b40779a971758b12e0c010eae45f68449bd5f24a6d18bbf4ddd6a408c09ddbc1

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4385fd6a532a320b74828a801af497f5_JaffaCakes118.html
Size

211KB
MD5

4385fd6a532a320b74828a801af497f5
SHA1

e9a6bfa3f6e8f609728bb51040e25e40718720e4
SHA256

b40779a971758b12e0c010eae45f68449bd5f24a6d18bbf4ddd6a408c09ddbc1
SHA512

5411830b8f15bbef524aa73bae13fb5fcca55e844d035c0e941dfb4b37cb7f766ca1980b86c31e7ab82d15eda26a76b2ddadfa6621e2d7e8480a851d9ae2b69d
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fchNLHAl17L/99/ExcZcXr3Rp:sYcZLcxx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31FA6FF1-4164-11EF-97E7-D22B03723C32} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602d102171d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000477dc97d0376c28a86fb93fe83e1de122d5c037c3df44594268b6203ddb9967d000000000e80000000020000200000006a546524d5de05dd5803de28892cbeacdf4426e8d901d9eaeef936f431c14898900000009b4ff3cbfeb09117500c744a6201b8010a403ef27524e3fe9481e2774ecde64e80bc204a7af95226b9fe8133fa8b3dccd0725ef0f22a97030407e1022095724222539bf6f139a360a96085e90eef42b82ca49abf948772c9d135981351add8a7ae3f46f792b30b3e8f1d68fdf93591cc8fa0a11a498ff15c9768e809ebef77870ca8ac52e928d7383f89e647086ad42d40000000568821d4c297a54c8fb71026ce4ef39c57433ffc8659d8c21bae09f36dfe28ddb0294e1600d71bee8ee2e495819b04c89b34a023268b635505abae66dbf8eccf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427070295"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000001aafadcac80173366da3eb61606c4b1203505adaba32ed0a9f93cf6ea4d67bd0000000000e8000000002000020000000ebb5f71395fb19979ba8b92feaabb00afc3d13998ef32491c55420344b1b24e420000000fb4f6474b2c4af708ee9bf8cc97aa42972dac086cd452253bde1a7a8d1bed0ed400000001dab2b81cad22968f22929c92d336bbd71e761f9ad3dc4142ef77729727e9577c2fdaaa56c8376322cb311f39164563e96c52e83b30bdc5e854292f001f64cfd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1404	iexplore.exe
1404	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1912	1404	iexplore.exe	30
PID 1404 wrote to memory of 1912	1404	iexplore.exe	30
PID 1404 wrote to memory of 1912	1404	iexplore.exe	30
PID 1404 wrote to memory of 1912	1404	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4385fd6a532a320b74828a801af497f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4485880e196077f442a39405881a1133

SHA1
31acc34f31d46ae003d08043969b3efa76ed7f5e

SHA256
5bffc9db9ae2c7f9d6bf1ef00b6ae26dc53c5bb09620b2f71adb3d5a5451a408

SHA512
dd48e02b9d3d40949b0d938a70524ff3df9fada8bf3f82ea2566d820e8f1b5ac6cecef41f98ca134b6912a86b696d0d028bc4685e1ceff63b336a71e00532897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d4ce431898e35eb9d7aa32460c6f5b

SHA1
3e7ebd23ccd8c38e184039a2974504825dc73a38

SHA256
6f828b7c530f98da39aede4b54f7c6b6b8d02a00428977c711c19fed569defff

SHA512
49887effd6caf08d02245405c024c8994327c8eca6c8c12bcf47f9c3d52b9eb8f24dab26b2ef2f4721a4c31ee440de8db3941a814457583ab7591a49a263aa57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767ad5658ae6e95740c26d308b985d36

SHA1
bfc16323031ca4cc7a7787596293a8389ed6c1d9

SHA256
79156acd6999700fb37f85bad3f334eb2013247afd517e12e0722555528c86ee

SHA512
d260275eb2b4ad024b60f9fd205d38193bb32eefad8347fb0ce8222ec15c17674faf904624e0d07b671da05aba7c51e174650a9ffa116986aba3a955403f6b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59367c8292a6c394006d139a576e3a74

SHA1
7ef3085fa75fd5c6fcab0d521c5e4477a71bd0e0

SHA256
1065b9eb0061efcbbf3d40b749e18df498b3e66b759c4b21d29ed0572552ef9e

SHA512
1e64a8b09d84fbec52d324fd0fa2d7db5539c929aad1fced7b08a00d0fd5c2366c208097ec9fe46747846bbad002252d234c144baa67efb0c70f5d141c198492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80afc029ed803eac9b19b2490aff1692

SHA1
19154c8f78ccc857b716de2b940dc181345b5715

SHA256
e2fa98c21cfb5b43a1fef97b6a0aa5cb0f7de4109bd9cc6237e3b4ce1156ecb3

SHA512
5750b75783d23eed7ea255164e20e9b220c207284cb1c7436c03d0ca04e7194c71692bcd6645862f0f6943281e4fb933526000bca55de96afaf9eb51892a6ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23f8fee97a0c3e63f995ba902add45b0

SHA1
39073844baed1502da75a434aa3a717a8af1d56a

SHA256
689fab3ee3b3bdd8a04df0df10fb73daeb102888830127be545ab617d60de750

SHA512
714054666d3ee1974a8ec6f9c2f74ca92645d622657b3933aee6d89293b58a4072ff3de31319f28ecc4fde53f41ebd0a2469c17e8535e6937bd6f942241e933f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4e3c50d452a5334642f5e170548e004

SHA1
b141d07a5280f73f809c92ef50676ed9025ea6e7

SHA256
2f5c0e2ae63ca94151b524244d53af34915a5994bf255ea0533ccdeef0ea964f

SHA512
e86c286a9a3ca65cdcfeb953809e5195fd1f5f3af55685cb60253ce72c7e85501c93bd3f4f9ab29d51f9ae27d0da435a65847ff7dae746ccefcc827108ba8280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec5cf4fd6e1cfc67db99b1afa4b83ca4

SHA1
c623c0492c57b49752e7a9d7c021f0216eb98860

SHA256
1cc375e78e9f316c467997768e6d62c4f657c0f66e16e4f48cdf865be9092527

SHA512
1eaa2e2c3b13ec64e445824907a10d3d341e72b1acf0dd92d08e1b9a3250d9cd971c944bcdb7284cf45ff8f35c43e8ed3f648684c3c29cae3fc0b2250d1c8b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
091e9cb1df4cf4c7136b7b2210065eff

SHA1
784a71c8e672afa75a3757c0a7fa58f34f67e927

SHA256
b8e61d6fd772d60a493c76af9b36725045cd5b9753342dd546f030c5b34df390

SHA512
2eb56cee57ab6529f06abd0c9c29ce319856fa499f12e9100e0daf04461952f2726429c1414e46c0f6f644b5d50a01ead1465c6376342a6b709cf52aa29cbf82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8835c239296fda31c8e0f907a58e6c62

SHA1
536bf09aeb06dd1f96e2d4c67fb7a029461148ce

SHA256
2dc5c22e1ffd71c0e23a4635455258d6998a396a6123f3d4eee76c4591898cf7

SHA512
af189da1f61939e544aab0fa1ab469c3e345c0802fa517ef584b0bfad623c8ae0af5fdb86a3996400717e80326a8c3b2b6748f0fdaa8afcd4820c57e71221136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
544a4d77b05f3bfbd35b173af49421b5

SHA1
b0718c009f9f733c7672045d63fcea3cb0bb0768

SHA256
77c0557b5a3ac75a48bd17fa7ea3df217062fbf3bcf510a4868cdc49916257ee

SHA512
936d3bdada74a38f60114a331e1eb55f2e3bc62a9760bcfa667525497f203e91cfdbccdd6feb2cab5fcd16395b7f51f90d792cc7ecba785db2254e1bd653d617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
108689d9971d465efd051f3c72014182

SHA1
46f0e748725530ff34c17b0456d11b0d3dce7a74

SHA256
a22b406664b687036fbb24ced22ea9c248bb819ef6e3a66918ad89cdc11a9180

SHA512
a3cafe034f9c28f49ea0cc148cf23f78823457b510f86a36371b0b9ed04a682c244e7ddd5d09f912525ced474e8b6cdd99e465726dee8a2c799944da46d4b529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a4e35d638c73c5e6e2af4737e73914e

SHA1
cf2bb2441e603613a720eb9bcdd9b183a61dd162

SHA256
78959509d5492f5f79d81224b85a386c9463bc484a1912ba3cced01ffd86b249

SHA512
e88e644be87e5a82f907c1c5f2d2a60af391e9ca9bc8c9365c89659822374a17275d34a7b92b296d089975ddc0520f01bfdbab38a26bfdf4f2be8db0aed3cb25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c1385f30853d2d214c194b9109618d

SHA1
eb294455dba77a54026b4059a4ccf5021d51477c

SHA256
fc3faee860106cddd1981c58b73d8f9a2b66b6a2033af1418763134db26b4326

SHA512
6817a80716f28614cd86b52648a11dbca885c1246d9aadcff458283b59953bcc2fe86e6575cac5872fb2ac17a4ff69cd317d8a489d6e56e7cb71c790a53a9bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77cb1fbc810ebfe66059fdcfd2c57063

SHA1
8cbe35c3d5594a717d23bd8fad226a72f9400180

SHA256
dd84e182f93a84bb73dbacc3f5b9e274bd1bca286697e7dd82f54e4ab55ed1ed

SHA512
9dd0e2a80e5c5799a18faf5797982fb5500236c98e2af800e59a93183bc672bffb5561b08142a35a82cf70fd2a804c1477143452095c97620f719ab119465066

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab57F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit