008cdd691e30da1b77693288378aad194b46f4105a3fe461df7a17c60d01448b

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3663e11709fbf69c64f63843647df2b1_JaffaCakes118.html
Size

9KB
MD5

3663e11709fbf69c64f63843647df2b1
SHA1

2377517d450ef0f1453dbcbee698f164d8a07005
SHA256

008cdd691e30da1b77693288378aad194b46f4105a3fe461df7a17c60d01448b
SHA512

5698b8441aa0b1022af29660e24ace1f8ac09cbdf853482b85231590bde2428d79d2eab5a6bc352d65fb00f232506b9cf9f42455521187468b0a3d1c5039d5f4
SSDEEP

192:WU3vOTWVqwPSnYtIArsPf3+1Kse7g6WXVfo4A2ZyA0mZnVI61E5AIqAIDqkiNXCg:oWVQzH+5WeuXy+AKl9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807594"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000bad3ed68075e3b721e254d444a0648131dcbfd52ba00958de4d03aea67af57fa000000000e80000000020000200000009ce84e8d689be734fe5c250d95b749fdc89a97c8cc6b9ccece1c090fb9af59b020000000ad55ca85a4624a63ede6d9c271fbab582c96111d2a5ecf06a0498d98bcf765aa40000000552bdae8f57526a21eb4105bcef4ff60d3985df9505f196c7189d3143f8a557b65eb8a20fc7e08a3a26e08bf4c2ba925ed43f5328d470597b8942a40df757623	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95892631-3F00-11EF-BC39-5E6560CBCC6E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5080306a0dd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000283c416d8f8068f2b27462bc29284c30a5e3781f559803e8a52b2781ab04c328000000000e80000000020000200000001d20fe6c8fbed28d516b88a0d9151b76d40cc644e8c004418865484abf12045090000000c6e19908b33ac10089005df81ec517d8628b03517e4aa04903f2d131d4b30baa6d1232f6534874f86c05905b15e26158a573315290c02b06c90b6ccb164fdb6f273d7f120484ce1c27adeeb4768d2e59d5b304dca5b5716e5511309277523da40f05292a7e70b374a700a91dbeba8b6e9b1a63b222b9dbb502d520cc297ca3d732f5bc32d9fa7593a545b37b6c034241400000006fb05c72ef1bcd934a47518c632a26aa7e551ce2c8640bfdb3426fdd54865e2b755e0c96cec48a5c7838b727746e19f52df12502ac760eac0d6d84fa74683fdc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2648 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2648 iexplore.exe
2648 iexplore.exe
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE

pid	process
2648	iexplore.exe

pid	process
2648	iexplore.exe
2648	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2648 wrote to memory of 2824	2648	iexplore.exe	IEXPLORE.EXE
PID 2648 wrote to memory of 2824	2648	iexplore.exe	IEXPLORE.EXE
PID 2648 wrote to memory of 2824	2648	iexplore.exe	IEXPLORE.EXE
PID 2648 wrote to memory of 2824	2648	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3663e11709fbf69c64f63843647df2b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65975904b7a241dcb6ae5496383dcc74

SHA1
641aad5657caee1f03e43b4072338aa56ec67f4d

SHA256
dc42ac857c2d24b8399e2634548b6ee055b0d452ad44ba269f0a12383b14c9a5

SHA512
65db2b6beeb30bc13c1eb8ce6f1e1db20840548aa6e027de02504dba69a5f9b8b26986cbbbe26aed47d6d26d0b448189cf27b746194abae1c5fae1f6296d9d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87f0fe2d40809109f3f239d498345a2e

SHA1
2f251512595733123fe7873e690b733207306f14

SHA256
979ccae26fa3c249063b3b5685c04b27e62d865ecc9570e5ac6606f6c477fd28

SHA512
dc84c3e74228719f7283c5015291192f3d125dc720762cc0a3c9ec090a4fd38a079f0d91228433960e874101fabc2301fa67ba2b43794530286e768582a5f9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acda40a7ecddd8ac243ced6caf041c08

SHA1
2e32981fe4142e01b7c3c2aa5f684a5449b149fb

SHA256
b8bdffb9c7b5d14bf31fe3972d214a7c1d7bb7bf5e8fcd53e62e25c1724d7e82

SHA512
c935d8af0bf616f963f9345581154bc43a18021c83e4970c0b8501e2e95e0097bb61be09282b27a5b719cfd1230259531b6f8863f8b6290724e15c8d9c89ccbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8072ec73d70875f83078f61af6d3ed94

SHA1
efac9ffd0a1bc637b6b29ccfc24d996f2d6ef28b

SHA256
c83fa7996630d05a160e8f849c977d40adacb26f7301a0fb811966432ebdf845

SHA512
d614bbdd9f5e04f0a7e55edbe1a7551f0f435fdf162b9d8aaf4af25d6bd9f889c13500af5fe1808ad70265f4385cbf65c02781cf2eb15397cdf353af3f780d7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
769a6510b28e427dcab72b50c0f8e439

SHA1
565e98455b1b56e6a16d04f97b1d580f9c7e5b51

SHA256
0bbe956126ccf69179ae642a078bc4dca843495bd4a2387582fd367715b7d3d8

SHA512
8fa0b1d55c844a2094d266a8786ae28573af26c2ea9236e6c64c1c84f00a5f43420c6b66b6738d1abe1c71aebbe05d915c3c9e9406d6e41f72ea603454839520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e1bf86b226d52ac5eb9ae1483190213

SHA1
325f55b9c5b5f73b6d9f9c4f93f37d0216250ae9

SHA256
681fb9fe55c958eb4f7a627696135161560a52abd08c2a69a42e40004376f258

SHA512
11061b43b523ad9178e03c59ff831554216a91748720c03452ee16d151de85677491729edc6d4ff696f0e7f7aaab8fe543e7cb56587bc1eccc1cc73943673fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e9607e2348f6d4567e5d233575bb8ce

SHA1
b274645f394412ab4f523ab3f37c14276280c82a

SHA256
d19604099549168271417dba446740826ed674a71567d30359a55876c49b1adb

SHA512
79e350424ad47fe0f3d4dc4cf28003c013951b0109be932cd5f2e45dcb11954e86843c2a2f26e29c82c36c3e555f2e453fd7d53239b0a8a2144cf1fadadba7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc640aae311a7e595291325748e48b3f

SHA1
13cb214fe6fbfde27a891e152b2346cf23fdb243

SHA256
8ef8ffe0c6e60456804010b4db4bf27bc5b90b456d6f9d8b179069c6c2852e4b

SHA512
3cbb8b2de354c0fa907704a9855199ce56be864efbc9905321f136cbe26a37510ad14bca9b1189c5bb445d39267178c3fdc2a301e4b16a45ee98db1f94585f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61b747493199cdd91d2a9989bc42476a

SHA1
8ec88fbd82da3197b388726969db5f13129ebaeb

SHA256
dd49ef5f5e8d684ca394e69e9e0433192b8b71814f6a37a5e77045ab723b2e4e

SHA512
f6066acbcee0634f76c430035bcc38809c7806924e672730ecd2eda8c80146e1825c6b260e7477d8679c5f4d36c2785d7a2d670acc0c3d0e75699b995753ad00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3563.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35F5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit