5017052fb65e1b07fce8e86d30a16c1aa56c70ac186acb6cff6a9a9e7faca530

Analysis

max time kernel
138s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html
Size

27KB
MD5

3660ba95e6b63946084483292cdd54f3
SHA1

74c6ea7804833a00b7fa89b8b23d564eb0e139ef
SHA256

5017052fb65e1b07fce8e86d30a16c1aa56c70ac186acb6cff6a9a9e7faca530
SHA512

d12a57064fc0b6936ce637e564f10217f57d025e3d75c4c8010ba87809a5e0fd0b1f32dab8898d060ae8483de01c433b90a3ab80ae3471a0d8a8dc3f5a8be56d
SSDEEP

768:S6+o/xt5VPBWHnb0YILBjZWxFNlsADKGn:S6T/xt51Ob0YI1jwxFNlsAeu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E779B1-3F00-11EF-A7E7-6EB28AAB65BF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c3ab459ec0969bada9305b217d6fa3175bedc46ad3719fdc957694035278f95e000000000e80000000020000200000001e04d51cee821ec5954ac1272fff2dde848dda2414452a6f62b5969debd7b52720000000f935c7b883935dcc7da2a586853fbb8f4d1dc361354860c8a12a677626243889400000007a812cf3ded725fb4d0e69e0ef46dba7032dcb57c931dad0e66173589633f73861b7206d3cffaacca1dd0f5cef8a15f03803375a7af168e675a7d2c8f78e3bf8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807404"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703ed6ff0cd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000004cc0b400dc47fab3f0aa4a2cf4ac39c36300cf6babb0ca8e8ef55c9cb84ed97000000000e8000000002000020000000588d036ade30bc32aba16dd7f9175be97e7de19bdbea9d24aa6d27d27d6cad949000000055cf79210212ebff18cd342bc14d653b5b9fa8a766fc52b55e6efbcb562618a0732c751cd7867fd4799253eaf1b00d6af5d74804469b2cc22ad7d1e7ec6dc8afadf53261ca7f5cf8f6363fcebb78426e20eb0e46b536ad70658bef992b7130d0b67f527466da5d4002d722af86c7158cf0fbbb1b8fc0a963272f0d6ce946ddbe175433bf2b0ea72245eb6e8f4837179f40000000aa56afe64df41d19677cfdf9c6c3b18e28448c247a85f4c96325f0c372df3b6d43673897e9a498f34dc465f73fb7cef82cfee9b3438d840bb74848d15598d444	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1936 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1936 iexplore.exe
1936 iexplore.exe
2964 IEXPLORE.EXE
2964 IEXPLORE.EXE
2964 IEXPLORE.EXE
2964 IEXPLORE.EXE

pid	process
1936	iexplore.exe

pid	process
1936	iexplore.exe
1936	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1936 wrote to memory of 2964	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2964	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2964	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2964	1936	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3660ba95e6b63946084483292cdd54f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ff54f3c4fa7fea2bccc2186d091b8a

SHA1
a62f770bfcf2ac54fb1d0f1746b0aa9d3f27627e

SHA256
14e18686bb21eabcf54fc076cd15dc6805a181da65a3e37fab8a5f119c9eda28

SHA512
e89f063c61b38ef47ae110e40d104f3c3ade4b07a1b49f7d4aff1d6f20e39eb135c13aa30776126b94b494cd1fb42983e28d2e22cdefd43bb545493ac847a8e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e99fd5190510bee0804128719fc1100

SHA1
8e9fd668ff79d6b6d8a6fdf2518607935e0cafb6

SHA256
97d87d46c28c18ebcd0753c7afa1033d9c276fb7f5df97c5570edbf85548a3e5

SHA512
25127561a7167e835cf5af707fc0a3d73704c60ddd7cdb05d6c340a6f6d1788a22fe577ee2daa70962391b2efef2b723739d32020f299676da90fad7c702bb35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b03c55756b74d4688db441c29d8c6c

SHA1
90d03c351d376bdae251a5661f70a555d9aa767b

SHA256
20c0d51b290231032e8f12459e2ddd1a7491f76b615443f819fbd6d0ed0f1ffe

SHA512
3574626fb60478dec0c09c1fd6c1939d3ffe7c25b63212cbb5578f0e5a0ba63c510139d73c0c435c3ce7b62bbf2876f018f93c112adb9f238b2fce39e6152729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94efe5c2a1111688e401d78a80bbea70

SHA1
436b48022a4584e933056c15a459d3b81e74af21

SHA256
7ba14dbc5b4a13be3a4b0ce26d299924768546a023a1eada293e087da6f34f18

SHA512
a2ac26bf076141bad9b09d2f61744b368a2828efc51fdc5558a201f6ccecbeb009cf3803685e20ec93150741205361498003842e3366c6fc46d36a6d24e79b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e505bf97e3a989455bab88be095580

SHA1
10d361af44bbab63904d6d2cda5d53f8738a04c8

SHA256
762a6872df6b0983e99c4f17331563c85c58471a04391b3e5451354de174a171

SHA512
4ca73ed39c9f4d2c3043e498416c399d7c397c6ef74bf673a68655fb0069cfc1d4afa2927c0dafb068514f6e09965b6e2a110c713e6cdc0b6e19352d7d56b28e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad49db1cb03b9c5c0f62ef2d68909c8

SHA1
d4eed261d109daaa0aec2d254ae75769102b8099

SHA256
0b90f262fa1de54faa4978aedda17917650576b1efce4df8fc82f1db44b2052e

SHA512
d2f016796f38aae44b3a444ad3c492dadd59551ecbabfaac780461377396d3dc990ff58d5a700a8502f963de0a33936f128a611c339ece50595688a3d8f0e0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dafa033bc81802c762254cccfedc0a6

SHA1
7e741509b01cd98f34681c06d2c29c059bc53624

SHA256
eae19b090a65ff178feb7e4a873775db409263b351aaf106715027ada6f89f39

SHA512
b5462533c9cc77f50a2adff3d26a7e0eaaca985eeef038c1506f675302714cc16bc6eeee1d605c1e42b855f3d3b37864dbad342afcc99a9c4eeaa947b0649b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9210fb98373ba6227708aeb12886dc9

SHA1
8bf272d1b7a8502a8f2e5b2bae854f652ce4c9a7

SHA256
92d4d7f7cfab84b8da3f029f4d13d2fee1c5811aa145bf1ce82e09233f30347a

SHA512
d14d97ac8c0375b68f6517e63c21addb90f206fd6e4829fa5ac57e6fb1b3e856c7dc975073245d930c72903690a2376a69df0067936c93491aa8b09849c20688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c20a24fe2e955ab646bcf3b1b96a8f

SHA1
0259da8a13892f9fd5cca1d001ebb2b58cc2191c

SHA256
c17692bcbb9e20ebe3f85ad1ec3955ee93988cafa465c872fafa20334c535c6d

SHA512
2c22cc3231fba4642b332ce992f4fa6749ebb456c5ed2dac8b249265d7a90d808ee275574144a15d028e4705d6c81c61a2d16b22e291d30bba6bb476f8d05ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
596ef4e9b68c2d017ee0169a13d104a9

SHA1
a7a03c04dbdcc4fe2688f0befbad00663fa8e1e2

SHA256
fc7ee36c669076a76befd5a4c7e0f4652ac91eea89b63f830cb0ecee961bb60c

SHA512
bb84f2b270c13df096911ef96bf5952ca95344a4665c3f50c7bcdca4e803d74d7835ca583fee0ce19f9b6eb8c09beb161a46d01e55670e5bc7490519234f88b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0aa33fc267386cbae1ce5d433ee0602

SHA1
ea60cd9d5e2769de9e5f82d6ebf9b3a112d2b507

SHA256
81f9c95e9f86d7989982e7ed1afff685656240b747cb5ee30a142c7c896702c4

SHA512
d5d7e82217c1c8409931aa2691143785991fda8ee8a3dea6b8c30531dc811c203ac71a350dc2ad7ef984653e115864a78baeabebb2678f542245374bfbb53006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc3272a82fe5a8ec49f82014172bace6

SHA1
36be5aa15e009e46558f0bcfa6cddfd0ad268c7d

SHA256
495e078824907b1bbf940655a368eb3d5c4a1e18c113b4826c1bc3a845f869a6

SHA512
bd0be63cb7efa49e1ff6f6f4b5e4e4d35dba5916c3855146476a6894160a43f6fdecf8ef5860077f170db6c1246dbe794a5ce4fe77cc93b1a5da673b9e6f46fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5696990010907209c763f9e1c1ec4773

SHA1
84edad54dd33e2deed754984ea397747eafe4496

SHA256
7b6c6990aafb91b459cfe7d59b26004697fef6378fc66d7db2fe3d82f1e26b25

SHA512
a1037af8787137cc569d563eef2187d10375747ba0061dce19ef854f3e05982e70be74000cd8c27ef5dc9bf48c2fb6766a5d54a78661e78caa05474e6a0ee815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a078cdac74d4d1c64cea69d188844e

SHA1
520ff9921b925f711e67e2183a1f5997725f4ca8

SHA256
50c4fe9451868202c913d5d960b737363cbf97f9869da98876ee05e4176e84f8

SHA512
d024c32efae3fddebbb71197b9ddad8ca1e61c69a477448a2156c79d1a750d70ecd9c26a9b822ec12aaf0ec3d99af27196679096c8dd1f6c28ea4874ed9c774e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B34.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit