1d9514908764f458d8990a167ad09eed48cdbe2a1488c3c4248ab53dec985fec

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html
Size

77KB
MD5

400ae17b3c246acaba9d721a8c447cb5
SHA1

18a919b611906d1463436e501a209cf10211004f
SHA256

1d9514908764f458d8990a167ad09eed48cdbe2a1488c3c4248ab53dec985fec
SHA512

8656eae7b2f548d694ef4835aa0717e9b88bc456f6900df76645aae33c8748c33090658826e31f3d25f9fa5467966638988db38b0a1e22d9c1be91b4250609f7
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fc9RxHALZBL+qkbcZdcIqUp:sMirL8E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005ea17acf8a4a8d9653276e3320fa69e2eb2466a6e352abfaa4028a0669b51a47000000000e80000000020000200000007eb312e497efd170b4d8ec0ba2e9970fdc678e6aad37d4f4979edfd1d6ee8bd4200000008d8380b04f2f934320894a521fd3d1905a344fe24c0294c2f9f0cbe2a4f2406f40000000060b49bd54768c7d7c7e509561f9909e41c57e30366418e1e374c20a7623638fcb6bbe659d905e2ea3c3295a3a3ac32b906013ac10659f1918e7014ad343ebde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07b9e4ed6d4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009254170ccd7de8128a4d52a6d7b44a037ec77575baa4012ec80515a13b0398e9000000000e8000000002000020000000569792c7c5fedfe89221400391c45339fc6935ce7fcd269cbae26e424064383a90000000469bf066617f4fd87c6cd6098babb702e32345d3b2a4a1c30201cae0a143ab86e78647888090902a6518bb7ce9f1b80e5bdc8c8d9da7a67615c15aa9373faee8174ca15ba665181709957f58398fa739a2ff2097a8b674beb7e07925d801f0547b0e0c548f81524416e2427adcd57b1cabaa87635ac70589d70e04873326147c6aaf69d9ae93dda073f32cd108d2c7cf400000005b18ec229d17bb798f0e037df134e39300dc97db7491ca611a57180f807bdcbe66127aecf23856eb1265d968e7d76843c820840f0ebabc5a5517f9ed15904c32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61177C61-40C9-11EF-9EB8-6A2ECC9B5790} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427003780"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30
PID 2648 wrote to memory of 2804	2648	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a87ffb1d970a6b5fcd2fd50bad504e9

SHA1
6a7cdfc1f02901693b91e94da35875115e74abd3

SHA256
9867079d154e31a3ffa8b8af702449d37792cf89c84d2f1f64ed95b0f5196eb2

SHA512
048c9ad9e15a1377a78f5c4bdf4722cbe163b0ae1d94497fcc378f373c3e0687b6e3263d53993f6b5dfe04da105a4cc5803b7b7e04281858747a41b77b154c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c21551487b786f0c3bf27273c716e691

SHA1
a6678019623ac4e5234d51a7be251c443150ac9b

SHA256
f37a9e69fa0c2291ac50f9ee1713aedf7298d5c6540c847daf461bc05bcd82b9

SHA512
6082c6e6205db3e8c4a8d32603d2bae4d8a32e90daed454cac7198c8c46e90af73d9c8faa9448acc2286f6d5e0233eb2de0a3bffcf9eb3672ece876074ffabce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9677baa80a92b1a4bce9fce93fb972e3

SHA1
7d27e2cd9b818ddd458f7fd4257eaadba11f192e

SHA256
e378c027aeb30df68b568aec711b8a8fe2b780ef3b954a6394fae95c14db22de

SHA512
3fb370999869bfea5495aa4f9af984dd21e470e4d51188850b1e024491cd82f45168f4db760091e17f3a8d9a72e87bba93e70a7e476661328a3c2309b4c4fb2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12e3d135efa84759c6b86a34ff17be95

SHA1
23a09eacf74f9dec43d8f50aff79731e3db94d17

SHA256
18c758ea57d9044cc3eec736628112e7b4fa6373b679c62bcf0a9c9f23975098

SHA512
218db83eaa135e9908e4fbfce7f0a7b07811b712c97bc34403ab75dc6da5e1895083eeaff335ad9903b68ae0fdb197b3a4c131ade8f518e3998f63f72c4bce23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
846c760a78290f40e6ee1524f6bdbaa7

SHA1
cb2705f43b9042c67f5d3713cca1dbf27c5c6eb4

SHA256
8838f6bf4871c5b6a5d8c7fc3398dab3f3f9f452d7be7944fb164ee246fd9368

SHA512
d08fc485e6fc33d108f905d8ff6dcd0a50d2772be5e5211735f67b452b84b88f807fe3e927f5e35588a9e662455b95635b83411acc6a26be0f263ba784ae98f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
738450c1e7998406a7bcaee580b409b3

SHA1
2fb4fc9e58348f809bd5fbdf8fd8a7cbfaec3669

SHA256
312279fe4832f86e5da6fc162df833e9a0dfa1ae3cf77360621ecba7522ab1d3

SHA512
31449a511c161ac6445ad73fe068bec295dddc618ffd2a9f88cd893e19cb235080e2808fd451330add1e924fed8e5491a36f9a9bc64c4aa21e79e8930b96a458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df77b9564f00922bb37ded9819dae00a

SHA1
d7a3e7babfe69c3eca16aab12e2f6f949ea8b455

SHA256
19710e29b18bca213a9d70732ceefd04d38a243e65da2823495cb2cf9096eaf0

SHA512
793302457114265ec664f347049b8b2eebb263069ba95eaf99989aa5e854b39c57ca1e3b88c050ddbedf9359fcfd77bea9d49b7b8cf8821e629930561b0c49b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe05abd19ff3793bbfd85d8aafc498b

SHA1
d26dc991ff38f8106324dd4c9670cdc920be341e

SHA256
2409afdb72382b891a67bf0a233df0fa2def19df79198b846610c3a7b35183e3

SHA512
7310a7c8f9d6ee65d3735d5418d882e8d632f1a60ff2e243000b82563ced4c36ddeae4db6adaf6adadad4484a326a96b9c1fe8efc4b78328d41688ae29bd7a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c344b0098677bf49f9a542f39dce2795

SHA1
11a7af5f5a6b5bdd4020c084ac23d8b66bd172cd

SHA256
72f014c1c16f32a0b6cead448d59ac82cacc81cc686dc9addcd967c77c00a8ca

SHA512
8bd0581e8f139db41403c3be65c774f27bdf728a044e61b9aba7cb0a21c133bee46385c3dd76be0cf1cfb8ad353054373027ad3c120f7ca3c82b416153e2974d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a251579c08860a231af12a2dc279f5f9

SHA1
a136b81ad260cd521b6997cd4f51378df34a07e7

SHA256
15c3f87e8b0015b4e3950e9c4571aabc9a9b684b388ca68139582ea086738488

SHA512
b1732476c21c5acc9250c0b26b78a01fad667423f63fbe8a89c7a0d85264fac772aad1e284ed086dd42f02f5cf0c04fbce72ec9656c2b65485acfa5cc17121ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8da48a127db576aeccc2f47e4eecccaf

SHA1
fa492c623392c635bec430186bb7f4951a712bd8

SHA256
c8f108c02861a5a26adeeef2bb333c6d9d0945c06c9f130021679762bbb27cfe

SHA512
0eb20b9cb2e196b604a1a51e784fe561e24cc6e045d392945f3b53e0f6b0511c513374795310cde3eed16577a4dc0fa76ae134d5750c2d7c1e3f795b4a40129c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dfd4b612f9be3920fc8715ecd34a284

SHA1
722851a32e9948ff398eaebba29dba03fe0361d6

SHA256
bca7b86954bffb0d4a18ad7b2c0b7bf8c144a10220cdf5233231f0a5f0f3fa8a

SHA512
91956dd122ec8dd16b1240e78a18f5089a8a2fc075ae4e8e946fe10a78912c41f250c62adceb6293857457716140f17a03d3ad540d203539dc01d5871f9e295b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeab28311adda73edbd6fe54c1627efb

SHA1
8e2fa9c0d12dd7a5ef0ab9687abdd76c30705470

SHA256
086dd09b58a5b78dd4bde26db2013da5d692014a88a0fb534456fa587ffe8b84

SHA512
0151ac61d4d6205a644a5892e8c633454e9581f98dd9f9f242a5b3f5f5a99f7a1d94a54027d2328a3aa458778954655c3b1b2c4ff70a48d510dc11c97c669ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b76f48505fc236453d66d2197edc13b5

SHA1
0560c504fdb7a37e27eb65a258b021bb9e93c5e9

SHA256
baa5be73a0a6df2fc8c569b352b9e84c53d071e94c8fb5c058bb91f572ea9d7c

SHA512
9ca5634498c5d9ef4ce132541ef637a62dd2c6d47b1ef77ac61ad81729c84d80260bd650a4f9f740eb4516b46534c06db11dd38c542216007acd964264a834ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e04d8c321276e6e6f4f1b7499a6a27a4

SHA1
963fa0e80eb0adaf6e38f561f3e4206f4b839b7d

SHA256
e59b17036b933aa60cc07182c7cbfa661011fc35b04cd73706a0e8a1a28e82c1

SHA512
33d2b9312c640baa8a98745f94add3f33432aed70aac2f752326d3094d72900367aa04bbe04ff4089602c629a098a87fedc64619a08cb5a0d0ed69f49a473485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98e1247b3ca4917e8f5c9be9195e9525

SHA1
e17b9e0b39f3c691be4a95ca832f7c91512e4c5b

SHA256
99ab7af443abd6423d5f574845afbe6536bd4427c1c8bfcb80f7446078288b23

SHA512
a56ba6920ff0bca18f42e76e82b18e2302ff2876048e8c6dba047bf02d6912868db6330439f880518d732c349e6ef91e3f9af5eedaf40642354d59ab031c940c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit