5dvPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000deb041a027d74b9f5aff6a145b05eaa9dd76521e658bbd1b3be90d4ed9887ff6000000000e800000000200002000000068a7d57b14ddd18b70f609052489386db2f8d802de14e5c3350e550550be1785200000009dd10911cd55e7e274d9fb4592f02d2001f453e7f743eac5f6df33b3e7b7a14d40000000abd7cda20cf4dfb52351103f579334f9e6ba0f716c92b70cce94f291a32ddbc6bba124e0b264728ef6d9e8be124641f2a5a661cc4c4f6c047d725324d70c3008	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d97ff77f537c70fcc309ffc953597ceca312f0f74b5f56ba9dddc7a877322ce2000000000e8000000002000020000000f8faff1fca84292907cd45df0a284c1e1b3fc2ee59849d7a4d5cf06d955a3ef7900000003ded9443813ee4f0c1ef2e3c1cc4bb4be2563d9f44a52f00ff3112193c67979039529af4b4405e5e270e11cd77c7113a9c9ea443c2f4b3129ccfe87ebc0851e848a9870768eefa4490533852e77133263501845f5e8120be8bad2473a3778c9f241e09a0a77fd84f0fd9fb02ca4518ae5d763b75fd0e2496c79a99643c04de36b6bce055dedf3ecbcae3da106227e48040000000d672c55bfaab9f565a7496abf84ca84b4759175f535b1faad3f1ad07774b70398e1f7ec941caa5757fd4809dd4cb2b8d68211e5779d0954beb0b3f0654023c06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426811163"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7CC5901-3F08-11EF-857A-72D3501DAA0F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c43cc115d3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1124	iexplore.exe
1124	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2468	1124	iexplore.exe	31
PID 1124 wrote to memory of 2468	1124	iexplore.exe	31
PID 1124 wrote to memory of 2468	1124	iexplore.exe	31
PID 1124 wrote to memory of 2468	1124	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36963042a18bc1a84456723fdf078d65_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0997b436032369567eb811eca2a04455

SHA1
20876a5128a9de6055f8b89f59ee419093a31de0

SHA256
a5bbe7e2b865102ba05cbd473480b6a1576cb8741401d7e019cef4c5be7114fe

SHA512
216eb75bc5f9d1fcbf918afcf624070325f4b56691d44e1b7bb1d4821cb50bf7b29805f59566f5686bcd271f1daca225257a1c1d317316f2deeb6731c2e3b241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
502b2c6c134d2bdd7c20efb6f344d900

SHA1
a81350986b5efdde98c9e547311f8d872da6e83f

SHA256
64842f5297e43319bf5b86fcbfc1ebe5408d75e7ee6a94d286421dc136d581e5

SHA512
9fb6388f6362ea2383680b5d5613e8d920ab141fe13a806426a6c8ad51e27957fb9ef97809799295258476b2f987326b5441aa206feeae7d781cb6c871eb6500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf92d86b0b9a0f2ef56e340f3c3a86c9

SHA1
5e947abd7279baa6a03b263fd37e92c97e36889b

SHA256
fe8f23509fcbb7e9d3494a827ed2d7bc2433fa488096ac6b856e8589f0fcaa56

SHA512
3c256af62a449aa09326792f42e19edc85c975879f080e51c429abef78cb482baaa314c76cc88bb8504da9fe55e5767456f21ae12cfe0da6e709bbd37101e2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c903e1ea88411fdd77096fe28137a2a8

SHA1
88fe62c0ef6db8575e32c6f83258d374781759e9

SHA256
a1fce61b2633cba5eb1894b932ad96d43df7055ca6b3c1eaf6815673ca508c36

SHA512
968f74b927dddba37b2d3ca2a911e219e9af44922ace0f692d78c1d14fdddb1419a641292e76d1fa02be9f0187e006c576184a20e2afa6a80fd734fdf2e91079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3065da697dee90420f618b3d4eb3e6b5

SHA1
34050456798fbc409c29bf2cec518dc4dfd6457a

SHA256
4e16ec4f6c8e43938646d98be4fe8026205af32b5a077d80be2b6eac4799dd0e

SHA512
ce8a0840c4b3b749050496250ffe27b5c03e43cd7b7be7ef7d666d35b021d20d5b93083ce13b26d2aa2df7488582245ab72f04cc326da7b757c3f43567f631a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085d91fdbcfe37c5ab0e3baef0303a49

SHA1
2ddc8a238691437e020896a9c361e3c0b6329888

SHA256
ac3d292e367e3efc036fa93af51181c30cb344fed732f07357cc627e72debd0c

SHA512
5f192ec82f434837e6045006df1024c8cbfe4e99fb1796013c671f7a3de91947959b47cf9849fc210ad6814f44e68ef8773195579e04e5d4590e7d1f88ecd39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
076a660433f62ada9219d545706c083e

SHA1
3767f7f9c81b032e39a0c505e9b416dcd7b3efc4

SHA256
df6d5443ef5e4ad42de5dc3a0c644284bca51f2f756b7e3d075f200c166e1b81

SHA512
884543dbe9d886b0c205cdcab0a2075ac06eee7bf8823204659531aca072ee16252fe8d16c5550eb2257d8f9225305b60aaaa0eacb1f2d0f694f15f4f25d1492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93c1764ba8287a95393f4840bf1a08a

SHA1
4928a5e42ad7655ef7b0a58628d1e5f058b0ec58

SHA256
fcfb6ac5cb2dbf46c1e8a3a965c8e3e0fafb79498b0989c083cbbbb3e36a3b72

SHA512
e34faf6201a65236294fd57e5faf374712acdc197ea4b6078d1a5053efe204ae061362b8e169816d6d8af9e60bfd0bf4d4bcc31ff4da94f1c94bcec9da2a5c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46909a3eb668710dbcf1ab3e19e4c1b8

SHA1
89c15e5a1a0cf3dd39c931d4d5de909f2e3578aa

SHA256
3632d0641c2412855658bb91c137ad5c47087f18fc73e1519b1c0ba7c2ab61d1

SHA512
dee11c1f0907fe736c5b53a770c24f0b868e52d74c4f58ec8d694b034c91aab4d9164ded277cc752e530d900b80afd6c332ca1c0b913ddc91282754a3a19778a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38efd0628ddc23e374655890b1927297

SHA1
b628f9010ef5c06198739e370093ff6d77f84273

SHA256
79209ab1f7a848cca3696381dfe5365d3ebf8b6517e7b6a13dc01f6b0c27f17c

SHA512
b32a0cbf32009c9f3a7ce3369b04ff0e38151e041559d93c61295a1244278beb7c5ac789f01a6834e43b52960710a39c9c82e274bc8987d24ee79f58b6f8a171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97ac60f74d6454efd0e9b41d56ccc9c

SHA1
32f3f4876632d5cfeb0e1a4c179f4b9060076920

SHA256
62fdafe84132768b2cf9e5c18d171c03c14349a06bc577e4ec7de2912374bb68

SHA512
69433ad2100800511df1e7b7d2e29f2375d123d1c7d1c6d38894a7447239bf047de042a2929acc39e2872bb9a3f9d75c40f7de0a9420686624fd4a7c66c18690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a53c5bb9e609438021c25a4537fb1bdc

SHA1
be3465675185ddf80375d60963e1610c6bf5a7df

SHA256
8d2bf1a411aa3893d4789a471e9390e4f659ac64aadad075f6b89a297210cf6d

SHA512
93fe5f8b6d98bb64bf43eb586d65706a8f571d7bf51b61c46163ec66df4db2c8af42f647bd60b4f5de51a3e2d8f0a730c877ec280092529456d0dd8fe5add408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a254e365f568b7900827229671b9ccb2

SHA1
1b7013464f953e1ca76f020da4bbaa267d2d82f8

SHA256
5d6aca9edd148c098c3ab3adebeb5c324c5b6714e3c8220417125dec14f0c5e9

SHA512
8539b194210164aae1493376ad7d74df0f31b5bdbb97388350783e69efcbf51c660f61cdf63b7331a1a1c7208bedabaddfdbc00675fde69a144c9c9945848418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00099e557becc48bb6b8f971c06667a3

SHA1
0f3220e07776a6fc965de9497cb976c0ad3dbf89

SHA256
cbfd37a91099541d3ecf8ef7a18740dd979babbde933678a8570e1e4938a915c

SHA512
8bd3b01325720ae690295312f3f8a2cdbfef24f3d43537929f51f22fc554468742db913967a5e2c782c6922e558808fe800593ece1af48d56158c3dc610bc5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit