f744dabba7f4da01b212fe152cbeb0697e3a15bcd7a4f909e95a688bcdb5bd1d

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4225e1804ce8eb1d506ef08174c1bc01_JaffaCakes118.html
Size

62KB
MD5

4225e1804ce8eb1d506ef08174c1bc01
SHA1

5c2e481f0d5ae5d4950b8add544b9c1c2d4e93cf
SHA256

f744dabba7f4da01b212fe152cbeb0697e3a15bcd7a4f909e95a688bcdb5bd1d
SHA512

87c5b532d2dd0890e511f451d0832f30e3962048663c43b1b77c4c9540c17aee0b21244c042b4dc788826fa278bb74ff8b146f70d0bfff986d1342d281fec067
SSDEEP

1536:84gfvykKVuW9iiERqdklOaQdL1yHRKuVQ4n3hUkI3bpUh1:c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427044250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001276897d0a8878f3606009e99dc4d47a32265cb0db4aa757ea4de8f8594f6524000000000e80000000020000200000005dfda5ce018e2b19e77d08d10fd628bf6c9d6726585b240670d26028635c0c4590000000a5eec527f2840e40e4d1448ef6d5feb77a9a271d4bab426cabd218f485cf6c81a0ca27ad6fe9bd42cee50ae73364159a7c358d764c0b87a5e669459ae6ec3f21a706c553da04e90a61913890a18081e5e1d2dc32ec8453094d068613a59c333baa06962781edbffea27b5d2a8d5741977e2d7fc507ff6ae7f7b3bc94611eac3da00309649d9dd3e3fa7a5a8efd0e3eda4000000055edb206c32947f7806181de3f1815d9cce7b4fcb203ac1bf9c5a4fe8d9ef98009188742f455801a0019e0aa591a0e2e4e924fe99e39958d446546f49c11082f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A7C8AF1-4127-11EF-B33F-CE9644F3BBBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000cbf7d16fb53ef4d0136cf00ad0f8dc2ce05d7a95d712f6f5beb1a475ea87218d000000000e8000000002000020000000198d5dddec83553e35d63710de0020744b51909ac59ed0ddb1ccab346ec0d984200000005906f6909144420f4a4d5626856e1601b2fa403d7750f0c90073a906633cd8704000000018d7819dbb2bbd422b412e40c23bc3fcb11e2fde04c1cca86207ff6adf8c40982bf7d3238a03860753aaf805d5a38936be0d58128824a699b74b7fd65a3633fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f2ee6e34d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1292	iexplore.exe
1292	iexplore.exe
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE
1736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1736	1292	iexplore.exe	31
PID 1292 wrote to memory of 1736	1292	iexplore.exe	31
PID 1292 wrote to memory of 1736	1292	iexplore.exe	31
PID 1292 wrote to memory of 1736	1292	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4225e1804ce8eb1d506ef08174c1bc01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7c102f6d77c585e9a627b4c8e9a20c

SHA1
1c2ffe0d88bd978d17bb0f92cb3f30f0e0a36d5c

SHA256
fffc71f11c0505c1c9b3e72b93f12cf6f8fc52c71345a5ad4f4acf7d5a61d990

SHA512
f50a41bf051d89082681359aa90438d57e00987aa8c666ec81abb367dd463c4fd7d3c90c9a79fd64dda36ac91cd429f78b4c3faa3a1bafc6bf97df85e992b780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb47d0717051ba17303eeedcdca51ccf

SHA1
701aca50d61b4f4fe2cbba2ba90254bf4740463c

SHA256
e67287965ed73351420ee4fb0245fe4e9cb866d3f36357ebd57f7e3f8862afa2

SHA512
4e10debd4021a9b15aa1360077e7cf0adcbfecaf73b8f67bd26ebe3e799973b9ca9e5371b42257efa4576d36b932575251a77c19831cf00612f5d19dbc0e8e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
039440e47f5cdf4dde9b7fcd55f37ed3

SHA1
efbcfa37071bae73e55460342ab6e4f245e65316

SHA256
6fc329bf0004ffec1803b5abd4f42e1aaf46ff9f2cfa9cd438fa5c7b5cd77c3d

SHA512
da6d026a17a081e2af06b36dedd67a68647b9c81d64124256c379f430ad5ea163ab300b0f03c92d4830256a4b689a7432c02e1d8282dc84db60631a449e54e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d6148b4f6214a170076bca6b067e599

SHA1
2404b9c19c1a5476cfe74a60f3e3c58c4b628181

SHA256
d58394ec05d8c0513014a7f27c58799a9d509ce0b3f58cd3e3ec70ba7671b250

SHA512
e711c7f9650227a86b117885fa2b8d364b081c9ac164e07d3ff3e855ad095b9176cd90424965267c5bfe92898b1251c79deebff36218b7cafa6ad085123845cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d55f53930c65cb3448734b1cd29863eb

SHA1
061f0d9ada45027e45e35dd025ee23c440234487

SHA256
78d589ea1d4c4ad2bd5ef000aea3c28a735e59f5f05f760c4f9e4bc2cf8558b1

SHA512
06aff4344de35edcc85bf64ea4213a43bd81ec36ba263345169b5648e97c5e628e9d452ec05ce21edfb6596d11961bd0d8f2b1f875b412436cc26c7f2b3ef9ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a044d8d36231c776e0e4331a8388736e

SHA1
07f684bc196c4baf65396df26c838c10984123a5

SHA256
dc2abc63f9cce0eb1415f71e14f375d0e707e9c79e6725f9611d835e7a33c41f

SHA512
1e4c74962ea995264f209fdd703917ff22095f67c98340fdff180aa3df59732019666c36dcac320e49741f710daa92c7aade51554095f2d81a5f57962a229215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e7c2230b8e4509ce2267b1e2c64b439

SHA1
d304853630df7d21d0ece8f8ae10f8ea94cf8942

SHA256
70b36a508680b15af9a6db62ac163ed72c48e13e774e491ec7d9b233d0935201

SHA512
dc251ca2bcfda98f3e1e6728f8e0993a5199a945411a0e022aa5e5f6d3048e04f087bf50d7e2589f66defbc79d82e07d28b87e3cf34f8f5c82f707ceada0be4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ada3dfeabe3bad31ce0defca04f49ba9

SHA1
91bde45677c9704bba2cdfe4261955d527219f50

SHA256
b4d05a5f4ad17f37a0171b3078a598100f5ec28130eaec79efc113069639ed66

SHA512
dc0bbc77d7eb098f49c0ffd580bee86b2d7ecee30f2e1b7062ed3e0bd1befd07d92e2122135b6c16c168109839cb604081cb88245846e270bf652b798913d7cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af8e48cadbe212f6778174a12c2154d0

SHA1
d9c53fe41305b01215fcc9eb1a519ea0ebece33a

SHA256
4e953f53416ab4e352ddd59d48ea405b14d5eb989f203f99ebc159652f2fd8d2

SHA512
9dfcda28f566938687beac4aee99e66582b1f37971e55de406927a0ed350f182a3048a8a4a21149479906bdb850f2ae4b98d6299b8a9dc8ddeff3a7b294a8662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c06cb58c58c812d6e23e63ebbd0a3d54

SHA1
d3c432854db7c53ba069dce85edf6dfb7a8afc9a

SHA256
5676bac79e00bc1112f5c6cc315844d112697f20587659e380c1c8bb2b53d6cf

SHA512
37a96a617bffddcb943727870a170a109804b6899c17c0b010d814f6c2ccdaf952e2bee52150c67e5d75fddfb2ec12ddd46e0bb558a691c2a15f592c951b146c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7793d867d3938a2768c96a29792c99d

SHA1
aca6ced29416a1ceca6333fc649fd9663825f5da

SHA256
a7efe1466170cc4748d9cf3f07ac93b3e36ab7ecc1f1addf73904ceac6ec7624

SHA512
70bffff3941544bd8b341463093414f04735710cbaaa3325805e532461bb9e6fc74056f517cd7ba6d9ddfe7c43a4fa6de28e4760a6a2d46748de84f3d3cb88e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2a0410916fd5d45f39b76ee6e97054

SHA1
35a28b7a857e86467de0956102cb03dcc924f914

SHA256
6e21d2e9fa1f02a00ec3730051fb6a9349ef5e33ba24bd8033206e3a073f3033

SHA512
fdfb390b5c918362ce11c63a78394da5d31aa98635fcc71e735e15920cd58bf3da94a4cb2676a751a4863b8d0ff12730fbb65f45a6a1a0ba96d01aedabb91e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f123606feb9b1f4473330c21f0a941ec

SHA1
646bdedd7819eeef6d0f22a8d593c70266228ed8

SHA256
fb23f232f9ad633553ff5080149a5658a0f4985429a8909820e84bd8907696e9

SHA512
16e131b66d718590e471394c914b6295309813af9928d354ed80efa0a0bea1a94ce733e5c89e728727c5214edbc555189cff7e8bf018bf0ae322117af65a9e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d0fb21f3ad5ee4775291dd7d6eba0d9

SHA1
be60012efd0c7128f1acdcbcdfb0e6a97a0a97fd

SHA256
34b05fbaaf76848e5b910b01625b531e2fef9fc3380f4d11d7b06ceb3c029806

SHA512
1c6b1b16293a49c909d743eb66971f77b94de65a231c29e3e0d24ba7b50dc5990bb5a12fdbe0b0256c9c249bd1a9b247396d3ca6da1749844557bfd155c82f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
335dc84b4dd98a729d71a85a3dc69389

SHA1
d6acc8b2cec80481b09f6adcdc473c5caec18448

SHA256
a389d20d6176696ee04fb52f9e086fa80a1f76ec6bfa53c0b89942c32e5ac5c5

SHA512
4f4be3e32aaec30f41e27591596cbb515bdec58c0e4d2a95e18b118215f6749144d7b131222cf939e0b2d9edc6e7b5b0c1a9c95c51fe7de9b8d3e6229b18dce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF5B5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF695.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit