c61dc0b2fe59aa0fb5ccdf0b5d9ec3ab1456f8e41a70064442c7a8d4388a0efe

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

366667d4719dce2687668ab6362be75f_JaffaCakes118.html
Size

53KB
MD5

366667d4719dce2687668ab6362be75f
SHA1

b39d2b62711bd18ccc6702841c1fcadc19b3ced3
SHA256

c61dc0b2fe59aa0fb5ccdf0b5d9ec3ab1456f8e41a70064442c7a8d4388a0efe
SHA512

aed6c26c00f3887f3a086fe17fc135ede971ffecfb4e725599aac8f1980173c4024b268494c21738681b48b322daf59f96ffb7e303fb1ed2194d8dda13a02ce8
SSDEEP

1536:CkgUiIakTqGivi+PyUzrunlYH63Nj+q5VyvR0w2AzTICbb5o4/t9M/dNwIUTDmDc:CkgUiIakTqGivi+PyUzrunlYH63Nj+qQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000379e8ef7e3c9b206a1936366f7e7f549baf7acbeeef7b3524edbbb2af228a15d000000000e80000000020000200000006a2d0e243da0f5d8dd70c48ae52a7be8712a178cc231dc7b224e6c7db69a70cf20000000f84c932b62611c9ebe40a33aa335de977458e14127616951f59207294803d91a400000007382b34dded1bc3b3e3b2e53e516e0032c8000e001271bc8c7c6083861e443eb06a71a6e15be32ad3c71479c9f20c594c6fe8a2aeb7131070c99be05a6dd9068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A70F3F1-3F01-11EF-BB9C-566676D6F1CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000005a55ab11c6dd3ac0cf8eeae9cb75a20d9483144183253625f6fa658bac64023d000000000e8000000002000020000000367c087fd1631c85767120662a9aa906f0ce5ed359e43471e9a4fdf0e76de15590000000c941efd943b7240d6610d124aa55be9d21a99dd32d7a5cab6d3f246afacfaef85b3f6c9b7cfb88cabcc95312b9a65834a7dc655100c00cc16c4181d4d54f8b457171673eec04056f0c22f03248c45fe3fba5ebed2cb2839d0e4b34abf5ea475e744c13fa693c8fd6a71defd05a05a49c23e97140a789751db152d802e1a049ad6f884bf8876924536c26173e26ab545040000000837bb425ffe693224d435a5de0fd6a9f1ddec4b0b759a187f36444d4d4c2924f332d7d6a9f25f4000759c942982842cc7516c7ee55db32c2170fed81440f8b26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807812"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bcc6f10dd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2268 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2268 iexplore.exe
2268 iexplore.exe
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE
2404 IEXPLORE.EXE

pid	process
2268	iexplore.exe

pid	process
2268	iexplore.exe
2268	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2268 wrote to memory of 2404	2268	iexplore.exe	IEXPLORE.EXE
PID 2268 wrote to memory of 2404	2268	iexplore.exe	IEXPLORE.EXE
PID 2268 wrote to memory of 2404	2268	iexplore.exe	IEXPLORE.EXE
PID 2268 wrote to memory of 2404	2268	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\366667d4719dce2687668ab6362be75f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1a8ca3b4c50b6c9759f25a24162cb25a

SHA1
c28e14a61cc4adf6745f5815aafb3dbc8132acc8

SHA256
25f41ee044c2d21b508f5ecade93c2fe34c4528017f7d16f98627e443c626a09

SHA512
e48bbb48b099dc7f39715d8e2229ece3db84193fd966265e1ca1ac4153917fb58f2fcf09e508060a5e4b006425ff40567fe181007aa3b0e44c11f20d4b5a94e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9339d9e14bcdc8c23e988e5f2eed09fc

SHA1
346ecd65f4bf467a34a9baea8fd1b876ff9c0968

SHA256
33ae949a8a97750b743c5878927a6138c53ec0ae87ff4282950cd2f23f1ec557

SHA512
3c6dc4ae03306c551d9da04c2d7d0560b1d3b6af5776a699efd0a4cb1c3d28404b6d3b7a5bc9191f6d0c8e4ecf45763cf77310042f25491e0d17d30d58e9c7f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
318d0475ba2f77ead09ac569077710fb

SHA1
7b3ea169aecd3ea4de5f14b117961e0bb5d5599b

SHA256
23679e8e3bc004d6e7835385e09a6cafe968dd88ccac9b602e7021b9df9f257f

SHA512
b7dc042e0aa490d40ffe79f01e4f5e408f1b1453af45412aeb6a1c675e938c246c9b76351b8becfcaad27b085559bac55ad304f8cb11d572e95f372ba3a34839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
362b5f47775b8769cf4e5dd789b50d9a

SHA1
6c624b989bf8d7f2482d9a9bae1b164da937d304

SHA256
70217cdb09b944f421187cd8662a55346b81b1b867a985ca49e037e560aa7fda

SHA512
57858d8f0ce5ca531439e2b70a7c10bef4b407ac8e6dc78d1e5c87ed5e6ae91b954e1c60c9c842f4bc4448505ec16824e5b827fc37aa46d94f226e6f882118f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
478565e50667024c6d72a5c9403fd17f

SHA1
23baaaffb389ec1830251843d164408801da4eb2

SHA256
0324ef3f8f92d3a8a6c7bc522c88615d6ad8355f31096c712c124a69952719f3

SHA512
34b468622290a67a4c5b4aad2ffec972ec9bacfe489e610d5bb4b9ef99814195daef781d6226cff87fe5ce504b420ab345e9427a6b62acdddcce642abd28f7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8aa5c309bfda06a06ce968286fa9a40f

SHA1
52a4728727909b4d7061f84e1a3693025e9f94fe

SHA256
302200dc1e9ce43dd88fdd9b68f87654a55b9db39a31c000eb16efcf0f496d91

SHA512
eecd9db2bd24571b03b5e9932660468cac69653d6ad55928adcc3feaca6879308f49919f88dd140eab2e5fb48a48855ead71cbaa6fa1e1a40bddfbf6615d26f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
290845773cdc34d03b2671826d030acc

SHA1
6e2441136d499bb4b77f3d9a1180d6325877420f

SHA256
fa257f2b3aa71e7739cf0264c7e62889dfa8ed04d0f00333960a1132b2c94c96

SHA512
d87e727437e38ff32877ef3c78034570f1a54e2e24d09aba2f43c35c47686a15f3bbb41c3b8bda4bde97a8027dcb2f005c30a64bc41b25c774223d4fe26e789e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
769ca54f00b2b1a4b1932f640a2f6605

SHA1
4214c112bb6fde1db86911a622e8c01ec52fe337

SHA256
3f2d9208619c208c630275bb44eb9e55069c3c1cf522253fcfefb7ececee7bc3

SHA512
645a34b8be75730958bd64a1d49fa30ea51c73c3ab094bfdb8a605cbc30f930247bb063a285e7bb83a676597a670a75c7449fc30076923e6a07ec276a5757fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5cfb6049bce8fc3f61ad7683b8256aef

SHA1
d8007a58545fc7c5ffacff1f95cb5da0c4dacf24

SHA256
763a05d31b450286044a5ef2a76a3e7657b1123e10d3a8d0762d097c7165ee4a

SHA512
f8c6a1edcc809d8ae5b530db96003a19b497ea91b328f915f259d5abb9974e3589493944d8295d8bafb8d32ac19fe91eeda6945c9790a21d57acd6ff12842bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e1e4b34b124b6008f4c35d28ba0a98a

SHA1
74b9e0196b1f901b23113d236906d97db02df651

SHA256
9b7a9a0b16db1f0bb0bd5815bc1b75f00fad7bf42912069c1bbfab5a9608a127

SHA512
b0c1f6d704145383f7bd295a0e3b99214640fc221307de7c81039f40855a8b8a7b4d52c6e37325d40194d2d5f3154e2daae97838517b9f8650ab3a53c5558084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9288d2c08b9405b13d3494b6a5d47704

SHA1
3672bd00c82c553e73b5919056b391447151bc99

SHA256
31a55d405b7eb1f79e07dacb6be9404baa81b5a223ade94bfbef2ea1774bdbd9

SHA512
3b3423d69a5af62802ce7fab0dd86024631b4cc8e50029c9d45df7f91d2ac5ff661e6ac4d08efa179b86db898798fc2727923d7909e6603016e46115d6ffd0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2bd62c1025adb6f593d63e4b5d0e43da

SHA1
c19d01ad360d3253444059bc49e9d780e2770c33

SHA256
d4b489cbfa0e957966bbb37e4a737b6e3ba18e1a71a7bac58e7d9be9e9b0c3c2

SHA512
6e70b3672c40b9f3c3290549ca5c9e2bf446ddf458ba01c3bfef8a30c22404ae56cfcd66b5ff094c7fc12c7507e85963cbee68ca212b847d5e372dcd11c43744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8293811941db11026146d3c4cda173a4

SHA1
896cbac844d5dfada5f5f4c72a491360268c3752

SHA256
016ad9dd7d0f94b858d5a315fafbe8a9d89058bf55bf5957cfe13d4c33933499

SHA512
457755b777be026e4272f9102d3a759dbc0f93fb81715c03b0adf40c5557f512c5919c9072339a52d72b17e9ef5e4e6744cc854466f792e84fd66121aa2cc0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ae8c101e6a18698100f679a033552330

SHA1
85acf0b58501363c66a6feb643a75c044d808339

SHA256
79fb187b87c6cd54a19418e9552ce949d1df2b2e6208de86623bcb417cc29bc5

SHA512
93ce6caabcff01736118627fe3afe0fbd03cdb4bfdd1ab75150f955c0b0fb17ae2b4955186471abba5d5c68b6710d407474430bae152819ccbca3a366302af9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD166.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD205.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit